Subject: [Netconf] zerotouch/16: How to encode a chain of certs?

From: Kent Watsen <[email-masked]>
Date: Thu, 7 Jul 2016 00:14:32 +0000

New issue: https://github.com/netconf-wg/zero-touch/issues/16

The draft currently states that the owner-certificate is just a single certificate, but the owner certificate actually needs to be presented along with its chain of intermediate certificates leading up to the trust anchor certificate known the to manufacturer's devices.  Here are some options:

  1. use an ordered-by-user leaf-list of the X.509v3 structures encoded using DER
 2. use a PEM file (string) that can encode multiple certificates
  3. use a PKCS#12 structure from RFC 7292 to encode a bundle of certs

Notes:
  - Option #1 is what is currently used in the system-keychain model, but I think that it’s clunky and should be replaced.
  - OpenSSL can convert between #2 and #3 well enough.

Thoughts?

Thanks,
Kent