-----BEGIN PRIVACY-ENHANCED MESSAGE-----
Proc-Type: 4,MIC-CLEAR
Content-Domain: RFC822
Originator-ID-Asymmetric: MEYxCzAJBgNVBAYTAlVTMSQwIgYDVQQKExtUcnV
zdGVkIEluZm9ybWF0aW9uIFN5c3RlbXMxETAPBgNVBAsTCEdsZW53b29k,02
MIC-Info: RSA-MD5,RSA,DZLk4MLUeil5XKhFUwWXkTt5WSxVNN2SGidQnKUK0/Z
QFYHvAkF7RiceDum1BDLCmbD3psWcaJ/GS45ZG/5XZQ==
The DN subordination requirement does not apply to the
relationship betw. PCAs and CAs and betw. the ICIR and PCAs.
But in an implementation, how is one to know when one has hit a
PCA certificate?
An implementation would know if it knew the IPRA public key (or
certificate) a priori. (Yes, the name of the "root" has changed yet
again. The previous acronym is being used -- IPRA -- but it now expands
to Internet PCA Registration Authority.) Only PCAs are certified
immediately under the "root".
Jim
-----END PRIVACY-ENHANCED MESSAGE-----