Initial

[Dirk-Willem van Gulik <dirkx@xxxxxxxxxxxxxx>]

Apologies if this is is a very obvious question - but I've certainly  
missed it reading through the document. With respect to:
> 2.2.1.2 Required Information A requester is required to have the  
> following information configured before starting any PKI operations:
> 1. the certificate authority IP address or fully-qualified domain  
> name,
> 2. the certificate authority HTTP CGI script path, and the HTTP  
> proxy information in case there is no direct Internet connection to  
> the server,
> 3. If CRLs are being published by the CA to an LDAP directory  
> server, and there is a CRL Distribution Point containing only an X. 
> 500 directory name, then the client will need to know the LDAP  
> server fully-qualified domain name or IP address. CRL Distribution  
> Points are discussed in more detail in RFC 2459.
How does a client learn '1' and '3' in the wild. For '3' we have clear  
extensions in the very first x509 cert's you'd encounter, say during a  
802.1X signon, when you talk to the server* -- but in what extension  
is 1 passed ? And secondly - how does one learn those when the x509 of  
the first port of call (say some Radius server doing EAP) is different  
from above ?

Thanks,

Dw

*: who in the TLS exchange will flash its own cert and the chain up.