[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
cert chain processing
Is it possible to mandate that if sending a cert chain, it be sent as a
single cert payload as pkcs7 wrapping of all necessary certs?
I can't think of any good reason to support sending all the certs in
arbitrary orders in the payload.
Ex:
Chain : Root, CA1, CA2, UserCert
Possible payload:
ID, CA2, Sig, CA1, User
Much Better:
ID, Cert, Sig where Cert contains all the necessary certs in one place.
Of course its possible to grovel around the entire payload and build up the
chain before processing the sig payload, but I see no benefit in supporting
this complexity.
Also, say someone wanted to send 2 chains, for whatever reason. If we had
it mandatory that chains sent as single cert payloads, this is easy.
Supporting multiple chains with in the freeforall individual cert payload
format is just stupid.
Comments?
bs
Follow-Ups: