February 12, 2002
Practical Aspects of Modern Cryptography
84
Three ways to chain
nName matching
n“Exact matching”
nExactly one parent, rigidly defined
nWhen parent cert expires, link always dies, need to reissue
n“KeyID matching”
nMatch off keys, not names