Skip to content

Commit

Permalink
RS-002: Clarify that channel messages to Internet gateways must use s…
Browse files Browse the repository at this point in the history 
…elf-issued certs
  • Loading branch information
@gnarea
gnarea committed Jul 19, 2024
1 parent 1bc4a69 commit d89f482
Showing 1 changed file with 3 additions and 1 deletion.
4 changes: 3 additions & 1 deletion rs002-pki.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,9 @@ Conversely, an Internet gateway will start with one certificate (self-issued), p

Self-issued certificates MUST only be used to issue certificates to peers, and therefore such certificates will be the root for a PDA or a [Cargo Delivery Authorization (CDA)](#cargo-delivery-authorization-cda). Self-issued certificates MUST NOT be used to sign channel or binding messages.

Certificates issued by peers MUST be used to sign [channel](rs000-core.md#gateway-messaging-protocol) and [binding](rs000-core.md#gateway-synchronization-binding) messages like cargoes.
Certificates issued by peers MUST be used to sign [channel](rs000-core.md#gateway-messaging-protocol) and [binding](rs000-core.md#gateway-synchronization-binding) messages like cargoes,
except for channel messages sent to Internet gateways,
which MUST use self-issued certificates as the recipient is an Internet node.
A certificate issued by a private gateway to its Internet peer is known as a CDA, and additional requirements and recommendations apply.

### Cargo Delivery Authorization (CDA)
Expand Down

0 comments on commit d89f482

Please sign in to comment.