Subject: [pkix] new text for 5280bis, Section 3.2

From: Stephen Kent <[email-masked]>
Date: Tue, 31 Jul 2012 15:37:32 -0400

Another version, incorporating Peter's suggested text*
*

*2.Update to RFC 5280, Section 3.2: Certification Paths and Trust*

***Add the following paragraph to the end of RFC 5280, Section 3.2:*

***In some cases, a self-signed certificate that does not contain a 
BasicConstraints extension is used to convey a public key. Consistent 
with Section 3.4.61 of X.509 (11/2008) we note that use of self-issued 
certificates and self-signed certificates issued by other than CAs are 
outside the scope of this specification. Thus, for example, a web server 
or client might generate a self-signed certificate to identity itself. 
These**certificates, and how a relying party uses them to authenticate 
asserted identities, are both outside the scope of RFC 5280.*

Comments?

Steve

---

From: Santosh Chokhani <[email-masked]>
Date: Tue, 31 Jul 2012 15:56:18 -0400

Steve,

I think putting this in Section 3.2 may give the impression that a trust anchor need to have basic constraints extension.

How about the following:

Consistent with Section 3.4.61 of X.509 (11/2008) we note that use of self-issued certificates and self-signed certificates when issued by entities other than CAs are outside the scope of this specification. Thus, for example, a web server or client might generate a self-signed certificate to identity itself. These certificates, and how a relying party uses them to authenticate asserted identities, are both outside the scope of RFC 5280.

From: [email-masked] [mailto:[email-masked]] On Behalf Of Stephen Kent
Sent: Tuesday, July 31, 2012 3:38 PM
To: pkix
Subject: [pkix] new text for 5280bis, Section 3.2

Another version, incorporating Peter's suggested text
2.  Update to RFC 5280, Section 3.2: Certification Paths and Trust
Add the following paragraph to the end of RFC 5280, Section 3.2:
In some cases, a self-signed certificate that does not contain a BasicConstraints extension is used to convey a public key. Consistent with Section 3.4.61 of X.509 (11/2008) we note that use of self-issued certificates and self-signed certificates issued by other than CAs are outside the scope of this specification. Thus, for example, a web server or client might generate a self-signed certificate to identity itself. These certificates, and how a relying party uses them to authenticate asserted identities, are both outside the scope of RFC 5280.

Comments?

Steve

---

From: "David A. Cooper" <[email-masked]>
Date: Tue, 31 Jul 2012 15:58:03 -0400

What is the reason for the first
sentence in the proposed paragraph?  It doesn't seem to be at all
related to the rest of the paragraph.

On 07/31/2012 03:37 PM, Stephen Kent wrote:

2.  Update to RFC 5280,
Section 3.2: Certification Paths and Trust

Add

the following paragraph to the end of RFC 5280, Section 3.2:

In
some cases, a self-signed certificate that does not contain a
BasicConstraints extension is used to convey a public key.
Consistent with Section 3.4.61 of X.509 (11/2008) we note that
use of self-issued certificates and self-signed certificates
issued by other than CAs are outside the scope of this
specification. Thus, for example, a web server or client might
generate a self-signed certificate to identity itself. These
certificates, and how a relying party uses them to authenticate
asserted identities, are both outside the scope of RFC 5280.

Comments?

Steve

---

From: Peter Sylvester <[email-masked]>
Date: Tue, 31 Jul 2012 23:13:42 +0200

On 07/31/2012 09:37 PM, Stephen Kent wrote:

at least two bugs

s/generate/use/

s/identity/identify

> ***In some cases, a self-signed certificate that does not contain a BasicConstraints extension is 
> used to convey a public key. Consistent with Section 3.4.61 of X.509 (11/2008) we note that use of 
> self-issued certificates and self-signed certificates issued by other than CAs are outside the 
> scope of this specification. Thus, for example, a web server or client might generate a 
> self-signed certificate to identity itself. These**certificates, and how a relying party uses them 
> to authenticate asserted identities, are both outside the scope of RFC 5280.*
> Comments?
>
> Steve
>
>
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix

---

From: Stephen Kent <[email-masked]>
Date: Tue, 31 Jul 2012 17:52:30 -0400

> On 07/31/2012 09:37 PM, Stephen Kent wrote:
I think "generate" is appropriate. 5280 imposes rules on entities that 
signs certs
and these are self-signed certs. "Using" certs is too ambiguous.
> s/identity/identify
whoops. you're right here!

Steve