Subject: Certificate definitions

From: "Erik Andersen" <[email-masked]>
Date: Wed, 1 Apr 2009 14:39:56 +0200

Hi

I got a number of responses on user certificates, but quite little that
actually answered my question.

I have tried to dig a little bit more in X.509 to get hold of the
terminology and then produced below figure. I will not comment all the
boxes.

I will like you to comments as to the correctness of above figure.

The end-entity certificate is not defined in the definition clause. However
it is used widely in the main text. It is mentioned the first time in clause
7 as a public-key certificate. There are several other places where it is a
public-key certificate. In 15.5.2.4 is used in the context of attribute
certificates. The conclusion must be that an end-entity certificate can
either be a end-entity public-key certificate or an end-entity attribute
certificate. However, in most places, it is implied that we only talks about
public-key certificates. For veterans, this is not a major problem, but
new-comers may get confused. Anyway, I thing our specifications should be
clear and not subject to interpretation. RFC 5280 does not use the term at
all. It seems just to use the term "certificate" as a synonym for
"end-entrity public key certificate".

The "User Certificate"  is not defined in X.509, but is wide used. It seems
to be a synonym for "end-entrity public key certificate". It is also used in
X.511. RFC 5280 uses the term once without differenting it from just
"certificate".

The term "cross-certificate" should probably also be qualified.

I suggest to add in X.509 definitions for:

"end-entity public-key certificate"

"user certictate" as a synonym for "end-entity public-key certificate"

"end-entity attrubute certificate"

The X.509 text should be updated to make use of these definitions.

X.509 has four attribute types for holding certificates.

UserCertificate: For end-entity public-key certificates

cAcertificate: For CA certificates

attributeCertificateAttribute: For end-entity attrubute certificates

aACertificate: For AA Certificates

Any comments?

Erik Andersen

Andersen's L-Service

Elsevej 48, DK-3500 Vaerloese

Denmark

Mobile: +45 2097 1490

email: [email-masked]

www.x500.eu

www.x500standard.com

---

From: "Erik Andersen" <[email-masked]>
Date: Fri, 3 Apr 2009 17:00:01 +0200

I take silence as approval.

Erik Andersen

Andersen's L-Service

Denmark

Mobile: +45 2097 1490

email: [email-masked]

www.x500.eu

www.x500standard.com

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Erik Andersen
Sent: 1. april 2009 14:40
To: Directory list; PKIX
Subject: [x500standard] Certificate definitions

Hi

 

Any comments?

Erik Andersen

Andersen's L-Service

Denmark

Mobile: +45 2097 1490

email: [email-masked]

www.x500.eu

www.x500standard.com

---

From: "Denis Pinkas"<[email-masked]>
Date: Fri, 3 Apr 2009 17:33:01 +0200

Eric,

Silence does not mean approval.

It may mean that the corrections are so numerous that it would take too long to respond
and that people do not have that time available at the moment.

e.g.:  an End-entity attribute certificate is not linked to a public-key certificate.
         a cross-certificate is not linked to an AA certificate.
         an Authority Certificate is not linked to an Attribute Certificate.

This is only a start ...

Denis
----- Message reçu ----- 
De : owner-ietf-pkix 
À : x500standard,'PKIX' 
Date : 2009-04-03, 17:00:01
Sujet : RE: [x500standard] Certificate definitions

Erik Andersen
Andersen's L-Service

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Erik Andersen
Sent: 1. april 2009 14:40
To: Directory list; PKIX
Subject: [x500standard] Certificate definitions

Hi

I got a number of responses on user certificates, but quite little that actually answered my question.

I have tried to dig a little bit more in X.509 to get hold of the terminology and then produced below figure. I will not comment all the boxes.

The end-entity certificate is not defined in the definition clause. However it is used widely in the main text. It is mentioned the first time in clause 7 as a public-key certificate. There are several other places where it is a public-key certificate. In 15.5.2.4 is used in the context of attribute certificates. The conclusion must be that an end-entity certificate can either be a end-entity public-key certificate or an end-entity attribute certificate. However, in most places, it is implied that we only talks about public-key certificates. For veterans, this is not a major problem, but new-comers may get confused. Anyway, I thing our specifications should be clear and not subject to interpretation. RFC 5280 does not use the term at all. It seems just to use the term “certificate” as a synonym for “end-entrity public key certificate”.

