Open MikeBishop opened 8 years ago
This is, I think, a complete copy of the TLS language:
Because certificate validation requires that trust anchors be distributed independently, a certificate that specifies a trust anchor MAY be omitted from the chain, provided that supported peers are known to possess any omitted certificates.
The point being that what comprises a "root" can be vague. For example, certification paths can include multiple potential trust anchors.
From Andrei:
SHOULD? MUST? Though, back to DANE, if DNS says that the cert must chain to a CA that the client doesn’t otherwise trust, wouldn’t the client need to see that cert to validate the signature?
I defer to my TLS brethren on this issue.