Subject: RE: On cross-certificates and pathLenConstraint

From: "Stefan Santesson" <[email-masked]>
Date: Thu, 9 Sep 2004 08:21:55 +0100

> -----Original Message-----
> From: Stephen Kent [mailto:[email-masked]]
> 
> I think it fair to say that if a product's default configuration
> passes the standards interoperability tests, it is compliant.
> 
> Steve

[Stefan] I have no problem with that.
Unfortunately however, which I pointed out to Santosh before, the NIST
PKI test suite doesn't provide any compliance test regarding root
extension processing since it doesn't make use of any root certificates
with constraints or policies.

---

From: "Santosh Chokhani" <[email-masked]>
Date: Thu, 9 Sep 2004 07:49:33 -0400

Stefan:

Are you saying that if we had constraints in a trust anchor MS CAPI can be
configured or invoked to ignore those?

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Stefan Santesson
Sent: Thursday, September 09, 2004 3:22 AM
To: Stephen Kent
Cc: Santosh Chokhani; [email-masked]
Subject: RE: On cross-certificates and pathLenConstraint

[Stefan] I have no problem with that.
Unfortunately however, which I pointed out to Santosh before, the NIST PKI
test suite doesn't provide any compliance test regarding root extension
processing since it doesn't make use of any root certificates with
constraints or policies.