Subject: [pkix] Intermediate CA vs. subject CA

From: "Erik Andersen" <[email-masked]>
Date: Sun, 24 Jul 2011 11:46:13 +0200

The terms intermediate CA and subject CA are used in the PKIX publications
and in X.509. I have not found any exact definitions of those term in any
PKIX document, but found some in 8.1.2 of X.509, but I am not sure that
these definition are generally accepted in the PKI community.

According to an intermediate CA is an CA issuing cross-certificate, while
the subject CA is the one for which the cross-certificate is issued.
However, the two CAs could have both roles.

Erik Andersen

Andersen's L-Service

Elsevej 48,

DK-3500 Vaerloese

Denmark

Mobile: +45 2097 1490

e-amail: [email-masked]

Skype: andersen-erik

http://www.x500.eu/

http://www.x500standard.com/

 <http://dk.linkedin.com/in/andersenerik>
http://dk.linkedin.com/in/andersenerik

---

From: Stephen Kent <[email-masked]>
Date: Thu, 28 Jul 2011 10:01:05 -0400

At 11:46 AM +0200 7/24/11, Erik Andersen wrote:
>Content-Type: multipart/alternative;
>	boundary="----=_NextPart_000_000D_01CC49F7.4C5A2E30"
>Content-Language: da
>
>The terms intermediate CA and subject CA are used in the PKIX 
>publications and in X.509. I have not found any exact definitions of 
>those term in any PKIX document, but found some in 8.1.2 of X.509, 
>but I am not sure that these definition are generally accepted in 
>the PKI community.
>
>According to an intermediate CA is an CA issuing cross-certificate, 
>while the subject CA is the one for which the cross-certificate is 
>issued. However, the two CAs could have both roles.
>
>Erik Andersen

Erik,

In PKIX, I think we use these terms relative to a given cert in the context
of a specific cert path. Thus the "subject CA" is the CA that issued 
the cert to the indicated subject, which might be an EE or a CA.

An "intermediate CA" is a CA that lies between a TA and a subject CA, 
in the context of a cert path and a specified CA.

Steve