Subject: Re: Questions on Authority/Subject Key Identifiers

From: [email-masked] (Peter Gutmann)
Date: Tue, 24 Sep 2002 18:44:35 +1200 (NZST)

"Tom Gindin" <[email-masked]> writes:

>You should not IMO accept any certificate as a candidate to be the issuer of a
>given certificate unless its subject matches the issuer field.

What if the cert has been reparented, e.g. due to a company reorg or merger?
This is a real-world issue, MS allow chaining by sKID (even if the DNs don't
match) for this reason.

Peter.

---

From: Stephen Kent <[email-masked]>
Date: Sat, 28 Sep 2002 15:07:17 -0400

>This is a real-world issue, MS allow chaining by sKID (even if the DNs don't

And MS implementations are non-compliant for this and several other 
reasons that have garnered considerable press recently. The real 
world issue you describe calls for re-issuance of certs; it does not 
justify violating the standards.

Steve