The “User Certificate”  is not defined in X.509, but is wide used. It seems to be a synonym for “end-entrity public key certificate”. It is also used in X.511. RFC 5280 uses the term once without differenting it from just “certificate”.

The term “cross-certificate” should probably also be qualified.

“end-entity public-key certificate”
“user certictate” as a synonym for “end-entity public-key certificate”
“end-entity attrubute certificate”

Any comments?

Erik Andersen
Andersen's L-Service

---

From: Russ Housley <[email-masked]>
Date: Fri, 03 Apr 2009 12:38:15 -0400

I'm a pit strapped for time right noe, but just looking at your picture,
I see something that causes pause.  An AA certificate issues a
Cross-Certificate?  That does not seem right.

Russ

At 11:00 AM 4/3/2009, Erik Andersen wrote:

I
take silence as approval.

Erik Andersen

Andersen's L-Service

Denmark

Mobile: +45 2097 1490

email: [email-masked]

www.x500.eu

www.x500standard.com

-----Original Message-----

From: [email-masked]
[
mailto:[email-masked]] On Behalf Of Erik
Andersen

To: Directory list; PKIX

Hi

The end-entity certificate is not defined in the definition clause.
However it is used widely in the main text. It is mentioned the first
time in clause 7 as a public-key certificate. There are several other
places where it is a public-key certificate. In 15.5.2.4 is used in the
context of attribute certificates. The conclusion must be that an
end-entity certificate can either be a end-entity public-key certificate
or an end-entity attribute certificate. However, in most places, it is
implied that we only talks about public-key certificates. For veterans,
this is not a major problem, but new-comers may get confused. Anyway, I
thing our specifications should be clear and not subject to
interpretation. RFC 5280 does not use the term at all. It seems just to
use the term “certificate” as a synonym for “end-entrity public key
certificate”.

The “User Certificate”  is not defined in X.509, but is wide used.
It seems to be a synonym for “end-entrity public key certificate”. It is
also used in X.511. RFC 5280 uses the term once without differenting it
from just “certificate”.

“user certictate” as a synonym for “end-entity public-key
certificate”

Any comments?

Erik Andersen

Andersen's L-Service

Denmark

Mobile: +45 2097 1490

email: [email-masked]

www.x500.eu

www.x500standard.com

---

From: "Santosh Chokhani" <[email-masked]>
Date: Fri, 3 Apr 2009 14:03:09 -0400

I did not respond before because I am not quite sure what purpose this diagram serves and why we need it.
 
I have also read Russ's post and I agree with Russ (and with Denis on one point).  Unless some one views a PKC with SDA as an AC,  AA certificate is not a cross certificate.
 
I disagree with Denis on two of his comments.  Good, bad or indifferent, the diagram is saying that a PKC could be an Authority Certificate or an EE certificate.  The diagram is correct.  The diagram says an attribute certificate could be an authority certificate or an end entity certificate.  Again, the diagram is correct.
 
But, as I mentioned before, I lose forest for the trees here.  I know this started with the userCertificate  directory attribute, but the diagram may confuse people, may be misread, and without understanding why precisely we need it, I do not see a need for it. 
________________________________

From: [email-masked] [mailto:[email-masked]] On Behalf Of Denis Pinkas
Sent: Friday, April 03, 2009 11:33 AM
To: x500 list; ietf-pkix
Subject: [x500standard] Re: Certificate definitions

	Eric,

	 
	 
	This is only a start ...
	 
