pem-dev
[Top] [All Lists]

Re: DN subordination

1993-11-13 14:28:00
Unless you are prepared to display complete certification paths 
for users, the name subordination requirement is necessary to 
prevent the last certificate in a chain from spoofing a user.  The 
reason that 1422 does not completely preclude non-subordinate 
certification by CAs is to allow the same infrastructure to be 
used for more than PEM.  Thus the name subordination requirement 
is enforced by UAs.

Actually, I do always display complete chains.  However, the issue of
how to get residential CAs to work in a DN subordination environment
still remains.

I've taken a compromise stand of not requiring subordination between
top layer CAs (directly beneath PCAs) and the next layer and will
adopt this scheme unless the residential CA issue can be resolved.

 -Ray

<Prev in Thread] Current Thread [Next in Thread>