David & Sean,
We put checks into the validation spec to try to ensure that CAs
issue certs consistent with the profile.
This profile is for a large, highly distributed system that needs to
work reliably across the public Internet. Note that the RPKI asks
Internet registries and ISPs to act as CAs. They are not
organizations that set out to act as CAs to make money issuing certs;
they allocate address space (either as a primary function, or as a
side effect of offering ISP services). We don't want to make life
hard for them, either as CAs or as RPs. Recall that the RPKI is
unusual (unique?) in that essentially every RP is also a CA, so each
of these organizations has a dual role.
Over the years we have seen a lot of examples of CAs doing an awful
job of issuing certs in compliance with the PKIX profiles, and RP
software that behaves equally poorly, condoning (encouraging?) such
behavior. My hope (maybe Geoff's ad well) is to try to get RP
software to help detect bad CA behavior in this respect, to provide a
feedback loop to help address such problems.
Steve
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
