> That isn't what you wrote. Machine don't do "What I really meant", only what you actually wrote. This isn't code for a machine, it's a conversation. If you

> That isn't what you wrote. Machine don't do "What I really meant", only what you actually wrote. This isn't code for a machine, it's a conversation. If you interpreted it in a way that sounds broken to you, please tell me exactly how and I'll either clarify or learn something new. All I'm doing is casually describing the RFC, and yes, I may have stated something ambiguously or incorrectly. Help me out here. Are you saying the RFC describes a bad algorithm or that I've described it badly? > The TLS RFCs don't offer any opinion about how you should make trust decisions The TLS RFCs refer you to RFC 5280 for validation, which does explicitly specify the algorithm. > I'm sure you will continue to believe you were correct, and yet the exact steps you wrote down are going to blow up for people in just a few days I'm not seeing how my steps will blow up, although the phrase "eventually end in a valid cert that you trust a priori" could be interpreted differently than I meant it. "Eventually end in" here is referring to the validation algorithm ending, not the cert chain. Can you elaborate on how you think this algorithm fails? > As a programmer, I call that "wrong" but I'm quite sure you feel you weren't wrong at all, just misunderstood. Could I ask you to be a little less aggressive in this conversation? We aren't having a fight here. Edit: I think we're actually in violent agreement here. Your statement "But wait, after step 2 we reached ISRG Root X1, which we know is trustworthy. We were actually done!" is exactly my point. You don't need to ignore the expiration date on the old root if you have issued a new trusted authority below that root and the validation can stop there. You aren't ignoring the expiration on the old root, you're ignoring the entire old root cert because you found a new trusted cert that supercedes it. if you did still have an end entity cert that was issued via a path to the old root that did not include the newer, explicitly trusted cert lower down the chain, THAT end entity validation would fail.