Subject: Cert chain validation

From: "Meggison, Tim" <[email-masked]>
Date: Mon, 21 Feb 2000 17:36:34 -0500

Suppose I have a certificate chain consisting of a Root, a CA and a User
certificate.

The policy extension in the Root certificate contains one oid of 1.2.4.
The policy extension in the CA certificate contains one oid of 1.2.4.
The policy extension in the User certificate contains one oid of 1.2.4.1.

Assuming all other data is valid, is this a valid certificate chain?

It appears to me that the algorithm defined in draft-ietf-pkix-new-part1-00
would determine that this certificate path is invalid.  And the way to
correct it would be to add a policy mapping to the CA certificate for the
oid 1.2.4.1.  

Is the policy mapping necessary  in a closed-community, if the Relying Party
trusts all certs issued with a policy oid of 1.2.4 and all certs issued with
a policy oid of 1.2.4.1?

---

From: Russ Housley <[email-masked]>
Date: Tue, 22 Feb 2000 10:19:25 -0500

Tim:

OIDs are not intended to have any semantics derived from their structure. 
The only appropriate operation is exact-match.  Given this, the chain you 
provide should be considered invalid.

Russ

---

From: "Meggison, Tim" <[email-masked]>
Date: Tue, 22 Feb 2000 11:06:14 -0500

If the policy extensions in all the certs are marked non-critical, is it
valid for a Relying Party to ignore the policy extensions during path
validation, but still display any associated User Notices?

-----Original Message-----
From: Russ Housley [mailto:[email-masked]]
Sent: Tuesday, February 22, 2000 10:19 AM
To: Meggison, Tim
Cc: [email-masked]'
Subject: Re: Cert chain validation

Tim:

Russ