Re: [pkix] Self-issued certificates

[Peter Gutmann <[e-mail]>]

Miller, Timothy J. <[e-mail]> writes:

>> rfc4210 is sufficient complex and awkward that is not used anywhere
>> around TLS (at least the stuff that I come in contact with) nor common
>> web-service or pkcs#7/CMS based data exchange scenarios.
>
>I didn’t say it was *used*, I said it would *work*.  ;)

You can't really claim that it'll work either.  CMP is sufficiently
dysfunctional and broken that it's really hard (in many cases almost
impossible) to get two implementations to talk to each other just to do a
standard "gimme a cert" (which is all that 99.5% of users really care about).
Given that, I'd put the chances of something as untried as a TA-update working
correctly at "vanishingly small", at best.  So the correct phrasing would be
something like "CMP has something that could, in theory, work, if someone
implemented it".

Peter.