	Denis

		----- Message reçu ----- 
		De : owner-ietf-pkix 
		À : x500standard,'PKIX' 
		Date : 2009-04-03, 17:00:01
		Sujet : RE: [x500standard] Certificate definitions

		Erik Andersen

		Andersen's L-Service

		Denmark

		Mobile: +45 2097 1490

		email: [email-masked]

		www.x500.eu

		www.x500standard.com

		-----Original Message-----
		From: [email-masked] [mailto:[email-masked]] On Behalf Of Erik Andersen
		Sent: 1. april 2009 14:40
		To: Directory list; PKIX
		Subject: [x500standard] Certificate definitions

		Hi

		 

		The end-entity certificate is not defined in the definition clause. However it is used widely in the main text. It is mentioned the first time in clause 7 as a public-key certificate. There are several other places where it is a public-key certificate. In 15.5.2.4 is used in the context of attribute certificates. The conclusion must be that an end-entity certificate can either be a end-entity public-key certificate or an end-entity attribute certificate. However, in most places, it is implied that we only talks about public-key certificates. For veterans, this is not a major problem, but new-comers may get confused. Anyway, I thing our specifications should be clear and not subject to interpretation. RFC 5280 does not use the term at all. It seems just to use the term "certificate" as a synonym for "end-entrity public key certificate".

		The "User Certificate"  is not defined in X.509, but is wide used. It seems to be a synonym for "end-entrity public key certificate". It is also used in X.511. RFC 5280 uses the term once without differenting it from just "certificate".

		Any comments?

		Erik Andersen

		Andersen's L-Service

		Denmark

		Mobile: +45 2097 1490

		email: [email-masked]

		www.x500.eu

		www.x500standard.com

---

From: "Santosh Chokhani" <[email-masked]>
Date: Thu, 9 Apr 2009 11:35:52 -0400

Erik,
 
See responses inline.

	From: [email-masked] [mailto:[email-masked]] On Behalf Of Erik Andersen
	Sent: Thursday, April 09, 2009 11:26 AM
	To: [email-masked]; 'ietf-pkix'
	Subject: [x500standard] Re: Certificate definitions

	Hi Denis,

	It is a little dangerous not to respond to my comments. Due to the apparent inactivity of people, I have the power to produce Defect Reports, produce Draft Technical Corrigenda, run them through both the ISO and ITU-T approval process and finally integrate them into the next edition of X.500 (incl. X.509) without being stopped by anyone (except for Jean-Paul Lemaire).

	I believe you misunderstood my diagram. It may be a little confusing. Let me express myself without the diagram.

	The set of certificates is the union of the set of public-key certificates and the set of attribute certificates.

	The set of end-entity certificates is the union of public-key certificates issued to end-entities and the set of attribute certificates issued to end-entities. However, X.509 is a little confusing here as the term end-entity certificate is sometimes meant to be just public-key certificates issued to end-entities, so the term end-entity certificate has two meanings.

	The set of public-key certificates is the union of the set of end-entity (public-key) certificates and the set of CA certificates.

	The set of attribute certificates is the union of the set of end-entity (attribute) certificates and the set of AA certificates.

	The set of authority certificates is the union of the set CA certificates and the set of AA certificates.

	The set of CA certificates is the union of the set of self-issued (public-key) certificates and the set cross certificates. The latter is a little confusing, as a cross certificate can also be an attribute certificate. 

	[Santosh]: The above paragraph has two inaccuracies.  Since not all CA certificates are called cross certificates, set of CA certificates are self-issued, cross certificate, and subordinate CA certificates.  (I wish we had not distinguished between cross certificates and subordinate CA certificates in the first place).  Also note that a cross certificate can not be attribute certificate.  I don't see an AA cross certificate in RFC 3281 or in X.509

	I am avoiding here to use the term "user attribute", but believe it is supposed to mean a public-key certificate issued to an end-entity.

	Whenever an innocent reader sees the term "certificate", he/she is entitled to believe it can either be a public-key certificate. It may not always be clear from the context what is meant.

	Whenever an innocent us  reader see the term "end-entity certificate", he/she is entitled to believe it is either a public key certificate or an attribute certificate issued to an end-entity.

	Whenever an innocent us  reader see the term "cross-certificate", he/she is entitled to believe it is either a public key certificate or an attribute certificate. 

	[Santosh]: See prior comment. 

	My proposal was only to clear-up the terminology and to use the terminology consistent in the text of X.509. Trying to do the latter may raise a number of detailed questions when the meaning is not absolutely clear from the context.  

