Open dzacharo opened 1 month ago
This issue was created based on:
This is either closely related or a duplicate of #495.
@dzacharo "not allowed to issue non-TLS leaf Certificates from server TLS-capable Issuing CAs" would disallow the issuance of OCSP Signer Certificates from Server TLS-capable Issuing CAs. I presume that's not your intent?
The TLS BRs need to clearly state that it is not allowed to issue non-TLS leaf Certificates from server TLS-capable Issuing CAs, not even single-purpose "client authentication" leaf Certificates (end-entity certificates with just the
id-kp-clientAuth
EKU), which was allowed before SC-62.