Re: [pkix] Self-issued certificates

Hi Timothy

I am not sure how the first paragraph leads to the second paragraph. Where
is that stated in RFC 5280 or X.509?

Regards

Erik

-----Oprindelig meddelelse-----
Fra: pkix [mailto:pkix-bounces@ietf.org] På vegne af Miller, Timothy J.
Sendt: 13 July 2015 14:25
Til: Peter Bowen; pkix@ietf.org
Emne: Re: [pkix] Self-issued certificates

In X.509 (and PKIX) the name *is* the identity.  X.509 (and PKIX) binds keys
to names; the key can change but the name remains invariant.  In contrast,
SPKI/SDSI binds names to keys; the key remains invariant, but the name can
change.

So if it has a different DN, it's not the same entity.  As a result there's
no ambiguity in the RFC.

It is possible to bind the same key to different names.  Nothing stops you
from presenting the same key to multiple CAs and claiming different names.
If your goal is pseudonymity, though, I wouldn't recommend this.  :)

It's also possible to use keys from X.509 certificates as entities and
ignore the name--e.g., key continuity management (a.k.a. certificate
pinning)--but this is outside the spec.

-- T 

> -----Original Message-----
> From: pkix [mailto:pkix-bounces@ietf.org] On Behalf Of Peter Bowen
> Sent: Sunday, July 12, 2015 5:03 PM
> To: pkix@ietf.org
> Subject: [pkix] Self-issued certificates
> 
> I'm trying to make sense of the definition of "self-issued 
> certificates" in RFC
> 5280 (and X.509)
> 
> Section 3.2 provides a definition: "Self-issued certificates are CA 
> certificates in which the issuer and subject are the same entity."
> However section 6.1 says "A certificate is self-issued if the same DN 
> appears in the subject and issuer fields."
> 
> While it is clear that all certificates with the same DN for subject 
> and issue are self-issued, it is unclear to me whether a certificate 
> with different DNs could be self-issued.  Section 6.1 could be giving 
> one example of how a certificate could be self-issued or section 6.1 could
be a limiting definition.
> 
> Consider the following example:
> Example Trust Services has two different private keys.  Each key has a 
> single associated DN:
> Key0 has DN O=Example Trust Services, OU=Global Trust Anchor
> Key1 has DN O=Example Trust Services, OU=Commercial Trust Anchor
> 
> There is a CA certificate created with
> Subject: O=Example Trust Services, OU=Commercial Trust Anchor Subject 
> Public Key: Key1
> Issuer: O=Example Trust Services, OU=Global Trust Anchor Signed by 
> Key0
> 
> Is this CA certificate considered a self-issued certificate?
> 
> Thanks,
> Peter
> 
> _______________________________________________
> pkix mailing list
> pkix@ietf.org
> https://www.ietf.org/mailman/listinfo/pkix

_______________________________________________
pkix mailing list
pkix@ietf.org
https://www.ietf.org/mailman/listinfo/pkix