Re: [saag] subordinate vs intermediate certification authority

[Viktor Dukhovni <[e-mail]>]

On Thu, Feb 04, 2021 at 12:13:22PM -0500, Michael Richardson wrote:

> > > However, if the Anchor (level N) and the Level N+1 certification
> > > authority are in different organizations (such as for an "Enterprise
> > > Certificate"), then the Level N+1 is a subordinate CA.
> >
> > Again, from the vantage point of the verifier, there's no practical way
> > to know.  Some of the Let's Encrypt CA certs are issued by DST others
> > by ISRG.  In common usage, I typically see these referred to as
> > intermediate certificates, but e.g. the ISRG CPS appears to prefer
> > "subordinate":
> 
> That seems to be consistent with my hypothesis that the term "subordinate"
> represents a split in administrative authority.

Sort of, only they explicitly distinguish between affiliate and
unaffiliated subordinate CAs, thus implying that the "split" in question
is not always a feature of subordinate CAs.

The NIST terminology mentioned in this thread makes intermediate a
subclass of subordinate, where intermediate CAs issue subordinate CA
certs, rather than end-entity certs.

My take is that the terminology is all over the place, and I mostly
don't care, but where you need to be precise, you need to carefully
state the definitions that hold in your document...

-- 
    Viktor.