Re: [Pki-devel] assorted sub-CA use case questions
Hi Fraser,
please see my response in-line ...
Christina
On 04/01/2015 08:47 PM, Fraser Tweedale wrote:
Hi Christina,
The following questions emerged in recent discussions and work on
sub-CAs. Your responses will be helpful in working out what work is
needed, and when.
*OCSP signing*
Currently sub-CAs sign OCSP responses with the CA signing
certificate, rather than using the CA cert to sign an OCSP signing
cert and delegating OCSP signing to it.
Question : do you expect customers who use sub-CAs will want to be
able to choose whether sub-CAs have OCSP signing delegate? If so,
how fine-grained should the control be (instance-wide config,
per-subCA, etc?), and can this feature be deferred (i.e. is OCSP
signing directly by CA acceptable for initial release of sub-CAs)?
In general, I
don't think people are aware nor do they care who signs
what as long as it works. However, if we want to make a default choice
for them, I think it's best if we make the right one. For a secure
site, I'd choose to have a separate OCSP responder with a separate ocsp
signing cert, as the administrator of the ocsp response system would not
need to have access to the CA's signing keys. The separate ocsp signing
cert would also allow to be given a shorter validity period than that of
the CA.
If your target customers don't really care much about the above then
technically, I don't see any issue -- the clients should work as long as
your ocsp signing cert is valid.
*Sub-CA DNs*
There is currently no check that a sub-CA's DN is unique.
Question : should we enforce CA DN uniqueness within the Dogtag
instance?
yes. there exists an UniqueSubjectNameConstraint that can be used for
this purpose.
*Sub-CA certificate profile*
Currently sub-CA certificates are created using the `caCert' profile
(the same profile that is used for the self-signed root
certificate).
Question : how much control over aspects of the sub-CA certificates
will customers need or want? (e.g. validity period,
pathLenConstraint, nonstandard extensions, etc). Is using the
`caCert' profile defaults fine for the initial release?
I think it's fine. As long as we provide the flexibility, they can
always create new ones if they see fit.
Look forward to your input.
Cheers,
Fraser