	Erik Andersen

	Andersen's L-Service

	Denmark

	Mobile: +45 2097 1490

	email: [email-masked]

	www.x500.eu

	www.x500standard.com

	-----Original Message-----
	From: [email-masked] [mailto:[email-masked]] On Behalf Of Denis Pinkas
	Sent: 3. april 2009 17:33
	To: x500 list; ietf-pkix
	Subject: [x500standard] Re: Certificate definitions

	Eric,

	This is only a start ...

	Denis

		----- Message reçu ----- 

		De : owner-ietf-pkix 

		À : x500standard,'PKIX' 

		Erik Andersen

		Andersen's L-Service

		Denmark

		Mobile: +45 2097 1490

		email: [email-masked]

		www.x500.eu

		www.x500standard.com

		-----Original Message-----
		From: [email-masked] [mailto:[email-masked]] On Behalf Of Erik Andersen
		Sent: 1. april 2009 14:40
		To: Directory list; PKIX
		Subject: [x500standard] Certificate definitions

		Hi

		 

		"user certificate" as a synonym for "end-entity public-key certificate"

		"end-entity attribute certificate"

		attributeCertificateAttribute: For end-entity attribute certificates

		Any comments?

		Erik Andersen

		Andersen's L-Service

		Denmark

		Mobile: +45 2097 1490

		email: [email-masked]

		www.x500.eu

		www.x500standard.com

---

From: "Erik Andersen" <[email-masked]>
Date: Thu, 9 Apr 2009 17:25:37 +0200

Hi Denis,

It is a little dangerous not to respond to my comments. Due to the apparent
inactivity of people, I have the power to produce Defect Reports, produce
Draft Technical Corrigenda, run them through both the ISO and ITU-T approval
process and finally integrate them into the next edition of X.500 (incl.
X.509) without being stopped by anyone (except for Jean-Paul Lemaire).

I believe you misunderstood my diagram. It may be a little confusing. Let me
express myself without the diagram.

The set of certificates is the union of the set of public-key certificates
and the set of attribute certificates.

The set of end-entity certificates is the union of public-key certificates
issued to end-entities and the set of attribute certificates issued to
end-entities. However, X.509 is a little confusing here as the term
end-entity certificate is sometimes meant to be just public-key certificates
issued to end-entities, so the term end-entity certificate has two meanings.

The set of public-key certificates is the union of the set of end-entity
(public-key) certificates and the set of CA certificates.

The set of attribute certificates is the union of the set of end-entity
(attribute) certificates and the set of AA certificates.

The set of authority certificates is the union of the set CA certificates
and the set of AA certificates.

The set of CA certificates is the union of the set of self-issued
(public-key) certificates and the set cross certificates. The latter is a
little confusing, as a cross certificate can also be an attribute
certificate.

I am avoiding here to use the term “user attribute”, but believe it is
supposed to mean a public-key certificate issued to an end-entity.

Whenever an innocent reader sees the term “certificate”, he/she is entitled
to believe it can either be a public-key certificate. It may not always be
clear from the context what is meant.

Whenever an innocent us  reader see the term “end-entity certificate”,
he/she is entitled to believe it is either a public key certificate or an
attribute certificate issued to an end-entity.

Whenever an innocent us  reader see the term “cross-certificate”, he/she is
entitled to believe it is either a public key certificate or an attribute
certificate.

My proposal was only to clear-up the terminology and to use the terminology
consistent in the text of X.509. Trying to do the latter may raise a number
of detailed questions when the meaning is not absolutely clear from the
context.  

Erik Andersen

Andersen's L-Service

Denmark

Mobile: +45 2097 1490

email: [email-masked]

www.x500.eu

www.x500standard.com

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Denis Pinkas
Sent: 3. april 2009 17:33
To: x500 list; ietf-pkix
Subject: [x500standard] Re: Certificate definitions

Eric,

It may mean that the corrections are so numerous that it would take too long
to respond

e.g.:  an End-entity attribute certificate is not linked to a public-key
certificate.

This is only a start ...

Denis

----- Message reçu ----- 

De : owner-ietf-pkix 

À : x500standard,'PKIX' 

Erik Andersen

Andersen's L-Service

Denmark

Mobile: +45 2097 1490

email: [email-masked]

www.x500.eu

www.x500standard.com

-----Original Message-----

Hi

 

all. It seems just to use the term “certificate” as a synonym for
“end-entrity public key certificate”.

