Subject: Re: Path validation and self-signed certificates

From: Peter Sylvester <[email-masked]>
Date: Mon, 27 Aug 2001 19:55:47 +0200 (MET DST)

> This makes path discovery even harder than it was before. If we
> require that self-signed certificates be forbidden or ignored in
> PKIX path validation, none of this will be a concern.
> 

Why does PKIX need to say something that is essentially
already in X.509? Aren't self-signed certificates of type a)
ignored for path validation in X.509?

---

From: Steve Hanna <[email-masked]>
Date: Mon, 27 Aug 2001 15:04:11 -0400

> ignored for path validation in X.509?

Most of son-of-2459 is already in X.509. The purpose of our
document is to provide a profile of X.509 suitable for the
Internet. Why mention name chaining or signature checking in
son-of-2459? Because they're part of our profile.

Even if we decide to adopt the X.509 behavior and ignore
self-signed certificates, we should still mention that in
son-of-2459. It's not reasonable to expect people to figure out
that some requirement is part of the PKIX profile just because
there's one sentence on page 31 of the X.509 spec that explains it.

I'm suggesting that we add an additional requirement to our
validation algorithm, as we have done before by requiring
that the Issuer field MUST contain a non-empty distinguished
name (for instance). This requirement would be that the path
not contain any self-signed certificates.

-Steve