Home/ Questions/Q 4580918
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-21T20:51:02+00:00

In the PKIX documentation it mentions: The certificate representing the TrustAnchor should not be

  • 0

In the PKIX documentation it mentions:

  1. The certificate representing the
    TrustAnchor should not be included in
    the certification path

My question is, where does this restriction come from? In the RFC 5280 I only found:

  1. A certificate MUST NOT appear more
    than once in a prospective
    certification path.

Does the statement (2) in RFC somehow imply statement (1)? Because I can not see it.

What problem would be created by having the trust anchor in the path as well?
In the end, the TA certificate can validate itself.

Could anyone please explain this?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    It’s more a definitional thing, IIUC. A valid certification path is defined in RFC 5280 and one condition is that its first certificate is signed by a trust anchor (and that the issuerName of the certificate matches that trust anchor’s name). (Trust anchors need not be certificates.)

    • 0