Re: [TLS] [pkix] New version of Multiple OCSP mode of Certificate

[Martin Rex <[e-mail]>]

Nicolas Williams wrote:
> 
> If you have a non-traditional PKI then the path sent by the peer may
> only be partially helpful.  (Though in that case you probably won't be
> using AIA but instead searching a directory or configuration.)
> 
> > So really, a server with a certificate from a fancy briged CA should
> > definitely, similar to the "server name indication" get a TLS
> > ClientHello extension defined and have the client provide hints
> > about the trust anchors if the server is unable to send a certificate
> > chain acceptable to the client's certificate path validation
> > algorithm as-is without such information.

And if you have a fancy bridged CA, you will likely have the requirement
to add and maintain your own RootCA cert(s) into the trust anchor stores of
an of-the-shelf software/browser anyway, so you should be able to
use the exact same mechanism to push all necessary bridgeCAs
to your clients entirely obviating the need for AIA-cert-downloads.

Well, except maybe if you're just deploying Microsoft Windows 7 and
realize that your existing schemes for client certificate enrollment
and distribution of RootCA certs that worked on previous versions
of Windows fail in unexpected ways...(*)  But that is a regular software
maintenance issue otherwise irrelevant for the issue at hand.


-Martin

(*) like the bug described for the AllowUntrustedRoot value for the
    Restrictions parameter, which was defective in Vista rtm, fixed in SP1
    and seems to have regressioned back into 7rtm:

http://msdn.microsoft.com/en-us/library/aa378051%28VS.85%29.aspx