KSKB, the KERISuite Knowledge Base · Papers and paper collections

Why X509 Certs Should Be Secondary Evidence of Org Identity

Practitioner informative

Maintainer: Daniel Hardman · checked 2026-10-14

A position paper by Daniel Hardman arguing that X.509 certificates should be secondary, not primary, evidence of an organization's identity, with ACDCs (Authentic Chained Data Containers) such as vLEIs carrying the primary weight. It works through mismatched lifespans, opaque governance, the post-quantum path, single-key signing, missing pre-rotation, unsequenced signatures, maintenance, revocation and scale. For practitioners choosing evidence for organizational identity.

Open the original

The abstract and the labels are KSKB's own text under Creative Commons Attribution 4.0 (CC BY 4.0); the source keeps its own license. Record: in the database · as Markdown · in the app.