Subject: specific policies used in conjunction with anyPolicy

From: "Carlin Covey" <[email-masked]>
Date: Wed, 21 Mar 2001 13:11:10 -0600

Russ or Tim (or anyone else with an opinion),

The certificate policies extension allows a sequence of policy OIDs.
One such policy OID is anyPolicy.  I assume that it is permissible in a
CA cert to include specific policy OIDs in addition to the anyPolicy OID.
The reason I would want to do this is to support applications that insist
on finding a specific policy OID, and also support more liberal applications
that will tolerate the anyPolicy OID.

draft-ietf-pkix-new-part1-05 does not appear to prohibit using specific
policy OIDs and the anyPolicy OID in the same CA cert.  Is this true?

- Carlin Covey
  Cylink Corporation

---

From: "David A. Cooper" <[email-masked]>
Date: Wed, 21 Mar 2001 15:32:05 -0500

Yes, you may assert both anyPolicy and specific certificate policies in the same certificate. This may not be specifically stated, but path processing algorithm (section 6.1.3) does take this possibility into account.

The reason that this is allowed is exactly the one you stated. Originally there was a rule that if anyPolicy were included in the certificatePolicies extension, then no other policy could be included. This rule was removed when the inhibitAnyPolicy extension was developed. In the case you mention, the "strict" applications would set initial-any-policy-inhibit in order to ensure that the path would only be considered valid under policies that had been explicitly listed in each certificate. The more liberal applications would not set initial-any-policy-inhibit and would then (possibly) consider the path to be valid under more policies.