Re: Clarification request on RFC 2560

["David P. Kemp" <dpkemp@xxxxxxxxxxxxxx>]

Is that 99.9999% of all PKI programs (i.e. SSL clients, which are forbidden
from handling cross-certification*), or 99.9999% of those PKI programs,
such as S/MIME, whose specifications are not so short sighted as to forbid it?

Dave


* SSL 3.0: "certificate_list - This is a sequence (chain) of X.509 certificates,
            ordered with the sender's certificate first and the [sender's] root
            certificate authority last."



Rich Salz wrote:
> 
> > An OCSP client might assume that only a single certificate corresponds
> > to the responder ID and for example just look for the first certificate
> > in the certs attribute which matches the reponder ID and verify that.
> 
> I think most -- like 99.9999% -- PKI programs are not equipped to handle
> cross-certified entities.
>         /r$
> 
> --
> Zolera Systems, Your Key to Online Integrity
> Securing Web services: XML, SOAP, Dig-sig, Encryption
> http://www.zolera.com