Re: Correct approach to certificate validation?

[Rich Salz <rsalz@xxxxxxxxxxxxxxxx>]

Al,

You're saying that the current deployed base of CA's ensures that
the issuer DN of certs they issue is exactly the same as the subject
DN of its own signing cert?  If my understanding is correct, not
only do I strongly concur, but I don't know of any product that
works otherwise, in the course of normal operation/default config.
Does anyone know of a product that doesn't?

Even if there is one, it doesn't matter.  And if the standard is 20
years old, it doesn't matter (heck, TCP's older than that).

Generally speaking, "that's what everyone else does" is the kind
of argument that, in the IETF, generally trumps anything else.
Trevor, I thought you've been around long enough to know this.
	/r$