1

I found this article and stumbled upon the part:

So if a client trusts either of the G5 certificates as a trusted root, it will trust any certificate issued by a subordinate CA such as the G3.

As to my understanding of RFC5280 (Section 6.1.1 (d)), the server needs to indicate which TrustAnchor the client should validate the certificate path against. The author of the first article (to my understanding) claims that this indication is not necessary and/or that the client will accept my certificate it it trusts any one of the signing CAs.

So assuming we have a scenario like this:

Root A --> intermediate
Root B --> intermediate
intermediate --> my Cert

where Root A and Root B both signed intermediate and intermediate signed my Cert. The Server is configured to deliver intermediate and my Cert as the certificate path and will hint that Root A should be the Trust Anchor.

  1. A client will obviously accept my Cert if it has Root A as a Trust Anchor.
  2. Will a client accept my Cert if it has only Root B as a Trust Anchor?
  3. Will a client accept my Cert if it has only intermediate as a Trust Anchor?
  4. Will a client accept my Cert if it has only a self-signed Version of intermediate (but same priv/pub Key and Subject) as Trust Anchor?
  5. Does any answer change if Root A and Root B both have the same Subject?
  6. If any answer is No, how can a server know which Trust Anchor the Client has, as in which RootCA to indicate for the Path-Validation?
  • Note 5280 (and PKIX) includes applications that do not involve any client and server roles; 6.1.1d is information the validator already has itself separate from a received cert/chain/claim. For a server in TLS (which is only one application of PKIX, although an important one) the RFCs require that the server provide a full path to (but optionally excluding) some root, but do not require the client use that path if it has or obtains another it considers acceptable. Nowadays people use AIA quite a bit more than was common when 5280 and 5246 were written. – dave_thompson_085 Jul 27 '17 at 5:08
  • Also note G5 is just 'generation 5'; the important distinction in the article you link is between 'Primary CA' which in this context means root or quasi-root and which has had several generation, versus 'Secure Server CA' which in this context is an intermediate. – dave_thompson_085 Jul 27 '17 at 5:16
1

I suspect, you are talking about SSL/TLS certificate validation in a HTTPS context.

how can a server know which Trust Anchor the Client has, as in which RootCA to indicate for the Path-Validation?

server don't know and not required to know about trusted anchors installed on the client. Server sends leaf and intermediate CA certificates (without roots) and the rest is up to client.

Client uses retrieved certificates and constructs certificate chains. During certification path building multiple chains can be produced (due to cross-certification). That is, leaf certificate has more than one path to one or more trusted anchors. Depending on on client configuration (crypto library), only single chain (best one) is chosen and used for the rest process of certificate validation.

Eventually, there might be a case that chains on server and client are different. For instance, server has Root A as a trust anchor (but no Root B), while client has Root B as a trust anchor (but no Root A). If intermediate certificate can be chained to Root A on server and to Root B on client, the certificate will be successfully accepted.

Does any answer change if Root A and Root B both have the same Subject?

they have to have the same subject, because one of certificate binding in the chain rules is that issuer field of the certificate must match the Subject field of the issuer certificate. Otherwise, the issuer certificate may not be found.

Will a client accept my Cert if it has only a self-signed Version of intermediate (but same priv/pub Key and Subject) as Trust Anchor?

if crypto library does support use of non-self-signed certificates as a Trusted Anchor (Microsoft CryptoAPI, for instance, does) then it is possible. Then root certificate has no effect in the certification path building.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.