Pros Cons Distribution: Multiple Root CAs need to be distributed to the devices Complexity: Multiple CI model results in a more complex path validation due to cross certification Compatibility: Certificate-validation ATA software on devices must consider Spec each organization's hierarchical trust 42 relationships as well as the trust relationships between multiple CAs. these Technical Resource Constraints: Validation as software on devices with limited resources may not be able to handle traversing the path lengths efficiently. that AIA pointers can be used to traverse are the hierarchy, but it is not always used populated correctly, nor are most for relying party clients equipped to do this correctly. Speed and efficiency: Increased network traffic due to the extended length of the certificate chain. Multiple CI Scalability: Issue can be Scalability: Overhead unprecedented possibly resolved with a natural even for a relatively small number of such grouping. organizations as Compatibility: Relying parties must Operational retrieve AIA extension CAIssuers bundle at runtime (or cache) which VPN could be huge resource overhead Policy Overhead: Need to establish initial and continuing audit policies and practices to ensure all CIs follow stringent set of policies and procedures for certificate issuance Policy AeroMACS Policy Authority to audit Considerations policies for each PKI member’s including: - Pre-issuance identity vetting policies, - private-key protection policies, or - CA and directory infrastructure other operational policies.
Pros Cons Multiple CI Technical Distribution: Multiple Root CAs need to be distributed to the devices Complexity: Multiple CI model results in a more complex path validation due to cross certification Compatibility: Certificate-validation software on devices must consider each organization's hierarchical trust relationships as well as the trust relationships between multiple CAs. Resource Constraints: Validation software on devices with limited resources may not be able to handle traversing the path lengths efficiently. AIA pointers can be used to traverse the hierarchy, but it is not always populated correctly, nor are most relying party clients equipped to do this correctly. Speed and efficiency: Increased network traffic due to the extended length of the certificate chain. Operational Scalability: Issue can be possibly resolved with a natural grouping. Scalability: Overhead unprecedented even for a relatively small number of organizations Compatibility: Relying parties must retrieve AIA extension CAIssuers bundle at runtime (or cache) which could be huge resource overhead Policy Considerations Policy Overhead: Need to establish initial and continuing audit policies and practices to ensure all CIs follow stringent set of policies and procedures for certificate issuance AeroMACS Policy Authority to audit policies for each member’s PKI including: - Pre-issuance identity vetting policies, - private-key protection policies, - CA and directory infrastructure operational policies. ATA Spec 42 these as that are used for such as VPN or other
ACP-WP-WMF_PKI%20Certificate%20Policy%20Considerations_AeroMACS_v10_2015-06-13.docx