Re: RFC 5280 interpretation of trust anchor certificates

My personal view is that clarity about path building, regarding the
semantics of the issuer and subject either as names or KI, and a statement
of what can be used to terminate path building regarding the signing
keypair in question are a better basis of trust anchor definition than
handwaving about self signed certificates. Plus, some words about
validators choices of trust anchor, and it's centrality to the process.

It should be clear self signing and arguably even a certificate per se, is
broadly irrelevant. What matters is the path to a key which is trusted, so
that validation can process with certainty, and the independence to select
trust anchor(s) outside of the specific issuer subject chain under "test"

Is this an over simplified view?

Cheers G

_______________________________________________
pkix mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/pkix