Subject: Certificate Policies in Root CA certificates

From: Tomas Gustavsson <[email-masked]>
Date: Tue, 03 Oct 2006 14:18:25 +0200

Hi,
I'm an old aquantance, but a new comer to the list this time around.
I don't know if this has been up recently, but I couldn't find anything 
in the archives at least.

I am studying the enhanced wording in RFC3280 and the cert validation 
protocol regarding the Certificate Policy extension.
I come to the conclusion that a RootCA certificate better have anyPolicy 
or no extension at all. This because you usually don't want to limit the 
possible policies that sub CAs can use to issue certificates to end 
users. You can always find good use for another sub CA, right.

Basically I want to know what the consensus is among the list, should a 
root CA have anyPolicy in the Certificate Policy extension, or no 
extension at all?

 From the validation protocol both (or none) would work find depending 
on the input parameters given from the validating application.

Regards,
Tomas Gustavsson
http://www.ejbca.org/