Subject: Re: Another certificate policy question

From: [email-masked] (Peter Gutmann)
Date: Mon, 20 Jan 2003 14:59:31 +1300

"Joel S. Kazin" <[email-masked]> writes:

>There is a slight discrepancy between the text of RFC 3280 and the ASN.1
>notation for the type.
>
>  "This specification defines two policy qualifier types for use by
>    certificate policy writers and certificate issuers.  The qualifier
>    types are the CPS Pointer and User Notice qualifiers.
>
>    The CPS Pointer qualifier contains a pointer to a Certification
>    Practice Statement (CPS) published by the CA.  The pointer is in the
>    form of a URI.  Processing requirements for this qualifier are a
>    local matter.  No action is mandated by this specification regardless
>    of the criticality value asserted for the extension." (RFC 3280)
>
>The RFC clearly is talking about a single CPS pointer.

Hmm, I'm not so sure.  It says there's a single CPS pointer in the CPSuri, but
since the qualifiers are a SEQUENCE OF you could in theory have hundreds of
them.

[Insert standard gripe pointing out that if PKIX RFCs used currently valid
 ASN.1, this wouldn't be a problem since you could specify a uniqueness
 constraint in the ASN.1 to make it clear]

>In any event such a certificate is an error. 

I think opinion is divided on this matter.

Peter.