Re: Questions on Authority/Subject Key Identifiers

[pgut001@xxxxxxxxxxxxxxxxx (Peter Gutmann)]

Stephen Kent <kent@xxxxxxx> writes:

>The real world issue you describe calls for re-issuance of certs; it does not
>justify violating the standards.

In *theory* it calls for the re-issuance of certs.  I can quite easily see
that the practical approach would be to chain by sKID, and obviously enough
people agree with this that they persuaded MS to change the behaviour of their
code to allow it (the issue you're referring to was a bug, not a deliberate
design decision like sKID chaining).

Peter.