Re: [TLS] Record layer corner cases

[Martin Rex <martin.rex at sap.com>]

Kemp, David P. wrote:
> 
> There is no misbehavior involved at all, and no reason to
> complain to VeriSign about any dates contained in a rootCA
> certificate.  In fact, VeriSign could have made the nature
> of trust anchor information more explicitly obvious if they
> had stuck in a validity period of Jan 1, 1900 0000Z -
> Jan 1, 1900 0000Z.  Including nonsense in the certificate
> fields that are not part of a trust anchor makes it obvious
> that the certificate is just a data structure that is being
> re- (or mis-)used to convey trust anchor information.

I do not mind about not checking validity dates (or even signatures)
on trust anchors.  But when an X.509 certficates is sent as part of
a certification path, then it is not a trust anchor, but instead
a regular certificate -- and therefore MUST be a correct certificate
(or not be sent in a certification path!).


-Martin

_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls