self-signed certs that aren't the final certificates in the path

Question

The X.509 spec makes frequent statements like this:

  (b)  If certificate i is self-issued and it is not the final
       certificate in the path, skip this step for certificate i.

How can you have a cert that is self-issued and not be the final cert in the path? Is the issuer and the subject are the same how are you supposed to find parent cert?

Answer 1

Self-signed and self-issued are two different things. Thus, the self-issued certificate has the same subject as issuer, but is not signed by the same key. This means there is another certificate which binds the public key used to signed the self-issued certificate.

This can be used for key rollover, e.g. an organization starts using a new key, creates a new self-signed certificate and creates a self-issued certificate for the old key.