Subject: basic constraint extension

From: "Petra Gl�ckner" <[email-masked]>
Date: Tue, 22 Sep 1998 11:26:49 +0200

Hello all,

the draft-ietf-pkix-ipki-part1-10 says the basic constraint extension 
MUST appear as a critical extension in all CA certificates but it 
SHOULD NOT appear in end entity certificates.

Why should the basic constraint extension not appear in end entity 
certificates ? Is it purely to safe some bits or is there another
reason, like keeping the draft more flexibel, e.g. to allow an
end entity to issue a certificate for his encryption key himself using
his signature key and certificate ?

In general, is it possible for an end entity to use his signature key 
and certificate to issue a certificate for his encryption key himself ?
Or do you have to have the CA bit set to true in your certificate in
order to be able to issue certificates for your own encryption keys ?

Any ideas and thoughts are welcome !

Best regards - Petra

---

From: [email-masked] (Peter Gutmann)
Date: Thu, 24 Sep 1998 23:59:34 (NZST)

>the draft-ietf-pkix-ipki-part1-10 says the basic constraint extension MUST 
>appear as a critical extension in all CA certificates but it SHOULD NOT 
>appear in end entity certificates.
>
>certificates? 
 
Looking back through the different versions, this has been in there since at 
least -08, although not worded quite as strongly as this.  It seems like a Bad 
Thing, since this clashes with the (US) federal profile and Australian profile 
and... well I'm not going to enumerate them all, but unless there's some 
really good reason for it I don't see why it should be absent, especially 
since the generally accepted way (other profiles notwithstanding) seems to be 
to encode it as an empty sequence in end-user certs.
 
Peter.