Subject: Re: [pkix] OID for certificates issued under IETF policy?

From: Peter Gutmann <[email-masked]>
Date: Fri, 26 Sep 2014 23:58:49 +0000

Stephen Kent <[email-masked]> writes:

>It seems that one has to have a list of all OIDs that Web PKI CAs, have
>asserted are for EV certs, and use that to determine when a cert is supposed
>to be an EV cert, and thus subject to the additional checks appropriate for
>it.

If you look at the Chrome source code they have a module they compile in that
hardcodes in the necessary OIDs, you can grab the data from that and use it.
This whole process does however rely on the fact that you're Google and can
push out updates to your apps whenever you feel like it, i.e. whenever a new
OID appears.

Peter.

---

From: Stephen Kent <[email-masked]>
Date: Mon, 29 Sep 2014 15:00:55 -0400

Peter,

> Of course this relies on the fact that you're Google and can push out updates
> to your apps whenever you feel like it.
>
> Peter.
>
Thanks for the pointer. It matches what Rick said on the TRANS list,
and he provided a URL.

Steve