Subject: Revocation status checking of self-issued certificates

From: Brian Hunter <[email-masked]>
Date: Wed, 18 Jun 2003 18:15:40 +0200

Hello,

I have a question of whether self-issued certificates need to have their
revocation status checked.  I am referring to only intermediate or path ending
self-issued certificates and not trust anchors.

I have read through some PKIX discussions, in particular "Identifying the right
CRL for a given certificate", where Santosh seemed to imply that no check was
required:
  2.  The DNs for the certification path for the certificate should match
  the DNs for the certification path for the CRL (ignoring self-issued
  certificates).  Of course, the last DN (namely the subscriber DN) will
  be missing from the CRL certification path.

(This is not exactly the same context, but I believe similar.  I take "ignoring
self-issued certificates" to imply that there would be no revocation checks for
them.)
Another discussion, "CDP in self signed root CA", dealed only with root CAs.

I see the benefit of both, no checking saves time and rather redundant checks. 
The self-issued certificate could be revoked by having the original CA
certificate revoked, this is however costly.  Doing revocation checks allows the
CA to revoke individual self-issued certificates itself, without having to have
its own certificate revoked, provided that the self-issued certificate wasn't
the one delegated to be used as a CRLIssuer.

However by reading X509 and RFC3280, it says to me that the status of all
self-issued certificates must be checked.  (Self-issued certificates tend to be
excluded from such things as name constraint processing and path lengths, but
not status checking).

Could someone help clarify this for me, whether these certs need to have their
revocation status checked?

Many thanks,
Brian

---

From: "Matt Cooper" <[email-masked]>
Date: Wed, 18 Jun 2003 18:15:26 -0400

Brian,

I think what Santosh was saying is the names in the cert path should match
the names for the CRL's cert path, irrespective of traversing a self issued
certificate on one or the other.

For example, this would be ok - 
====================================
CertPath: A->B->C->Target Cert
CRL Path:  A->B->B->C->CRL

This is not ok:
====================================
CertPath: A->B->C->Target Cert
CRL Path:  A->C->B->C->CRL

You might end up with the first example as the result of a rekey.

Best Regards,
Matt Cooper

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Brian Hunter
> Sent: Wednesday, June 18, 2003 12:16 PM
> To: [email-masked]
> Subject: Revocation status checking of self-issued certificates
> 
> 
> 
> Hello,
> 
> I have a question of whether self-issued certificates need to 
> have their revocation status checked.  I am referring to only 
> intermediate or path ending self-issued certificates and not 
> trust anchors.
> 
> I have read through some PKIX discussions, in particular 
> "Identifying the right CRL for a given certificate", where 
> Santosh seemed to imply that no check was
> required:
> (This is not exactly the same context, but I believe similar. 
>  I take "ignoring self-issued certificates" to imply that 
> there would be no revocation checks for
> them.)
> The self-issued certificate could be revoked by having the 
> original CA certificate revoked, this is however costly.  
> Doing revocation checks allows the CA to revoke individual 
> self-issued certificates itself, without having to have its 
> own certificate revoked, provided that the self-issued 
> certificate wasn't the one delegated to be used as a CRLIssuer.
> 
> However by reading X509 and RFC3280, it says to me that the 
> status of all self-issued certificates must be checked.  
> (Self-issued certificates tend to be excluded from such 
> things as name constraint processing and path lengths, but 
> not status checking).
> 
> Could someone help clarify this for me, whether these certs 
> need to have their revocation status checked?
> 
> Many thanks,
> Brian
>

---

From: Brian Hunter <[email-masked]>
Date: Thu, 19 Jun 2003 21:16:28 +0200

Matt,

Thanks for correcting my comment on Santosh's comment.  However, it still leaves
my original question open, that is, what is done in regards to revocation checks
for self-issued certificates.  Any comments?

Regards,
Brian

---

From: "Matt Cooper" <[email-masked]>
Date: Thu, 19 Jun 2003 17:58:00 -0400

Hi Brian,

Sorry for the lack of clarity;  Skipping CRL checks for intermediate self
issued certs would not be desirable.

-Matt

> From: Brian Hunter [mailto:[email-masked]] 
> Sent: Thursday, June 19, 2003 3:16 PM
> To: Matt Cooper; [email-masked]
> Subject: Re: Revocation status checking of self-issued certificates
> 
> 
> Matt,
> 
> Thanks for correcting my comment on Santosh's comment.  
> However, it still leaves my original question open, that is, 
> what is done in regards to revocation checks for self-issued 
> certificates.  Any comments?
> 
> Regards,
> Brian
> 
> Matt Cooper wrote:
> > 
> > Brian,
> > 
> > I think what Santosh was saying is the names in the cert 
> path should 
> > match the names for the CRL's cert path, irrespective of 
> traversing a 
> > self issued certificate on one or the other.
> > 
> > For example, this would be ok - ====================================
> > > I have a question of whether self-issued certificates 
> need to have 
> > > their revocation status checked.  I am referring to only 
> > > intermediate or path ending self-issued certificates and 
> not trust 
> > > anchors.
> > >
> > > "Identifying the right CRL for a given certificate", 
> where Santosh 
> > > seemed to imply that no check was
> > > required:
> > >   2.  The DNs for the certification path for the 
> certificate should 
> > > match
> > >   certificates).  Of course, the last DN (namely the 
> subscriber DN) 
> > > will
> > > (This is not exactly the same context, but I believe similar.  I 
> > > take "ignoring self-issued certificates" to imply that 
> there would 
> > > Another discussion, "CDP in self signed root CA", dealed 
> only with 
> > > root CAs.
> > >
> > > I see the benefit of both, no checking saves time and rather 
> > > redundant checks. The self-issued certificate could be revoked by 
> > > having the original CA certificate revoked, this is 
> however costly.
> > > However by reading X509 and RFC3280, it says to me that 
> the status 
> > > of all self-issued certificates must be checked. (Self-issued 
> > > certificates tend to be excluded from such things as name 
> constraint 
> > > processing and path lengths, but not status checking).
> > >
> > > Could someone help clarify this for me, whether these 
> certs need to 
> > > have their revocation status checked?
> > >
> > > Many thanks,
> > > Brian
> > >
>

---

From: "Dean Adams" <[email-masked]>
Date: Tue, 24 Jun 2003 14:46:25 +0100

Hi,
	In some recent tests with IIS 5.0, I am led to suspect that if end-entity
certs have a CDP, then IIS wants to do revocation checking all the way up
the chain - including the self-signed root.  Can anyone else confirm or
correct this?

Dean Adams

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Brian Hunter
Sent: 19 June 2003 20:16
To: Matt Cooper; [email-masked]
Subject: Re: Revocation status checking of self-issued certificates

Matt,

Thanks for correcting my comment on Santosh's comment.  However, it still
leaves
my original question open, that is, what is done in regards to revocation
checks
for self-issued certificates.  Any comments?

Regards,
Brian

Matt Cooper wrote:
> > subscriber DN) will
> > redundant checks.