Subject: Cross certificate format

From: "Jaleel P.A" <[email-masked]>
Date: Wed, 21 Apr 2004 15:50:06 +0530

Hi,

Can anybody tell me the structure of a Cross Certificate and how it is
different from a normal Public Key certificate. A Cross certificate sample
can be of great help.

Thanks
Jaleel

---

From: "David A. Cooper" <[email-masked]>
Date: Wed, 21 Apr 2004 09:19:22 -0400

>different from a normal Public Key certificate. A Cross certificate sample

Technically, a cross certificate is certificate that has been issued by 
one CA to another CA.

X.509 defines three types of CA certificates:

1) self-issued certificate:  certificate in which the issuer and subject 
are the same CA.

2) self-signed certificate: self-issued certificate in which private key 
used to sign the certificate
   corresponds to the certificate's subject public key.

3) cross certificate: certificate in which the issuer and subject are 
different CAs (i.e., any CA certificate
    that is not a self-issued certificate).

Certificates issued to other CAs may be divided into two types:  (1) a 
certificate issued to a subordinate CA in a hierarchy; and (2) a 
certificate issued to a CA that is a peer (frequently a CA at a 
different organization).  With the second type, it will commonly be the 
case the each CA will issue a certificate to the other one.  Despite the 
"official" definition above, people will sometimes use the term "cross 
certificate" to refer to this second type of CA certificate (i.e., 
certificates issued to CAs in another organization in a peer-to-peer 
manner).  In fact, some believe that cross-certification implies that 
the two peer CAs have each issued the other a certificate.

Note that there is also a directory attribute crossCertificatePair, 
which holds a SEQUENCE of two cross certificates as specified in RFC 2587:

crossCertificatePairATTRIBUTE::={
   WITH SYNTAX   CertificatePair
   EQUALITY MATCHING RULE certificatePairExactMatch
 ID joint-iso-ccitt(2) ds(5) attributeType(4) crossCertificatePair(40)}

CertificatePair ::= SEQUENCE {
	forward		[0]	Certificate OPTIONAL,
	reverse		[1]	Certificate OPTIONAL,
	-- at least one of the pair shall be present -- }