Re: [saag] subordinate vs intermediate certification authority

["Dr. Pala" <[e-mail]>]

Hi Michael, all,

I would not add specific significance to terminology that has been used 
interchangeably for many years. In the public eye "Intermediate CA" or 
"Subordinate CA" are equivalent (used in different contexts, though). If 
you want to make the distinction because in your work you want to 
differentiate if a CA is run by the same organization that runs the 
Trust Anchors, I would suggest you make it very explicit in the text so 
as not to confuse people.

Developers and Practitioners (see the note on OpenSSL's conventions) 
seem to support more the "Intermediate CA" for technical conversations 
while "Subordinate CA" is usually referred to in the context of PKI 
policies.

RFC3647 talks about subordinate organizations instead - maybe that is 
the concept you need to use? What is weird about the question is the 
different logical levels that you are trying to put together: business 
relationships and certification chains.

I hope this helps,

Cheers,
Max

On 2/3/21 9:10 PM, Michael Richardson wrote:
> I thought I had cross-posted this, but apparently I did not:
>    https://mailarchive.ietf.org/arch/msg/anima/3tNwWb9gBacdYMTr1TtXzSa_3_Q/
>
> FC5280 uses the term "intermediate certificates", and they are presumably
> issues by "intermediate" certification authorities.
>
> That term does not appear, although:
>       "intermediate CA certificates"
> occurs.
>
> RFC4949 defines "intermediate CA"
> However, the usage in RFC4949 seems entirely related to cross-certification,
> rather than a PKI that has multiple layers of certification authority!
>
> RFC4949 defines "subordinate CA" in a way that implies it is part of the same
> organization.
> RFC5280 uses the term "subordinate" in section 3.2, but later in referring to
> RFC1422, notes that in X509v3, we don't need the same structure.
> In reading it, it feels that the term subordinate should refer to v1
> certificates only.
>
> At this point, in 2020, can someone give me some guidance on using these terms?
>
> My intuition, which I have started to document at:
>     https://www.ietf.org/archive/id/draft-richardson-t2trg-idevid-considerations-01.html#name-number-of-levels-of-certifi
>
> is that if the Trust Anchor (Level one) and the Level Two Certification
> Authority are under control of the same organization, then the Level Two is
> an "intermediate" certification authority.
>
> However, if the Anchor (level N) and the Level N+1 certification authority
> are in different organizations (such as for an "Enterprise Certificate"),
> then the Level N+1 is a subordinate CA.
>
> This question comes from working on draft-ietf-anima-constrained-voucher,
> in which we have a number of choices on which certificate (or public key) to
> pin our constrained-RFC8366 voucher.
>
> --
> Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
>             Sandelman Software Works Inc, Ottawa and Worldwide
>
>
>
>
>
> _______________________________________________
> saag mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/saag
-- 
Best Regards,
Massimiliano Pala, Ph.D.
OpenCA Labs Director
OpenCA Logo