The “User Certificate”  is not defined in X.509, but is wide used. It seems
to be a synonym for “end-entrity public key certificate”. It is also used in
X.511. RFC 5280 uses the term once without differenting it from just
“certificate”.

“user certificate” as a synonym for “end-entity public-key certificate”

“end-entity attribute certificate”

Any comments?

Erik Andersen

Andersen's L-Service

Denmark

Mobile: +45 2097 1490

email: [email-masked]

www.x500.eu

www.x500standard.com

---

From: "David A. Cooper" <[email-masked]>
Date: Thu, 09 Apr 2009 12:09:19 -0400

Santosh Chokhani wrote:

[Santosh]: The above
paragraph has two inaccuracies.  Since not all CA certificates
are called cross certificates, set of CA certificates are self-issued,
cross certificate, and subordinate CA certificates.  (I wish we had not
distinguished between cross certificates and subordinate CA
certificates in the first place).  Also note that a cross certificate
can not be attribute certificate.  I don't see an AA cross certificate
in RFC 3281 or in X.509

Santosh,

RFC 5280 says that "Cross-certificates are CA certificates in which the
issuer and subject are different entities."

X.509 defines a cross-certificate as "A public-key or attribute
certificate where the issuer and the subject/holder are different CAs
or AAs respectively. CAs and AAs issue cross-certificates to other CAs
or AAs respectively as a mechanism to authorize the subject CA's
existence (e.g., in a strict hierarchy) or to recognize the existence
of the subject CA or holder AA (e.g., in a distributed trust model).
The cross-certificate structure is used for both of these."

So, every CA certificate is either self-issued or a cross-certificate.

I know that a lot of people seem to think that a certificate issued in
a hierarchy by a hierarchically superior CA to a subordinate CA is not
a "cross-certificate", that belief is not consistent with either X.509
or RFC 5280.  (Perhaps people are simply guessing the meaning of
"cross-certificate", and the inclusion of "cross" in the name leads
them to guess that the term does not incorporate certificates issued to
subordinate CAs.)   If documents are being created that use the term
"cross-certificate" to mean only CA certificates that are neither
self-issued nor issued to a subordinate CA, then they are creating
confusion by misusing the term.

Dave

---

From: "Santosh Chokhani" <[email-masked]>
Date: Thu, 9 Apr 2009 12:16:21 -0400

David,
 
We agree.  That is why my parenthetical remark.

	From: [email-masked]
[mailto:[email-masked]] On Behalf Of David A. Cooper
	Sent: Thursday, April 09, 2009 12:09 PM
	To: [email-masked]
	Cc: ietf-pkix
	Subject: [x500standard] Re: Certificate definitions

	Santosh Chokhani wrote: 

			[Santosh]: The above paragraph has two
inaccuracies.  Since not all CA certificates are called cross
certificates, set of CA certificates are self-issued, cross certificate,
and subordinate CA certificates.  (I wish we had not distinguished
between cross certificates and subordinate CA certificates in the first
place).  Also note that a cross certificate can not be attribute
certificate.  I don't see an AA cross certificate in RFC 3281 or in
X.509

	Santosh,
	
	RFC 5280 says that "Cross-certificates are CA certificates in
which the issuer and subject are different entities."
	
	X.509 defines a cross-certificate as "A public-key or attribute
certificate where the issuer and the subject/holder are different CAs or
AAs respectively. CAs and AAs issue cross-certificates to other CAs or
AAs respectively as a mechanism to authorize the subject CA's existence
(e.g., in a strict hierarchy) or to recognize the existence of the
subject CA or holder AA (e.g., in a distributed trust model). The
cross-certificate structure is used for both of these."
	
	So, every CA certificate is either self-issued or a
cross-certificate.
	
	I know that a lot of people seem to think that a certificate
issued in a hierarchy by a hierarchically superior CA to a subordinate
CA is not a "cross-certificate", that belief is not consistent with
either X.509 or RFC 5280.  (Perhaps people are simply guessing the
meaning of "cross-certificate", and the inclusion of "cross" in the name
leads them to guess that the term does not incorporate certificates
issued to subordinate CAs.)   If documents are being created that use
the term "cross-certificate" to mean only CA certificates that are
neither self-issued nor issued to a subordinate CA, then they are
creating confusion by misusing the term.
	
