Subject: Re: Self-Issued certificate requirements?

From: Lars Johansson <[email-masked]>
Date: Wed, 01 Oct 2003 10:52:04 +0300

Hi Faisal,

According to RFC 2510, chapter 3.2.5, self-signed certificates
should be constructed with the following requirements:

" The fields within this certificate are restricted as follows:

   - The certificate MUST be self-signed  (i.e., the signature must be
     verifiable using the SubjectPublicKeyInfo field);
   - The subject and issuer fields MUST be identical;
   - If the subject field is NULL then both subjectAltNames and
     issuerAltNames extensions MUST be present and have exactly the
same
     value;
   - The values of all other extensions must be suitable for a self-
     signed certificate (e.g., key identifiers for subject and issuer
     must be the same).
"

That's all I've been able to find.

Regards
/Lars
_________________________________________________
Lars Johansson | Consultant
[email-masked] | www.omegapoint.se
phone +46 70-915 88 40 | fax +46 8-517 008 29
Omegapoint AB, Stockholm, Sweden

-------------------
> Hi All,
> 
> RFC-3280 defines Self Signed certificate as:
> "A certificate is self-issued if the DNs that appear in the subject
and issuer fields are  identical and are not empty."
> 
> There might be two condition for self-issued certificate:
>   1.. Version-1 certificate and has not any extension.
>   2.. Version-3 certificate with set of extension/s.
> For version-1 it is clear but are there any extra required things
for version-3 self-issued certificates?
> I mean for self-issued certificate is there any requirement that it
Must be a CA certificate?
> I mean BasicConstraints = ?, Path Length = ?, KeyUsage = ? etc.
> 
> Regards,
> FAISAL MAQSOOD
> 
>

---

From: "Wen-Cheng Wang" <[email-masked]>
Date: Wed, 1 Oct 2003 16:52:20 +0800

Faisal,

According to the X.509 standard 4th edition, there are three types of self-issued certificate:
  a) self-signed certificate (a special case of self-issued certificates)
  b) self-issued end certificate
  c) self-issued intermediate certificate

(Please refer to section 8.1.5 of the X.509 standard 4th edition.)

The definifion of self-issued certificate in RFC 3280 is not aligned with its definition in the
X.509 standard. The so-called self-issued certificates in RFC 3280 are mostly of type c) in
the X.509 standard. IMHO, currently both X.509 standard and PKIX have no clear
definition for the format and the handling of self-issued certificates of type b).

For self-issued certificates of type c), I believe that the requirement is hidden in steps
(k) and (n) of section 6.1.4 of RFC 3280 as:

  (k) Verify that the certificate is a CA certificate (as specified
        in a basicConstraints extension or as verified out-of-band).

  (n) If a key usage extension is present, verify that the
        keyCertSign bit is set.

Note that rules (k) and (n) apply to all intermediate certificates even if they are self-issued.

My interpretations to these two rule are:

For a v3 intermediate certificate (self-issued or not), it should contain a basicConstraints extension
with cA=TRUE. For a v1 intermediate certificate (self-issued or not), the RP need an out-of-band
method to make sure that it is a CA certificate.

For a v3 intermediate certificate (self-issued or not), it should contain a keyUsage extension
with keyCertSign bit asserted. For a v1 intermediate certificate (self-issued or not), there is no
need to check the key usage but the RP must make sure that it is a CA certificate.

Regards,
Wen-Cheng Wang

  ----- Original Message ----- 
  From: Faisal Maqsood 
  To: [email-masked] 
  Sent: Tuesday, September 30, 2003 10:03 PM
  Subject: Self-Issued certificate requirements?

  Hi All,

  RFC-3280 defines Self Signed certificate as:
  "A certificate is self-issued if the DNs that appear in the subject and issuer fields are  identical and are not empty."

  There might be two condition for self-issued certificate:
    1.. Version-1 certificate and has not any extension. 
    2.. Version-3 certificate with set of extension/s.
  For version-1 it is clear but are there any extra required things for version-3 self-issued certificates?
  I mean for self-issued certificate is there any requirement that it Must be a CA certificate?
  I mean BasicConstraints = ?, Path Length = ?, KeyUsage = ? etc.

  Regards,
  FAISAL MAQSOOD