Re: [saag] [lamps] subordinate vs intermediate certification authority

[Michael Richardson <[e-mail]>]

Thanks for the many emails on this; I think that it was useful to me.

Brockhaus, Hendrik <[e-mail]> wrote:
    > I also recognized the lack of clear definitions of these terms.

    > May be the definitions in the NIST glossary help.

Thanks, that's a good place to go.
I think that the NIST definitions are probably good enough for now.
(I wish revising RFC4949 was cheaper)

    > From NIST SP 800-32"
    > https://csrc.nist.gov/glossary/term/subordinate_CA "subordinate CA In a
    > hierarchical PKI, a CA whose certificate signature key is certified by
    > another CA, and whose activities are constrained by that other CA. (See
    > superior CA). From NIST SP 800-32"

    > The definition of intermediate CA from the NIST glossary differs to the
    > one in RFC 4949, but I think it fits better for todays use. The
    > definition of subordinate CA seems to fit well also with RFC 4949.

...

my conclusion is that mostly, the terms are interchangeable, but that
"subordinate" might be used when there is a clearer "constrained".
For instance, if there were a Path Constraint by the superior CA.

Or: all subordinate CAs are intermediate CAs, but not vv.


--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide