Re: [TLS] Update spec to match current practices for certificate chain order

Peter Gutmann <> Sat, 09 May 2015 13:09 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 9915D1ACD12 for <>; Sat, 9 May 2015 06:09:26 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.91
X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id ML7SAklbOXPr for <>; Sat, 9 May 2015 06:09:24 -0700 (PDT)
Received: from ( []) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 740141ACCD8 for <>; Sat, 9 May 2015 06:09:23 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple;;; q=dns/txt; s=uoa; t=1431176964; x=1462712964; h=from:to:subject:date:message-id: content-transfer-encoding:mime-version; bh=sMFocGkAZzhIhx7R3K37XjPGTGDhDr4Lz7nBheM3tDE=; b=HnhjBc3sh5HxoVlt2rQ4tuEZuoQLSLEpekMNh19Ug/U80bvfmAW9kdpZ OAioTxorIdYSM+q+I330qcuNZECA/EJGSZskaP3nuW0lTtTal4zm4ILAJ i/JzHfqQo+ID5H8/8ZflC+IwsSX8p959zImKP+DYQSn3N8E9snUA9ad2E U=;
X-IronPort-AV: E=Sophos;i="5.13,396,1427713200"; d="scan'208";a="3893820"
X-Ironport-Source: - Outgoing - Outgoing
Received: from ([]) by with ESMTP/TLS/AES128-SHA; 10 May 2015 01:09:15 +1200
Received: from ([]) by ([]) with mapi id 14.03.0174.001; Sun, 10 May 2015 01:09:14 +1200
From: Peter Gutmann <>
To: "<>" <>
Thread-Topic: [TLS] Update spec to match current practices for certificate chain order
Thread-Index: AdCKWVjP/Wn/1mVNQaGtvKPiHTh6MQ==
Date: Sat, 9 May 2015 13:09:14 +0000
Message-ID: <>
Accept-Language: en-NZ, en-GB, en-US
Content-Language: en-NZ
x-originating-ip: []
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <>
Subject: Re: [TLS] Update spec to match current practices for certificate chain order
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sat, 09 May 2015 13:09:26 -0000

Martin Rex <> writes:

>And every sensibly managed public CA ought to refuse signing the same public
>key for different names/identities/attributes (i.e. issuing different certs
>with the same public key).

ITYM "No true Scotsman would sign the same public key for different

(Also, no sensibly managed public CA will issue certs for RFC 1918 addresses,
unqualified domain names, "localhost", nonexistent domains, obviously bogus
domains like "", and so on, so the tens of thousands of
certs like this that have been issued by public CAs must be a figment of our