Re: [TLS] Update spec to match current practices for certificate chain order

["Ryan Sleevi" <[e-mail]>]

On Tue, May 12, 2015 5:16 pm, Martin Rex wrote:
>  Has adding the crossCA variant of the new Baltimore rootCA cert ever
>  been considered/tried?

Yes. It doesn't work.

> I mean dropping the old 1024-bit rootCA should
>  become irrelevant when the the 2048-bit crossCA variant is added
>  as trust anchor.  There is no practical difference between the
>  self-signed variant and the crossCA variant of that trust-anchor.
>  And if the PKIX implemenation is a little dense and does not recognize
>  the equivalence all by itself, then configuring both variants as
>  trust anchors should do the necessary magic.

In a world different than our own, anything is possible.
In the world we have, we deal with an imperfect reality and make it work.

>  Did the supplier of the relevant PKIX implementation fix this
>  implementation
>  shortcoming?

Nope.

Considering it is not required of an RFC 5280-compliant implementation to
support that, any claims that the relevant supplier should would largely
be inconsistent with your past messages. Even if you'd be correct in
arguing they should.