Quantcast
Channel: All SRX Services Gateway posts
Viewing all articles
Browse latest Browse all 17645

Re: Digital Certificate exchange

$
0
0

Hello,

 

 

Your understanding is not entirely wrong. In simple words:-

 

* Recipient must maintain the certificate chain if it needs to secure authenticate peer when their Sub-CAs are different.

* Sender can send certificate chain (e.g. Local Cert + Sub Cert + Root Cert) but sender's chain will not be used generally to

  authenticate Sender unless receiver has trust relations with Sub Cert + Root Cert. This chain may be used to gather

  information like CRL but not authenticating sender.

 

So just because sender is sending Sub CA + Root CA, I (receiver) will not use those certificates for validating sender unless receiver also trusts Sub CA + Root CA (It has a chain).

 

Regards,

 

Rushi


Viewing all articles
Browse latest Browse all 17645

Trending Articles