Re: [pkix] reminder

[Scott Schmit <[e-mail]>]

On Thu, Aug 02, 2012 at 01:06:43PM -0400, Stephen Kent wrote:
> Below is the text that was briefed in the PKIX meeting yesterday and
> that represents the current, proposed text for addition to Section
> 3.2. Russ noted that we need to add a reference to the 2008 version of
> X.509 from which we have cited text.  Peter will reissue the doc with
> this change. I plan to forward that version to the IESG a week after
> it is posted, unless we hear otherwise.
> 
> Steve
> -----
> 
> Add the following paragraph to the end of RFC 5280, Section 3.2:
> 
> Consistent with Section 3.4.61 of X.509 (11/2008) we note that use
> of self-issued certificates and self-signed certificates issued by
> other than CAs are outside the scope of this specification. Thus,
> for example, a web server or client might generate a self-signed
> certificate to identify itself. These certificates, and how a
> relying party uses them to authenticate asserted identities, are
> both outside the scope of RFC 5280.

As I read it, if you aren't a CA and generate a self-signed certificate,
then that certificate isn't a PKIX certificate.  Is that statement
right?

If so, it sort of screws up draft-ietf-dane-protocol:

From section 2.2.1:
#     3 -- Certificate usage 3 is used to specify a certificate, or the
#     public key of such a certificate, that MUST match the end entity
#     certificate given by the server in TLS.  This certificate usage is
#     sometimes referred to as "domain-issued certificate" because it
#     allows for a domain name administrator to issue certificates for a
#     domain without involving a third-party CA.  The target certificate
#     MUST match the TLSA record.  The difference between certificate
#     usage 1 and certificate usage 3 is that certificate usage 1
#     requires that the certificate pass PKIX validation, but PKIX
#     validation is not tested for certificate usage 3.
#
#  The certificate usages defined in this document explicitly only apply
#  to PKIX-formatted certificates in DER encoding [X.690].  If TLS
#  allows other formats later, or if extensions to this RRtype are made
#  that accept other formats for certificates, those certificates will
#  need their own certificate usage values.

(TLSA Certificate usage 3 is intended for self-signed "PKIX"
certificates.)

Maybe the problem is that we talk about PKIX-formatted certificates vs.
PKIX-validated certificates, but both are handled in RFC 5280.

Can we distinguish the two?

-- 
Scott Schmit