Subject: Re: Sample end entity certificate

From: "Moudrick M. Dadashov" <[email-masked]>
Date: Mon, 15 Jan 2007 03:31:51 +0200 (EET)

Russ,

but RFC 2119 also does say:

"OPTIONAL", mean that an item is truly optional. One vendor may choose to
include the item because a particular marketplace requires it or because
the vendor feels that it enhances the product while another vendor may
omit the same item (section 5).

and RFC 3280 also say both the "key usage" and "certificate policies"
extensions are OPTIONAL

Don't you think this is some how confusing?

Thanks,
M.D.

> RFC 3280 does say:
>
>     Conforming CAs MUST support key identifiers (sections 4.2.1.1 and
>     4.2.1.2), basic constraints (section 4.2.1.10), key usage (section
>     4.2.1.3), and certificate policies (section 4.2.1.5) extensions.
>
> It does not seem to require that these be included in every
> certificate that is issued, but looking further into these sections,
> I find a MUST statement that is not supported by this certificate:
>
>  From section 4.2.1.1  (Authority Key Identifier):
>
>     The keyIdentifier field of the authorityKeyIdentifier extension MUST
>     be included in all certificates generated by conforming CAs to
>     facilitate certification path construction.
>
> I would encourage the CA to include key usage and certificate
> policies extensions.
>
> Russ
>
> At 08:05 PM 1/9/2007, Moudrick M. Dadashov wrote:
>>Hello,
>>
>>I'm attaching a sample end entity cetrificate that the issuing CA claims
>>to be RFC 3280 compliant.
>>
>>The certificate at least MUST provide document signing functionality.
>>
>>Some of us say it's technically correct but has no legal purposes defined
>>and therefore can't be used for test purposes only, while others say it's
>>a universial one and can be used for all purposes.
>>
>>Any comments are highly appreciated.
>>
>>Thank you for your time,
>>M.D.
>
>