[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: CDP in self signed root CA




Steve,


I agree, but see my last comment. ;-)

RFC 3280 explicitly excludes self-signed certificates used as trust
anchors from the path, but not any other certificates used as trust
anchors.


Actually, trust anchors are always excluded from the path, even
if they are not self-signed. The text isn't quite as explicit on
this as it is about self-signed trust anchors, but it's clear.
Section 6.1 of RFC 3280 says:

   To meet this goal, the path validation process verifies, among other
   things, that a prospective certification path (a sequence of n
   certificates) satisfies the following conditions:

      (a)  for all x in {1, ..., n-1}, the subject of certificate x is
      the issuer of certificate x+1;

(b) certificate 1 is issued by the trust anchor;

(c) certificate n is the certificate to be validated; and

      (d)  for all x in {1, ..., n}, the certificate was valid at the
      time in question.

As you can see, the path begins with a certificate issued by
the trust anchor. It does not begin with the trust anchor itself.
If you read through the rest of section 6.1, you'll see that
only the certificates in the path (certificates 1 through n)
are validated or checked for revocation during the process.

There's no rule against checking the revocation status of a
trust anchor. Any implementation can do whatever extra checks
it wants. But this check is not part of the standard validation
algorithm as described in RFC 3280.

A copy of that last paragraph in RFC 3280 would certainly be helpful, and would have avoided that discussion. :-)

Denis


-Steve