The terms user agent, client, server, origin server, FQHN, FQDN, request host, request-URI and proxy are used as in RFC 2109 on State Management. The terms domain-match, verified transaction and unverified transaction are defined in RFC2109, and those definitions are also used here. This specification should follow the definitions in those documents. The following is a summary version of the x.509 definition. It includes all the fields we use here.
Validity is a date range.
Issuer is the name of the certificate authority. We will use different issuer names to convey different levels of certification. The subject name should contain the domain name to which the certification applies. Note that list of certificates applies to all cookies in the Set-Cookie2 header of the response . There is no need for separate certificates per cookie, since all cookies in the response come from the same server, and certificates belong to the server not the cookie.