Certificate Hierarchy

After consultation, collaboration, and discussion with industry experts, we have decided to alter the default Certificate Hierarchy (PKI) utilized by Corda and the Corda Network. To facilitate this, the nodes have had their certificate path verification logic made much more flexible. All existing certificate hierarchy, certificates, and networks will remain valid. The possibility now exists for nodes to recognize a deeper certificate chain and thus Compatibility Zone operators can deploy and adhere to the PKI standards they expect and are comfortable with.

Practically speaking, the old code assumed a 3-level hierarchy of Root -> Intermediate CA (Doorman) -> Node, and this was hard coded. From 3.3 onward an arbitrary depth of certificate chain is supported. For the Corda Network, this means the introduction of an intermediate layer between the root and the signing certificates (Network Map and Doorman). This has the effect of allowing the root certificate to always be kept offline and never retrieved or used. Those new intermediate certificates can be used to generate, if ever needed, new signing certs without risking compromise of the root key.

Special Thanks

The Corda community is a vibrant and exciting ecosystem that spreads far outside the virtual walls of the R3 organisation. Without that community, and the most welcome contributions of its members, the Corda project would be a much poorer place.

We're therefore happy to extend thanks to the following members of that community for their contributions

• Dan Newton for a fix to cleanup node registration in the test framework. The changes can be found here.
• Tushar Singh Bora for a number of documentation tweaks. In addition, some updates to the tutorial documentation here.
• Jiachuan Li for a number of corrections to our documentation. Those contributions can be found here and here.
• Yogesh for a documentation tweak that can be see here.
• Roman Plášil for speeding up node shutdown when connecting to an http network map. This fix can be found here.
• renlulu for a small PR to optimize some of the imports.
• cxyzhang0 for making the IdentitySyncFlow more useful. See here.
• Venelin Stoykov with updates to the documentation around the progress tracker.
• Mohamed Amine Legheraba for updates to the Azure documentation that can be seen here.
• Stanly Johnson with a fix to the network bootstrapper.
• Tittu Varghese for adding a favicon to the docsite. This commit can be found here