{"action":"created","issue":{"url":"https://api.github.com/repos/Javex/libscep/issues/25","labels_url":"https://api.github.com/repos/Javex/libscep/issues/25/labels{/name}","comments_url":"https://api.github.com/repos/Javex/libscep/issues/25/comments","events_url":"https://api.github.com/repos/Javex/libscep/issues/25/events","html_url":"https://github.com/Javex/libscep/issues/25","id":63245258,"number":25,"title":"requesting certs for different purposes","user":{"login":"gknocke","id":1614633,"avatar_url":"https://avatars.githubusercontent.com/u/1614633?v=3","gravatar_id":"","url":"https://api.github.com/users/gknocke","html_url":"https://github.com/gknocke","followers_url":"https://api.github.com/users/gknocke/followers","following_url":"https://api.github.com/users/gknocke/following{/other_user}","gists_url":"https://api.github.com/users/gknocke/gists{/gist_id}","starred_url":"https://api.github.com/users/gknocke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gknocke/subscriptions","organizations_url":"https://api.github.com/users/gknocke/orgs","repos_url":"https://api.github.com/users/gknocke/repos","events_url":"https://api.github.com/users/gknocke/events{/privacy}","received_events_url":"https://api.github.com/users/gknocke/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Javex/libscep/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-03-20T15:11:49Z","updated_at":"2015-03-31T12:45:52Z","closed_at":null,"body":"I'm confused by this information from the draft:\r\n>The pkcsPKIEnvelope for this message type is protected using the\r\n> public key of the recipient as detailed in Section 3.1.2.  For\r\n>example if a self-signed certificate was used to send the original\r\n>request then this self-signed certificate's public key is used to\r\n>encrypt the content-encryption key of the SUCCESS response's\r\n>pkcsPKIEnvelope.\r\n\r\nThe mentioned example forces the user to use the same certificate for signing and encryption. This is in fact not recommended. Later, the following is stated:\r\n\r\n>Since there can be multiple outstanding requests from one\r\n>requester (for example, if different keys and different key-usages\r\n>were used to request multiple certificates), the transaction ID must\r\n>also be included, to disambiguate between multiple requests.\r\n\r\nAssuming the CA limits the key-usage to signing only, SCEP would fail when staying compliant to the above example.\r\n\r\nI can only see one solution which contributes to previous discussions: If the client uses a different encryption cert than a signing cert, he MUST include BOTH in his request (regardless which kind of request). Then, the recipient has the opportunity to use a public key for encryption provided via the request. Do you agree? However, this leads to further questions. How can the server decide which cert to use for encryption if multiple possibilities are given? Probably all of them with appropiate key-usage and validity... I'm not sure if the same holds for multiple server signing certificates."},"comment":{"url":"https://api.github.com/repos/Javex/libscep/issues/comments/88070852","html_url":"https://github.com/Javex/libscep/issues/25#issuecomment-88070852","issue_url":"https://api.github.com/repos/Javex/libscep/issues/25","id":88070852,"user":{"login":"Javex","id":641439,"avatar_url":"https://avatars.githubusercontent.com/u/641439?v=3","gravatar_id":"","url":"https://api.github.com/users/Javex","html_url":"https://github.com/Javex","followers_url":"https://api.github.com/users/Javex/followers","following_url":"https://api.github.com/users/Javex/following{/other_user}","gists_url":"https://api.github.com/users/Javex/gists{/gist_id}","starred_url":"https://api.github.com/users/Javex/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Javex/subscriptions","organizations_url":"https://api.github.com/users/Javex/orgs","repos_url":"https://api.github.com/users/Javex/repos","events_url":"https://api.github.com/users/Javex/events{/privacy}","received_events_url":"https://api.github.com/users/Javex/received_events","type":"User","site_admin":false},"created_at":"2015-03-31T12:45:52Z","updated_at":"2015-03-31T12:45:52Z","body":"We should check that if SCEP allows multiple certificates that we also provide the possbility to add multiple certificates instead of a single one."}}