	Dave
	
	----- www.x500standard.com: The central source for information
on the X.500 Directory Standard.

---

From: Erik Andersen <[email-masked]>
Date: Thu, 9 Apr 2009 17:25:37 +0200

Hi Denis,

Erik Andersen

Andersen's L-Service

Denmark

Mobile: +45 2097 1490

email: [email-masked]

www.x500.eu

www.x500standard.com

-----Original Message-----

Eric,

This is only a start ...

Denis

----- Message reçu ----- 

De : owner-ietf-pkix 

À : x500standard,'PKIX' 

Erik Andersen

Andersen's L-Service

Denmark

Mobile: +45 2097 1490

email: [email-masked]

www.x500.eu

www.x500standard.com

-----Original Message-----

Hi

 

Any comments?

Erik Andersen

Andersen's L-Service

Denmark

Mobile: +45 2097 1490

email: [email-masked]

www.x500.eu

www.x500standard.com

---

From: Santosh Chokhani <[email-masked]>
Date: Thu, 9 Apr 2009 12:16:21 -0400

David,

	Santosh Chokhani wrote: 

	Santosh,

	

	Dave

---

From: Stefan Santesson <[email-masked]>
Date: Sun, 12 Apr 2009 11:50:07 +0200

Eric,

There is always a danger with cross posting to multiple mailing lists.
Instead of making more people aware of the issue, it may have the opposite
effect. In my case it made me miss all these mails as they all got sorted in
the wrong folder.

 I see a few potential issues here.
> 
> ³The set of attribute certificates is the union of the set of end-entity
> (attribute) certificates and the set of AA certificates.²

 I don¹t think an AA certificate is an attribute certificate. I view it as a
public key certificate issued to the AA.

> ³The set of CA certificates is the union of the set of self-issued
> certificate.²

Except for Russ comment, what is true for Self Signed SSL/TLS certificates
out there. Are they issued as CA certificates or as EE certificates (Basic
Constraints CA=FALSE). I could not find any samples to study, doing a quick
search.

/Stefan

On 09-04-09 5:25 PM, "Erik Andersen" <[email-masked]> wrote:

> end-entities. However, X.509 is a little confusing here as the term end-entity
> certificate is sometimes meant to be just public-key certificates issued to
> end-entities, so the term end-entity certificate has two meanings.
>  
> The set of CA certificates is the union of the set of self-issued (public-key)
> certificates and the set cross certificates. The latter is a little confusing,
> as a cross certificate can also be an attribute certificate.
>  
> I am avoiding here to use the term ³user attribute², but believe it is
> Whenever an innocent reader sees the term ³certificate², he/she is entitled to
> believe it can either be a public-key certificate. It may not always be clear
> from the context what is meant.
>  
> Whenever an innocent us  reader see the term ³end-entity certificate², he/she
> is entitled to believe it is either a public key certificate or an attribute
> certificate issued to an end-entity.
>  
> Whenever an innocent us  reader see the term ³cross-certificate², he/she is
> consistent in the text of X.509. Trying to do the latter may raise a number of
> detailed questions when the meaning is not absolutely clear from the context.
>  
>  
> 
> Erik Andersen
> 
> Andersen's L-Service
> 
>> De : owner-ietf-pkix <mailto%20:[email-masked]>
>> 
>> À : x500standard,'PKIX'
>> <mailto%20:[email-masked],[email-masked]>
>> 
>> I have tried to dig a little bit more in X.509 to get hold of the terminology
>> and then produced below figure. I will not comment all the boxes.
>>  
>> 
>>  
>> all. It seems just to use the term ³certificate² as a synonym for
>> ³end-entrity public key certificate².
>> 
>>  
>> 
>> The ³User Certificate²  is not defined in X.509, but is wide used. It seems
>> to be a synonym for ³end-entrity public key certificate². It is also used in
>> ³certificate².
>> The term ³cross-certificate² should probably also be qualified.
>> 
>>  
>> 
>> ³end-entity public-key certificate²
>> 
>> ³user certificate² as a synonym for ³end-entity public-key certificate²
>> 
>> ³end-entity attribute certificate²
>> 
>>  
>>

