Subject: Can the responder change values in a cross cert request?

From: [email-masked]
Date: Fri, 19 Mar 1999 19:35:11 GMT

There are a lot of statement in CMP that indicate that the requester must
specify a lot of information in cross cert request:

From 4.6:
"The ccr message must contain a "complete" certification request,
      that is, all fields (including, e.g., a BasicConstraints
      extension) must be specified by the requester CA."

From B7:

"signingAlg            present
  -- the requesting CA must know in advance with which algorithm it
  -- wishes the certificate to be signed"

"validity              present
  -- MUST be completely specified (i.e., both fields present)"

"extensions            optionally present
  -- a requesting CA must propose values for all extensions which it
  -- requires to be in the cross-certificate"

I'm trying to figure out how to address these requirements in a freeware
reference implementation (Jonah).

It seems difficult for the requesting CA to fill in all fields accurately.
For instance, the requesting CA may not know exactly what signature
algorithms the responding CA supports (it can guess them based on the type
of signature key in the cert published for that CA). A CA may not want to
sign a cert with a notBefore in the past (because it would create trust
chains that didn't actually exist then), which would make choosing a
notBefore that's soon enough to be useful but not in the past by the time
the responding CA creates the cert tricky. And the responding CA's policy
may not allow validity durations as long as the requesting CA would like
(which maybe the requesting CA would just go along with if they knew just
what the policy was).

So, is it reasonable for the requesting CA to fill in what it must, but
allow the responding CA to make reasonable changes/additions? This might
require human review to verify that the changed cert is OK before it is
confirmed. I couldn't find any text in CMP that flat out stated that the
responding CA couldn't  make changes and cut whatever cert it likes.
Developing out of band means for the requesting CA to specify values that
don't need to be changed would make interoperability impossible. So, if
this is a reasonable strategy for meeting the letter of the law for
freeware reference code, I'd like to go with it.

Again, thanks for your time.
     Mez