Subject: [lamps] RFC8894 (SCEP) ambiguities

From: Tomas Gustavsson <[email-masked]>
Date: Wed, 3 Mar 2021 09:01:23 +0100

Hi,

RFC8894 section 4.2.1.2 says:

---
If the CA has intermediate CA certificates, the response consists of
a degenerate certificates-only CMS SignedData message (Section 3.4)
containing the certificates, with the intermediate CA certificate(s)
as the leaf certificate(s).
---

So it suggest to have multiple leaf certificates? I though a leaf was a 
single leaf, and a list can only have one leaf.
I can easily read this text as if the CAs own certificate should not be 
included at all, only intermediates. In 4.2.1.1 it's clear that if the 
CA is self-signed, this is sent, but 4.2.1.2 makes if very fuzzy which I 
think can make different implementation different.

Say for a chain of issuing->Intermediate->root shall the response be:

1.
root
intermediate

or
2.
issuing
intermediate

or
3.
root
intermediate
issuing

or
4.
issuing
intermediate
root

My hunch is that nr 4 is the most common expected by clients. Windows 
clients want the root in there, and not only the intermediate.

Regards,
Tomas

---

From: Tomas Gustavsson <[email-masked]>
Date: Mon, 8 Mar 2021 09:01:03 +0100

Hi,

Of course..."certificates-only CMS SignedData" consist of a Set, which 
is unordered (unless you count the DER encoding rules).
https://tools.ietf.org/html/rfc5652#section-10.2.3

Is that what RFC8894 4.2.1.2 means? There is no order, but if assembling 
the chain from what is returned in the Set, the whole chain is there?

Regards,
Tomas

---

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Wed, 10 Mar 2021 13:50:09 +0000

Hi Tomas

As RFC 8894 Section 4.2.1.2 refers to backward compatibility with older versions of the spec, the chain may refer to also including the RA certificate as a leaf into the response as draft-nourse-scep-23 Section 4.1.1.2 specifies.
If I am right it should not say 'intermediate CA' but 'intermediate RA' in RFC 8894.
May be Peter can help with your question.

Hendrik 

> -----Ursprüngliche Nachricht-----
> Von: Spasm <[email-masked]> Im Auftrag von Tomas Gustavsson
> Gesendet: Mittwoch, 3. März 2021 09:01
> An: LAMPS <[email-masked]>
> Betreff: [lamps] RFC8894 (SCEP) ambiguities
> 
> 
> Hi,
> 
> If the CA has intermediate CA certificates, the response consists of a degenerate
> certificates-only CMS SignedData message (Section 3.4) containing the
> certificates, with the intermediate CA certificate(s) as the leaf certificate(s).
> ---
> 
> So it suggest to have multiple leaf certificates? I though a leaf was a single leaf,
> and a list can only have one leaf.
> I can easily read this text as if the CAs own certificate should not be included at
> all, only intermediates. In 4.2.1.1 it's clear that if the CA is self-signed, this is
> sent, but 4.2.1.2 makes if very fuzzy which I think can make different
> implementation different.
> 
> My hunch is that nr 4 is the most common expected by clients. Windows clients
> want the root in there, and not only the intermediate.
> 
> Regards,
> Tomas
> 
> _______________________________________________
> Spasm mailing list
> [email-masked]
> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf
> .org%2Fmailman%2Flistinfo%2Fspasm&amp;data=04%7C01%7Chendrik.brockha
> us%40siemens.com%7C93c614d538604da3c0ae08d8de1aa2f7%7C38ae3bcd957
> 94fd4addab42e1495d55a%7C1%7C1%7C637503553287343037%7CUnknown%7
> CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJ
> XVCI6Mn0%3D%7C3000&amp;sdata=t%2B7IhORMnisH5uj5w7LUfRj9hX07Q5uSL
> x%2F7GZCCaeY%3D&amp;reserved=0