1. People’s Choice… When not just any CA will do
Bruce A Rich
OASIS KMIP F2F, Feb 2016

2. Why multiple CAs?
Partitioning of intranet space into Dev, Test, Production areas
Loose and flexible
More tightly controlled
Rigid controls, may even be further partitioned
May somewhat mirror the internal org chart, reflecting partition of responsibilities and control

3. Can “Certify” a PKCS10 blob via KMIP, but…
If a server has multiple CA personalities, how can the client discover/suggest/hint?
And PKCS10 is not user-friendly, is there a way to request/tweak certificate capabilities through KMIP?

4. Client choice
The Certify API allows Attributes to be passed on the call
KMIP already has X509 Certificate Issuer attribute
Since that is supposed to be unique(ish), use that as a mechanism to refer to the desired issuer
Or could define a more client-friendly (X509 Certificate Issuer Name- >String) attribute

5. Discovering the choices
No (protocol-defined) way to know what CAs the server might be able to contact/use on the client’s behalf
Could add a Query extension for this, would return zero-n X509 Certificate Issuer (or X509 Certificate Issuer Name) attributes
Having the server volunteer the information keeps the client from having to compose this stuff all by themselves…

6. PKCS#10 avoidance?
Could define a couple of new attributes to specify whether the cert would be for a CA or not, the certificate usage type
Already have a variant of AlternativeName that is X500 Distinguished Name
Larger scope than just usage of X500 Certificate Issuer

7. Recommendation
Augment Query with one more optional thing to ask the server
Minimalist profile to show usage

8. Backup slides

9. Common certificate extensions
“Key Usage”
Allowable usages for the public key in the certificate
CERT_SIGN
CRL_SIGN
DATA_ENCIPHERMENT
DIGITAL_SIGNATURE
GOVT_APPROVED
KEY_AGREEMENT
KEY_ENCIPHERMENT
NON_REPUDIATION
These are covered via the Cryptographic Usage Mask on the public key (except GOVT_APPROVED, see KMIP Spec 3.19)
Omission is interpreted as all of the above
OID = { 2, 5, 29, 0F }

10. Common certificate extensions…
“Basic constraints”
Tells whether the cert is for a CA or not (TRUE or FALSE)
OID = { 2, 5, 29, 19 }
Impacts all interpretation of extended key usages

11. Alternative Name Can provide most of the information needed by Certify
DNS Name
IP Address
X500 Distinguished Name
Only need
“Basic Constraints”, “CA=true” attribute
“Extended Key Usage” bitset attribute