---

From: "Santosh Chokhani" <[email-masked]>
Date: Sun, 12 Apr 2009 08:55:09 -0400

Stefan,
 
In context of RFC 3281, you are correct that the AA certificate is a PKC.  But, in the context of X.509, AA certificate exists.  May be posting to both X.500  and PKIX was a bad idea from that viewpoint.  Actually, 3281 does 
 
I do not understand your comment that states:
 
"Except for Russ comment, what is true for Self Signed SSL/TLS certificates out there. Are they issued as CA certificates or as EE certificates (Basic Constraints CA=FALSE). I could not find any samples to study, doing a quick search."

	From: [email-masked] [mailto:[email-masked]] On Behalf Of Stefan Santesson
	Sent: Sunday, April 12, 2009 5:50 AM
	To: Erik Andersen; 'ietf-pkix'
	Subject: Re: [x500standard] Re: Certificate definitions

	Eric,
	
	There is always a danger with cross posting to multiple mailing lists. Instead of making more people aware of the issue, it may have the opposite effect. In my case it made me miss all these mails as they all got sorted in the wrong folder.

		
		"The set of attribute certificates is the union of the set of end-entity (attribute) certificates and the set of AA certificates."

	I don't think an AA certificate is an attribute certificate. I view it as a public key certificate issued to the AA.

		"The set of CA certificates is the union of the set of self-issued (public-key) certificates and the set cross certificates. The latter is a little confusing, as a cross certificate can also be an attribute certificate."

	Except for Russ comment, what is true for Self Signed SSL/TLS certificates out there. Are they issued as CA certificates or as EE certificates (Basic Constraints CA=FALSE). I could not find any samples to study, doing a quick search.
	
	/Stefan

		Hi Denis,

		 

		 

		 

		 

		Erik Andersen
		
		Andersen's L-Service

		Denmark
		
		Mobile: +45 2097 1490
		
		email: [email-masked]
		
		www.x500.eu
		
		www.x500standard.com

		-----Original Message-----
		From: [email-masked] [mailto:[email-masked]] On Behalf Of Denis Pinkas
		Sent: 3. april 2009 17:33
		To: x500 list; ietf-pkix
		Subject: [x500standard] Re: Certificate definitions

		Eric,

		

		

		
		This is only a start ...

		Denis

			----- Message reçu ----- 

			À : x500standard,'PKIX' <mailto%20:[email-masked],[email-masked]>  

			

			Erik Andersen
			
			Andersen's L-Service

			Denmark
			
			Mobile: +45 2097 1490
			
			email: [email-masked]
			
			www.x500.eu
			
			www.x500standard.com

			-----Original Message-----
			From: [email-masked] [mailto:[email-masked]] On Behalf Of Erik Andersen
			Sent: 1. april 2009 14:40
			To: Directory list; PKIX
			Subject: [x500standard] Certificate definitions
			
			Hi

			

			

			

			

			

			

			

			Any comments?

			Erik Andersen
			
			Andersen's L-Service

			Denmark
			
			Mobile: +45 2097 1490
			
			email: [email-masked]
			
			www.x500.eu
			
			www.x500standard.com

---

From: Tom Gindin <[email-masked]>
Date: Sun, 12 Apr 2009 22:32:20 -0400

An AA certificate is also a PKC, and normally not an issuer of 
other PKC's.  Thus, having a "set of attribute certificates" containing 
both AA's and AC's probably confuses more than it clarifies, especially 
since the term "attribute certificate" is in general use and does not 
include AA certificates.  I think it would be more helpful to depict the 
issuance relationship than to define a "set of authority certificates" and 
a "set of end-entity certificates".  A more accurate version of the second 
and third lines of your diagram would thus go:
        PK Certificate has two children:        CA certificate and 
End-entity certificate
        EE Certificate has two children:        End-entity PKC (EE PKC) 
and AA certificate
        The issuance relationships should be arrows from CA certificate 
back up to PKC, and from AA certificate to Attribute certificate.  It 
isn't clear to me whether EE Certificate as defined above is a useful 
concept, or whether PKC should have three children: CA, EE PKC, and AA. 
Conceptually, it's cleaner to make PKC have three children, but some 
certificates can be used as AA's without it being apparent from the actual 
contents of that certificate (the SOA identifier extension is not 
mandatory).
        In a different part of the discussion, self-signed certificates 
are a subset of self-issued ones.

