Subject: Comments on RFC 3280bis-04

From: "Wen-Cheng Wang" <[email-masked]>
Date: Wed, 5 Jul 2006 18:51:57 +0800

The definition of the term 'self-issued certificate' does not take
account of the possibility that a self-issued certificate might be
an EE certificate.

For example, a CA might issue a certificate to itself for used
by its RAs to check the CA's signature of the CMP messages. This
kind of certificate will not contain a basicConstraints extension,
and therefore be an EE certificate.

Another example is a CA might itself act as an OCSP responder.
In that case, the CA will issue an OCSP responder certificate to itself.
(The issuer name and subject name of the OCSP responder certificate
are the same.)
In general, an OCSP responder certificate is considered an EE
certificate.

In the last para of section 4.1.2.4, it defines the term 'self-issued
certificate' as:
   If the names in the issuer and subject field in a
   certificate match according to the rules specified in section 7.1
   then the certificate is self-issued.

According to this definition, an certificate with its the issuer and
subject field matched is a self-issued certificate, no matter whether it
contain a basicConstraints extension with the cA boolean is
asserted.

Therefore, in practice, a self-issued certificate could be a
a self-issued EE certificate if it is a v3 certificate with
the basicConstraints extnesion absent or it contains
a basicConstraints extnesion but the cA boolean is
not asserted. Unfortunately, the current text of RFC 3280bis
is written as if a self-issued certificate must be a CA certificate.

I think RFC 3280bis should clarify this. I suggest that at least the
following note should be add to the end of section 3.2:

  Note that, a CA might sometimes issue end entity certificates to itself
  for some special purposes such as for providing CMP signing certificate
  to its RAs. In general, the basic constraints  extension will is not present
  in such certificates, or the extension is present but the cA boolean is not
  asserted. Therefore, as discussed in 4.2.1.9, the certificate must be
  treated as an EE certificate, even if its issuer name and subject name
  is the same.

(Feel free to retouch my awkward english.)

In addition, the path validation logic in section 6 needs to be checked
thoroughly  to make sure it can correctly hadle situations where
self-issued certificates are EE certificates.

Finally, there is a typo in page 100:

In para 3 of section 10, the term 'certificate practice statement'
should be 'certification practice statement'.

Regards,
Wen-Cheng Wang