Subject: Re: [pkix] 5280 clarifications

From: Peter Sylvester <[email-masked]>
Date: Thu, 22 Mar 2012 20:05:56 +0100

Sharon Boeyen wrote:
>
> As the past editor of X.509 and someone whose history participating
> in the X.509 standards group goes back 25 years to 1987, I'd like
> to confirm that the X.509 model (going back all the way to the first
> edition published in 1988) is one where public key certificate
> signers/issuers are exclusively CAs. Therefore the first two sentences
> in the new proposed text below are a correct interpretation of X.509.

"public key certificate signers/issuers are exclusively CAs" has at least two
interpretations? :

1 -  only a CA can sign certs
      (if you have some other, maybe nontechnical, definition of CA)

2 -  Any entity that appears as issuer, is a CA
      (a technical definition of a CA).

I tend to think that the way to read x509 88 version
is pretty close to the second interpretation.