Subject: Re: [pkix] Intermediate CA vs. subject CA

From: "Erik Andersen" <[email-masked]>
Date: Wed, 3 Aug 2011 15:40:14 +0200

Hi Steve,

It seem you are not in agreement with Peter Sylvester. I also came across a
page (http://zvon.org/comp/r/ref-Security_Glossary.html#Terms~subject_CA)
claiming the term "subject CA" is a deprecated term. I have been wondering
whether we need that term as a specific, defined term.

Erik Andersen
Andersen's L-Service
Elsevej 48,
DK-3500 Vaerloese
Denmark
Mobile: +45 2097 1490
e-amail: [email-masked]
Skype: andersen-erik
http://www.x500.eu/
http://www.x500standard.com/
http://dk.linkedin.com/in/andersenerik

-----Oprindelig meddelelse-----
Fra: Stephen Kent [mailto:[email-masked]] 
Sendt: 28. juli 2011 16:01
Til: Erik Andersen
Cc: Directory list; SG17-Q11; PKIX
Emne: Re: [pkix] Intermediate CA vs. subject CA

At 11:46 AM +0200 7/24/11, Erik Andersen wrote:
>Content-Type: multipart/alternative;
>	boundary="----=_NextPart_000_000D_01CC49F7.4C5A2E30"
>Content-Language: da
>
>The terms intermediate CA and subject CA are used in the PKIX 
>publications and in X.509. I have not found any exact definitions of 
>those term in any PKIX document, but found some in 8.1.2 of X.509, 
>but I am not sure that these definition are generally accepted in 
>the PKI community.
>
>According to an intermediate CA is an CA issuing cross-certificate, 
>while the subject CA is the one for which the cross-certificate is 
>issued. However, the two CAs could have both roles.
>
>Erik Andersen

Erik,

In PKIX, I think we use these terms relative to a given cert in the context
of a specific cert path. Thus the "subject CA" is the CA that issued 
the cert to the indicated subject, which might be an EE or a CA.

An "intermediate CA" is a CA that lies between a TA and a subject CA, 
in the context of a cert path and a specified CA.

Steve

Subject: Re: [pkix] Intermediate CA vs. subject CA
From: "Peter Sylvester" <[email-masked]>
To: "Erik Andersen" <[email-masked]>
Date: Sun, 24 Jul 2011 15:36:59 +0200

personal

On 07/24/2011 11:46 AM, Erik Andersen wrote: 

The terms intermediate CA and subject CA are used in the PKIX publications
and in X.509. I have not found any exact definitions of those term in any
PKIX document, but found some in 8.1.2 of X.509, but I am not sure that
these definition are generally accepted in the PKI community.

an intermediate CA is any CA that is issuing certificates for other CAs and
which is not a/the root CA.
it seems that a root CA (at least in x509) cannot create cross certificates
(makes sense)
in the x500 naming hierarchy thus the picture in 8.1.2 is ok.

the real problem is that essentially most non directory related pkis are all
cross certificates,
none of tem is hierarchical.  "hierarchical" only means 'following the
directory hierarchy' 

According to an intermediate CA is an CA issuing cross-certificate, while
the subject CA is the one for which the cross-certificate is issued.
However, the two CAs could have both roles.

it could have been called 'issuing CA" instead of intermediate CA, but since
the fictive 
root CA has an empty DN the certs created by that would not be cross
certificates.

cross certification that you leave the transitivity of the naming hierarchy.
only "intermediate" CAs have (or originally had in V1) the implied
restriction that they could
only create certs with their own name as prefix.

---

From: "Erik Andersen" <[email-masked]>
Date: Wed, 3 Aug 2011 17:30:25 +0200

Hi,

I just realised that it is the Informational RFC 4949 that deprecates the
term "subject CA". However, it also deprecates the term "intermediate
CA".RFC 4949 is not a PKIX document, and I have the feeling that PKIX uses
the term "intermediate CA" quite a lot.

Erik Andersen
Andersen's L-Service
Elsevej 48,
DK-3500 Vaerloese
Denmark
Mobile: +45 2097 1490
e-amail: [email-masked]
Skype: andersen-erik
http://www.x500.eu/

-----Oprindelig meddelelse-----
Fra: [email-masked] [mailto:[email-masked]] På vegne af Erik
Andersen
Sendt: 3. august 2011 15:40
Til: 'Stephen Kent'
Cc: 'Directory list'; 'SG17-Q11'; 'PKIX'
Emne: [Spam] Re: [pkix] Intermediate CA vs. subject CA

Hi Steve,

Erik Andersen
Andersen's L-Service
Elsevej 48,
DK-3500 Vaerloese
Denmark
Mobile: +45 2097 1490
e-amail: [email-masked]
Skype: andersen-erik
http://www.x500.eu/

-----Oprindelig meddelelse-----
Fra: Stephen Kent [mailto:[email-masked]]
Sendt: 28. juli 2011 16:01
Til: Erik Andersen
Cc: Directory list; SG17-Q11; PKIX
Emne: Re: [pkix] Intermediate CA vs. subject CA

At 11:46 AM +0200 7/24/11, Erik Andersen wrote:
>those term in any PKIX document, but found some in 8.1.2 of X.509, but 
>I am not sure that these definition are generally accepted in the PKI 
>community.
>

Erik,

In PKIX, I think we use these terms relative to a given cert in the context
of a specific cert path. Thus the "subject CA" is the CA that issued the
cert to the indicated subject, which might be an EE or a CA.

An "intermediate CA" is a CA that lies between a TA and a subject CA, in the
context of a cert path and a specified CA.

Steve

---

From: Stephen Kent <[email-masked]>
Date: Wed, 3 Aug 2011 18:19:31 -0400

>the term "intermediate CA" quite a lot.

Yep.

Steve