Subject: Re: [dane] #37: Additive assertion of server certificate

From: Matt McCutchen <[email-masked]>
Date: Sat, 01 Oct 2011 11:54:43 -0700

On Tue, 2011-09-27 at 23:39 -0400, Richard L. Barnes wrote:
> This is a non-issue.  Using the cert as a TA means that you accept any
> chain starting with that cert.  Since a server cert itself is a chain
> starting with that cert (of length 1), if you put a server cert in a
> type 2 record, it Just Works.

It occurs to me that exactly the same argument can be made to eliminate
usage 1: if we delete the word "CA" from the definition of usage 0, then
you can just publish the server cert and it will chain through itself,
as required.

The only difference between usages 0/1 and 2 is the additivity of the
assertion, so I cannot see the motivation for having separate usages for
non-additive assertions of CA and EE certs and declining to similarly
subdivide the additive assertions.  We should have both of usages 1 and
3 or neither (of course, I would prefer both).  The status quo is just a
windfall for the public CAs, since folks like me will have to get a
publicly recognized server cert to be able to do an assertion of the
server cert via usage 1.

-- 
Matt