                Tom Gindin

"Erik Andersen" <[email-masked]> 
Sent by: [email-masked]
04/09/2009 11:25 AM

To
<[email-masked]>, "'ietf-pkix'" <[email-masked]>
cc

Subject
RE: [x500standard] Re: Certificate definitions

Hi Denis,
 
It is a little dangerous not to respond to my comments. Due to the 
apparent inactivity of people, I have the power to produce Defect Reports, 
produce Draft Technical Corrigenda, run them through both the ISO and 
ITU-T approval process and finally integrate them into the next edition of 
X.500 (incl. X.509) without being stopped by anyone (except for Jean-Paul 
Lemaire).
 
I believe you misunderstood my diagram. It may be a little confusing. Let 
me express myself without the diagram.

The set of end-entity certificates is the union of public-key certificates 
issued to end-entities and the set of attribute certificates issued to 
end-entities. However, X.509 is a little confusing here as the term 
end-entity certificate is sometimes meant to be just public-key 
certificates issued to end-entities, so the term end-entity certificate 
has two meanings.

 

I am avoiding here to use the term ?user attribute?, but believe it is 
supposed to mean a public-key certificate issued to an end-entity.
 
Whenever an innocent reader sees the term ?certificate?, he/she is 
entitled to believe it can either be a public-key certificate. It may not 
always be clear from the context what is meant.
 
Whenever an innocent us  reader see the term ?end-entity certificate?, 
he/she is entitled to believe it is either a public key certificate or an 
attribute certificate issued to an end-entity.
 
Whenever an innocent us  reader see the term ?cross-certificate?, he/she 
is entitled to believe it is either a public key certificate or an 
attribute certificate.
 
My proposal was only to clear-up the terminology and to use the 
terminology consistent in the text of X.509. Trying to do the latter may 
raise a number of detailed questions when the meaning is not absolutely 
clear from the context.  
 
Erik Andersen
Andersen's L-Service
 
-----Original Message-----
 
Eric,

It may mean that the corrections are so numerous that it would take too 
long to respond
and that people do not have that time available at the moment.
 
e.g.:  an End-entity attribute certificate is not linked to a public-key 
certificate.
         a cross-certificate is not linked to an AA certificate.
         an Authority Certificate is not linked to an Attribute 
Certificate.
 
This is only a start ...
 
Denis
----- Message reçu ----- 
De : owner-ietf-pkix 
À : x500standard,'PKIX' 
Date : 2009-04-03, 17:00:01
Sujet : RE: [x500standard] Certificate definitions

Erik Andersen
Andersen's L-Service
 
-----Original Message-----
 
Hi

 
 
The end-entity certificate is not defined in the definition clause. 
However it is used widely in the main text. It is mentioned the first time 
in clause 7 as a public-key certificate. There are several other places 
where it is a public-key certificate. In 15.5.2.4 is used in the context 
of attribute certificates. The conclusion must be that an end-entity 
certificate can either be a end-entity public-key certificate or an 
end-entity attribute certificate. However, in most places, it is implied 
that we only talks about public-key certificates. For veterans, this is 
not a major problem, but new-comers may get confused. Anyway, I thing our 
specifications should be clear and not subject to interpretation. RFC 5280 
does not use the term at all. It seems just to use the term ?certificate? 
as a synonym for ?end-entrity public key certificate?.
 
The ?User Certificate?  is not defined in X.509, but is wide used. It 
seems to be a synonym for ?end-entrity public key certificate?. It is also 
used in X.511. RFC 5280 uses the term once without differenting it from 
just ?certificate?.
 
The term ?cross-certificate? should probably also be qualified.

?end-entity public-key certificate?
?user certificate? as a synonym for ?end-entity public-key certificate?
?end-entity attribute certificate?

 
 
Any comments?
 
Erik Andersen
Andersen's L-Service