Subject: Re: Problem with PKIX part 1 basicConstraints

From: "Aram Perez" <[email-masked]>
Date: Wed, 18 Nov 1998 10:01:56 -0800

Hi Alex,

[snip]
>
>> 2) There are only 4 certificates listed on the page but IE lists 8 Verisign
>> certificates and Navigotor lists 6 Verisign certificates. Where are the
>> fingerprints for those "extra" certificates?
>
>The rest of the CA certs you see are subordinate CA's signed by the one
>of the VeriSign roots.  Applications should determine the
>trustworthyness of these subordinate CA certs by "walking the chain" and
>validating signatures up to one of these trusted root certs.   

IE lists the following certs:
1) VeriSign Class 1 CA - Individual Subsriber, Expires: Sun Jun 27, 1999
(This one does not match any information from the URL).
2) VeriSign Class 2 CA - Individual Subsriber, Expires: Sun Jun 27, 1999
3) VeriSign Commercial Software Publishers CA, Expires: Wed, Jan 7, 2004
4) VeriSign Commercial Software Publishers CA, Expires: Fri, Dec 31, 1999
5) VeriSign Commercial Software Publishers CA, Expires: Fri, Dec 31, 1999
(This is is a duplicate, don't know why Microsoft would do that :(
6) VeriSign Individual Software Publishers CA, Expires: Fri, Dec 31, 1999
7) VeriSign Individual Software Publishers CA, Expires: Wed, Jan 7, 2004
8) VeriSign Individual Software Publishers CA, Expires: Fri, Dec 31, 1999
(Another duplicate)

Navigator lists the following certs:
1) Verisign Class 1 Primary CA, Expires: Fri Dec 31, 1999 (This one matches
except it states the cert is valid starting Mon Jan 29, 1996)
2) Verisign Class 1 Primary CA, Expires: Tue Jan 7, 2020 (This one matches
except for 'Tue' not 'Mon' and it has a serial number which you do not list)
3) Verisign Class 2 Primary CA (similar to 1 above, also it appears that
Navigator main list of certificates only shows the "main" name, but when you
try to "Edit" the certificate, Navigator lets you chose one of two
certificates with the same name).
4) Verisign Class 3 Primary CA
5) Verisign Class 4 Primary CA (Not listed on the URL)
6) Verisign/RSA Commercial CA (Not listed on the URL)
7) Verisign/RSA Secure Server CA

Regards,
Aram

---

From: Alex Deacon <[email-masked]>
Date: Thu, 19 Nov 1998 11:55:40 -0800

Aram,

The Authenticode CA's slipped my mind.  I'll let the list know when this
page has been updated.

Thanks!
Alex