Re: [keyassure] I-D Action:draft-ietf-dane-protocol-05.txt

[Martin Rex <[e-mail]>]

Paul Hoffman wrote:
> 
> On 2/23/11 6:05 AM, Martin Rex wrote:
> > Jakob Schlyter wrote:
> >>
> >> On 23 feb 2011, at 12.04, Ben Laurie wrote:
> >>
> >>>          1 -- A PKIX end-entity certificate in DER encoding
> >>>
> >>>          2 -- A PKIX certification authority's certificate in DER encoding
> >>
> >> I agree this is a reasonable clarification.
> >
> > If anything, I would really prefer something like
> >
> >     1 -- An end-entity X.509 certificate in ASN.1 DER encoding
> >
> >     2 -- A certification authority's X.509 certificate in ASN.1 DER encoding
> 
> X.509 is a standard that does not contain all of the extensions created 
> by the PKIX Working Group in the IETF. Using "PKIX" makes it clear that 
> we are talking about certificates with the IETF extensions, not 
> certificates missing them.

"PKIX certificates" looks somewhat undefined to me.

For me, it suggests the rules defined in rfc-5280 for X.509v3 End-entity
and CA path certificates only, but excludes both TrustAnchors and
self-signed X.509v1 certs for use as public key containers.

-Martin