Re: encoding an X.509 certificate

[Paul Hoffman <paul.hoffman@xxxxxxxx>]

At 4:13 PM -0500 11/9/08, Russ Housley wrote:
>Anders:
>
>>Couldn't somebody setup something like W3C's HTML validator but for X509 certificates?
>
>I do not know what the W3C HTML validator does, but I aware of the NIST PKI testing:
>
>http://csrc.nist.gov/groups/ST/crypto_apps_infra/pki/pkitesting.html

The W3C Validator (<http://validator.w3.org/>) is an online mechanism for people to see whether a web page is valid HTML or XHTML. Some people like showing that their HTML is valid by checking it every time it changes and, if shown valid, put up a cute little logo on their web page.

The NIST PKIX test system is an offline system. I think Anders was hoping that, by putting up an online system, the problems mentioned in this thread might be reduced because CAs issuing certificates could check if they are valid. However, as Peter points out, there seems to be little interest on the part of the CA vendors to enforce the rules of X.509 and PKIX.

Creating a local validation tool inside a CA vendor's lab is trivial. The assumption that individual CA vendors don't know about their lack of conformance to the specs is dubious at best.

--Paul Hoffman, Director
--VPN Consortium