Subject: Re: certificate chain validation(policy extension)

From: Kong QiuYan <[email-masked]>
Date: Mon, 03 Jul 2000 14:32:05 +0900

Thank you very much for the reply.

 I agree with you.  It depends on the policy constraints extension.

 However, I think that the process of (e)(f)  is to keep the certificate policy's
consistency in certificate chain. If the SkipCerts is greater than zero, and the policy
extension is null, how can we  explain it(in this case the Cert chain will be valid)? 

 Thanks in advance.  

KwonSung Chung wrote:
> 
> I think it is depend on policy constraints extension.
> 
> If requireExplicitPolicy sub-field of the Root certificate
> has 0 as value of SkipCerts, the certificate chain is invalid because
> the policy checking about CA certificate  must be processed.
> 
> But, in the case of positive integer(greater then  zero), the certificate chain is
> valid ( if other extension is valid).
> 
> ------------------
> KwonSung Chung
> KISA
> [email-masked]
> ------------------
> 
> Kong QiuYan wrote:
> 
> > Suppose I have a certificate chain consisting of a Root, a CA and a User
> > certificate.
> >
> > The policy extension in the Root certificate contains one oid of 1.1.1(critical)
> > The policy extension in the CA certificate does not exist.
> > The policy extension in the User certificate contains one oid of 1.1.1(critical)
> >
> > Assuming all other data is valid, is this a valid certificate chain?
> >
> > It appears to me that the algorithm defined in RFC2459 would determine that
> > this certificate path is valid.
> >
> > -----------
> > RFC2459 6.1 says:
> >
> >       (e)  Verify that policy information is consistent with the
> >       acceptable policy set:
> >
> >          (1) if the certificate policies extension is marked critical,
> >          the intersection of the policies extension and the acceptable
> >          policy set shall be non-null;
> >
> >          (2) the acceptable policy set is assigned the resulting
> >          intersection as its new value.
> >
> >       (g) Verify that the intersection of the acceptable policy set and
> >       the initial policy set is non-null.
> > ---------
> >
> > Personally, I think that all of the certificates in a valid path must have
> > policy extension(critical or non-critical). Am I wrong?
> >
> > QiuYan Kong,
> > Fujitsu Ltd

-- 
-------------------------------------------------
Kong QiuYan
FUJITSU LIMITED
EMail: [email-masked]
  TEL: +81-45-473-3707