In the PKIX documentation it mentions:
- The certificate representing the TrustAnchor should not be included in the certification pat开发者_如何学编程h
My question is, where does this restriction come from? In the RFC 5280 I only found:
- A certificate MUST NOT appear more than once in a prospective certification path.
Does the statement (2) in RFC somehow imply statement (1)? Because I can not see it.
What problem would be created by having the trust anchor in the path as well? In the end, the TA certificate can validate itself.
Could anyone please explain this?
It's more a definitional thing, IIUC. A valid certification path is defined in RFC 5280 and one condition is that its first certificate is signed by a trust anchor (and that the issuerName of the certificate matches that trust anchor's name). (Trust anchors need not be certificates.)
精彩评论