Luckily in these cases, you may know other entities that trust it, so you can decide to trust it based on association. This is known as the certificate chain of trust. Version 2 of X.509 supported only the X.500 naming style, and many of us have spent an inordinate amount of time creating X.500 naming structures because we were told this was what all of the key technologies will use. As work progressed on version 3 of X.509, however, other naming structures were recognized as valuable both to have as an X.509 certificate identity and because X.509 would be significantly restricted if other forms were not supported. Finally, these certificates need to be exchanged between parties.
Names are critical in finding the certificates either in a repository or in direct exchange.
The choice of name structure has important implications on the use of e-mail syst ems. A similar situation surrounds the use of X.509 certificates in IPsec, which can use certificates to establish trust before starting a secure session. For the next year, IPsec will be used primarily as a tunnel between hosts, so it will need trusted identification of the hosts. In this case, DNS or an IP address will be the preferred choice. This multiple naming environment will require careful planning.