In the TLS Handshake a
Certificate message is sent. This message contains the (chain of) certificates needed to validate the provided certificate of the communicating party.
However, I have also read some papers, and also defined in RFC5280, that the certification path process is challenging; and, an algorithm is needed to actually do the path construction.
This confused me, since during the TLS Handshake the chain of trust is provided in the
Certificate message. Therefore I was wondering: Is a Certification path algorithm also needed in the TLS protocol?
- If so, why is it needed? As far that I know, the
Certificatemessage sends all the certificates in the chain of trust.
- If not, is it true then that the
Certificatemessage does not (always) provide all the certificates in the chain? Or maybe, does the certification path algorithm not apply at all for SSL/TLS; but for what kind of protocols is it needed then?