Re: [saag] [lamps] subordinate vs intermediate certification authority

["Brockhaus, Hendrik" <[e-mail]>]

Michael

I also recognized the lack of clear definitions of these terms.

May be the definitions in the NIST glossary help.
https://csrc.nist.gov/glossary/term/Intermediate_Certification_Authority
"intermediate CA
A CA that is signed by a superior CA (e.g., a Root CA or another Intermediate CA) and signs CAs (e.g., another Intermediate or Subordinate CA). The Intermediate CA exists in the middle of a trust chain between the Trust Anchor, or Root, and the subscriber certificate issuing Subordinate CAs. From CNSSI 4009-2015 CNSSI 1300
A CA that is subordinate to another CA, and has a CA subordinate to itself. From NIST SP 800-32"
https://csrc.nist.gov/glossary/term/superior_CA
"superior CA
In a hierarchical PKI, a CA who has certified the certificate signature key of another CA, and who constrains the activities of that CA. (See subordinate CA). From NIST SP 800-32"
https://csrc.nist.gov/glossary/term/subordinate_CA
"subordinate CA
In a hierarchical PKI, a CA whose certificate signature key is certified by another CA, and whose activities are constrained by that other CA. (See superior CA). From NIST SP 800-32"

The definition of intermediate CA from the NIST glossary differs to the one in RFC 4949, but I think it fits better for todays use. The definition of subordinate CA seems to fit well also with RFC 4949.

I often read the term "Issuing CA" referring to those CAs issuing end entity certificates.
https://www.omnisecu.com/security/public-key-infrastructure/certificate-authority-ca-hierarchy.php
But I am not aware of any official definition. Sometime the term issuing CA is also used more general to refer to the CA that's issued any certificate, not only an end entities.

Hendrik

> -----Ursprüngliche Nachricht-----
> Von: Spasm <[e-mail]> Im Auftrag von Michael Richardson
> 
> I thought I had cross-posted this, but apparently I did not:
> 
> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmaila
> rchive.ietf.org%2Farch%2Fmsg%2Fanima%2F3tNwWb9gBacdYMTr1TtXzSa_3
> _Q%2F&amp;data=04%7C01%7Chendrik.brockhaus%40siemens.com%7C255
> 1cabf1d654a19be8308d8c8c2f242%7C38ae3bcd95794fd4addab42e1495d55a%
> 7C1%7C0%7C637480086901728875%7CUnknown%7CTWFpbGZsb3d8eyJWIjoi
> MC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C200
> 0&amp;sdata=GtWLDA9UZnBbTgy4SPKe5GP2PcTnjz9x5SnL2HRxwZY%3D&a
> mp;reserved=0
> 
> FC5280 uses the term "intermediate certificates", and they are presumably
> issues by "intermediate" certification authorities.
> 
> That term does not appear, although:
>      "intermediate CA certificates"
> occurs.
> 
> RFC4949 defines "intermediate CA"
> However, the usage in RFC4949 seems entirely related to cross-certification,
> rather than a PKI that has multiple layers of certification authority!
> 
> RFC4949 defines "subordinate CA" in a way that implies it is part of the same
> organization.
> RFC5280 uses the term "subordinate" in section 3.2, but later in referring to
> RFC1422, notes that in X509v3, we don't need the same structure.
> In reading it, it feels that the term subordinate should refer to v1 certificates
> only.
> 
> At this point, in 2020, can someone give me some guidance on using these
> terms?
> 
> My intuition, which I have started to document at:
> 
> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww
> .ietf.org%2Farchive%2Fid%2Fdraft-richardson-t2trg-idevid-considerations-
> 01.html%23name-number-of-levels-of-
> certifi&amp;data=04%7C01%7Chendrik.brockhaus%40siemens.com%7C2551
> cabf1d654a19be8308d8c8c2f242%7C38ae3bcd95794fd4addab42e1495d55a%7
> C1%7C0%7C637480086901728875%7CUnknown%7CTWFpbGZsb3d8eyJWIjoi
> MC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C200
> 0&amp;sdata=abLRY9YWMtjjKzmrCsVgRV8pJj8At2rF74vGzTITV%2B4%3D&a
> mp;reserved=0
> 
> is that if the Trust Anchor (Level one) and the Level Two Certification
> Authority are under control of the same organization, then the Level Two is
> an "intermediate" certification authority.
> 
> However, if the Anchor (level N) and the Level N+1 certification authority are
> in different organizations (such as for an "Enterprise Certificate"), then the
> Level N+1 is a subordinate CA.
> 
> This question comes from working on draft-ietf-anima-constrained-voucher,
> in which we have a number of choices on which certificate (or public key) to
> pin our constrained-RFC8366 voucher.
> 
> --
> Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
>            Sandelman Software Works Inc, Ottawa and Worldwide
> 
> 
>