Policy-Discussion

["Sam Johnston" <samj AT samj.net>]

On Thu, Oct 16, 2008 at 6:03 PM, maurice Kellenaers <maurice AT gkbikes.com> wrote:

maybe a strange idea, but is there a way to say :  "verified by Acme, who is verified by CAcert.org" or something like this?
that way Acme can use cn="" at their discretion in their cert while CAcert MAY/COULD ask to evaluate/verify the cn= of the cert.

That is *exactly* what is proposed - the user will see 'Sam Johnston verified by Australian Online Solutions' or some such thing and if they look at the chain they will see that the reason their browser accepted this assertion is because Australian Online Solutions was verified by CAcert, who is satisfied that they are who they say they are and that they will follow the rules when requesting certificates be issued by CAcert on their behalf using their escrowed root.

The alternative (and status quo) is to say 'Sam Johnston verified by CAcert' even though CAcert has not had anything to do with the individual.

Sam