Subject: SkipCerts Question [RFC3280]

From: [email-masked]
Date: Mon, 17 Feb 2003 19:45:48 +0900

Dear all,

We are now testing our certificate path validation
program in Japan.
And I have a question on the "SkipCerts" in the RFC3280.

Would you please tell me?

-----
According to the RFC3280, 

4.2.1.12  Policy Constraints

<snip>

If the requireExplicitPolicy field is present, the value of
requireExplicitPolicy indicates the number of additional certificates
that may appear in the path before an explicit policy is required for
the entire path.
-----

If there is a certificate path like the following,
  cert0
  cert1
  cert2

and if the cert1 has the requireExplicitPolicy=1,

is the cert2 required to have an explicit policy or not ?

(Is the value applied to the cert1
 which has the requireExplicitPolicy=1?)

I don't think the cert2 is required to have it, 
but I'm not sure.

Regards,
 Kozo
--------------------------------------------------------
Kozo FUJINO (TEL: +81-82-264-8544  FAX: +81-82-264-8549)
NEC System Technologies, Ltd.
Hiroshima, Japan

---

From: Russ Housley <[email-masked]>
Date: Thu, 20 Feb 2003 18:42:06 -0500

Kozo:

You understand correctly --  cert2 is not required to have an explicit policy.

Russ