Subject: Comments on RFC 2459

From: [email-masked]
Date: Tue, 31 Aug 1999 11:35:11 +0800

I have some comments on sec 4.2.1.2 of the rfc 2459.

It says to facilitate chain building, the subject key identifier extenion
must appear in all conforming CA certificates. In fact, it is not always
true. If the CA issuers the certificates, and use the authorityCertIssuer +

authorityCertIssuerSerialNumber as these cetificates' authority key
identifier extenion, then the CA certificte need not include the subject
key identifier, because the information is included in its basic
certificate
fields.

I think the subject key identifier must be included in CA certificate only
if the CA issuers the certificates, and use keyIdentifier as these
cetificates'
authority key identifier extenion.

Regards

Wei-Ching Su

Senior Engineer
FISC (Financial Information Service Co., LTD.)
Taipei, Taiwan

---

From: Russ Housley <[email-masked]>
Date: Tue, 31 Aug 1999 14:18:48 -0400

Wei-Ching:

RFC 2459 mandates the use of the key indentifier.  The 
authorityCertIssuer/authorityCertSerialNumner may also be present.

So, I do not see a problem.

Russ