RE: DPD & DPV requirements

[Frank Balluffi <frankb@xxxxxxxxxxxx>]

Frank Balluffi said:

> >The client should supply some subset of each requested path 
> which must
> >include the least significant certificate and optionally:
> >
> >- one or more intermediate certificates
> >- one or more trusted certificates

Steve Kent said:

> An intermediate cert that is not trusted, but is not the end of a 
> partial path?  Why?  This is getting complicated.

OK. It is difficult for me to imagine a client supplying intermediate
certificates. But requirement 1.1 only supports a single certificate or a
chain:

1.1     A client request can contain a single certificate or a certificate
chain terminating in the "target" certificate, to assist the server in path
construction. 

Would it be valuable for a client to be able to supply the end-entity
certificate and the trusted certificate in the path?

Frank