Subject: Re: Cross certificate format

From: Tom Gindin <[email-masked]>
Date: Wed, 21 Apr 2004 12:24:57 -0400

Jaleel:

        As several of the earlier responses have pointed out, cross 
certificates are just those CA certificates whose issuer and subject are 
different.  CA certificates (except v1 self-signed certificates) are 
slightly different from non-CA certificates in the following ways:
a)      The basic constraints extension is present and has the "CA" flag 
set.
b)      The key usage extension is present and has the keyCertSign bit 
set, and often the cRLSign bit as well.
        There are other, less common, extensions which are typically found 
in CA certificates and not in others.  These include Name Constraints, 
Policy Constraints, Policy Mappings, and Inhibit Any-Policy.
        RFC 3280 does not support the use of v1 self-signed certificates, 
which contain no extensions at all (see the text of RFC 3280's 
basicConstraints section).  However, a number of public CA's still have 
them.

                Tom Gindin

P.S.    The opinions above are my own, and not necessarily those of my 
employer.

---

From: Jean-Marc Desperrier <[email-masked]>
Date: Wed, 21 Apr 2004 21:42:44 +0200

>basicConstraints section).  However, a number of public CA's still have 
Applications implementing the path validation algorithm of RFC3280 MUST 
accept them when they are used as trust anchors.

---

From: "Jaleel P.A" <[email-masked]>
Date: Fri, 23 Apr 2004 20:53:07 +0530

Hi

Can anybody attach a sample cross certificate.

Thanks 
Jaleel 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Tom Gindin
Sent: Wednesday, April 21, 2004 9:55 PM
To: Jaleel P.A
Cc: [email-masked]
Subject: Re: Cross certificate format

        Jaleel:

                Tom Gindin