During SSL server validation, it seems that the only fields of X509 certificates found in trust stores that are actually used are the "Common Name" and the "Public Key".
I'm not talking about any specific certificate validation implementation, but let's use OpenSSL as an example.
It seems that normal checks that happen to intermediate CA certificates do not apply to those present inside the anchor store, for example that basic constraints are not checked, dates are not checked, cipher weakness is not checked etc.
So I have two questions:
- Is the behavior I described correct? Are there any other fields being used?
- Should such 'extras' be checked according to the relevant RFCs ? From a casual read, it seems that everything in the anchor store is a priori trusted; no further checks should be done. This means that a CA certificate that lacks the CA:true constrain can issue other certificates and be the root of a valid chain. It also means that a CA certificate that has expired can also be root of a valid chain. Thoughts?