Subject: RE: Reverse paths

From: Sharon Boeyen <[email-masked]>
Date: Fri, 21 Jul 2000 11:26:55 -0400

OK, I think we've cleared up the confusion. 

So what I'd propose is the addition of a sentence along these lines:

If a CA issues a certificate to a CA that is not a subordinate to the
issuing 
CA, the issuing CA must place the certificate in its own directory entry in 
the crossCertificatePair attribute as a value of the reverse element.

Is that ok?

Sharon

> -----Original Message-----
> From: Stephen Kent [mailto:[email-masked]]
> Sent: Friday, July 21, 2000 9:41 AM
> To: Sharon Boeyen
> Cc: [email-masked]
> Subject: RE: Reverse paths
> 
> 
> Sharon,
> 
> >Steve,
> >I don't think I've been able to clearly describe what I meant. I am
> >NOT proposing ANY additional certificate issuance by anybody. I think
> >the terms reverse and forward are very unfortunate and always confuse
> >these discussions. Can we chat offline just to make sure that you
> >understand what it is I am proposing. Email makes this type of
> >discussion difficult at best.
> >
> >Within a hierarchy I don't believe any change is required. 
> If the root
> >of a hierarchy issued a certificate to some CA that is NOT a 
> subordinate
> >of the root, then currently PKIX does not require the root 
> CA to place
> >that certificate in the root CA's entry. What I am proposing is that
> >such a certificate, IF ISSUED, be placed in the issuer's 
> entry as well
> >as in the subject CA's entry.
> 
> Ok, I think this clarification makes me more comfortable.
> 
> Steve
> 
> P.S.  All the negative comments about bridge CAs in my previous 
> message still apply.
>

---

From: Stephen Kent <[email-masked]>
Date: Fri, 21 Jul 2000 11:52:18 -0400

Sharon,

>the crossCertificatePair attribute as a value of the reverse element.

Sounds OK to me.

Steve