I'm having trouble using Wget to download a file over HTTPS from
ftp.gnu.org using the Let's Encrypt X3 root. The Let's Encrypt X3 is cross-certified, which means it has an issuer and its not self-signed. When using Let's Encrypt X3, Wget is failing with the error it can't find the issuer certificate even though I am trying to root trust in the Let's Encrypt certificate.
I visited RFC 4158, Internet X.509 Public Key Infrastructure: Certification Path Building to see what the behavior should be. The document discusses in detail building paths from end-entity or subscriber certificates to CA roots and trust anchors. Its what one would expect.
However, Section 1.3 provides terminology, and it defines trust anchors:
Trust List: A list of trust anchors.
Trust Anchor: The combination of a trusted public key and the name of the entity to which the corresponding private key belongs.
Trust Anchor Certificate: A self-signed certificate for a trust anchor that is used in certification path processing.
"Trust Anchor Certificate" and the definition that demands "self-signed" means we cannot root trust in a subordinate certificate, like the Let's Encrypt X3 root that's been cross-certified.
My question is, why did the RFC do that? Why are we forced to use a self-signed certificate as an anchor, and include unneeded portions of the PKI that only serve to complicate path building and increase attack surface?