Re: [saag] subordinate vs intermediate certification authority

[Michael Richardson <[e-mail]>]

Thank you folks for the discussion.

On 2021-02-03 11:10 p.m., Michael Richardson wrote:
> 
> I thought I had cross-posted this, but apparently I did not:
>    https://mailarchive.ietf.org/arch/msg/anima/3tNwWb9gBacdYMTr1TtXzSa_3_Q/
> 
> FC5280 uses the term "intermediate certificates", and they are presumably
> issues by "intermediate" certification authorities.
> 
> That term does not appear, although:
>       "intermediate CA certificates"
> occurs.
> 
> RFC4949 defines "intermediate CA"
> However, the usage in RFC4949 seems entirely related to cross-certification,
> rather than a PKI that has multiple layers of certification authority!

Based upon the discussion on the list, the NIST references, and a look 
at the US GOV Federal  https://fpki.idmanagement.gov/tools/fpkigraph/

It seems that actually the Intermediate CA has extensive use related to 
cross-certification.  To the extent that the term has been used in our 
documents, it is usually associated with path validation, and this is 
usually important when bridge CAs are involved.

I will use the term subordinate CA when speaking about a multi-level 
PKI.  If I had the opportunity to update RFC4949 and RFC5280, it would 
be to add subordinate/superior CA to the document, with references to 
the NIST documents.