Subject: [pkix] OID for certificates issued under IETF policy?

From: Jeffrey Walton <[email-masked]>
Date: Fri, 26 Sep 2014 16:57:28 -0400

Is there an OID for certificates issued under the IETF's policies and
guidelines? Or perhaps other distinguishing information present in the
certificate?

Related: I'm having trouble differentiating between certifcates issued
under CA/B policies, and IETF policies. That causes confusion when
selecting validation routines.

---

From: Stephen Kent <[email-masked]>
Date: Fri, 26 Sep 2014 17:30:18 -0400

Jeff,

The short answer is no.

PKIX RFCs define standards for certs, CRL, OCSP, etc. But we did not
define any policy OIDs that would be inserted to assert compliance.
In part this would not work because we do not even require that a cert
contain the Cert Policies extension :-).

> selecting validation routines.
It would have been better of CABF had, for example, defined one policy OID
for its baseline certs and another for EV.

It seems that one has to have a list of all OIDs that Web PKI CAs,
have asserted are for EV certs, and use that to determine when a
cert is supposed to be an EV cert, and thus subject to the additional
checks appropriate for it.

Steve

---

From: "Miller, Timothy J." <[email-masked]>
Date: Mon, 29 Sep 2014 12:17:11 +0000

>selecting validation routines.

Only issuers have policies.  The IETF has recommendations.  :)

You can't distinguish a cert issued under CA/B processes without evaluating the chain, so you have to process per the CA/B Forum EVSSL Recommendation (https://cabforum.org/wp-content/uploads/Recommendations-for-the-Processing-of-EV-SSL-Certificates.v.2.0.pdf).  Just to make your life fun, the Recommendation basically says that you have to maintain your own root store and list of policy OIDs because they're not going to do it for you.  Quoting:  

"""
6.2. Identifying an EV certificate
EV certificate is distinguishable from a non-EV certificate by the presence of a distinct
certificate policy identifier. Each CSP has one or more root certificates designated to issue
EV certificates, and has its own EV policy identifier to identify EV certificates issued in
accordance with [EVSSL]. Alternatively, the CSP may choose to use the CA/Browser
Forum's EV OID: 2.23.140.1.1. The policy identifier for a particular CSP should be
confirmed by reference to the CSP's Certificate Policy (CP) or Certification Practices
Statement (CPS). The Root Store Manager should store the distinct certificate policy
identifier associated with each root certificate, for example, as meta-data.
"""

Amusingly, the CA/B Forum *actually points to Wikipedia* for an *incomplete* list of EV policy OIDs.

-- T

---

From: Gervase Markham <[email-masked]>
Date: Mon, 29 Sep 2014 14:07:21 +0100

> *incomplete* list of EV policy OIDs.

This doesn't seem particularly surprising to me. A cert is EV because a)
an issuer issues it and claims to be following the EV guidelines, and b)
a particular client agrees that the issuer is so doing. So it makes no
sense to talk about "the list of EV CAs", it only makes sense to talk
about "NSS's list of EV CAs" or "Microsoft's list of EV CAs". And, of
course, when you look at such a list, it will consist (at the basic
level) of a bunch of root certs and associated EV policy OIDs. So then
you have your list of OIDs.

Gerv