Subject: RE: Question about certificate policy handling

From: "Andrews, Rick" <[email-masked]>
Date: Fri, 8 Dec 2006 12:17:46 -0800

Mike,

For www.verisign.com, the root is a v1 cert with no extensions at all;
that's why it doesn't have a policy value. I would imagine (thought I'm
no expert in PKIX) that that should be interpreted as anyPolicy. That's
how we've always interpreted it.

-Rick

-- 
Rick Andrews                 __o    Phone: 650-426-3401
VeriSign, Inc.             _ \>,_   Fax:   650-426-5195
487 E. Middlefield Rd. ...(_)/ (_)  URL:   www.verisign.com
Mountain View, CA  94043            email: [email-masked] 

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Mike
> Sent: Friday, December 08, 2006 8:40 AM
> To: [email-masked]
> Subject: Question about certificate policy handling
> 
> 
> Hello,
> 
> I am having trouble understanding what I'm supposed to do 
> with certificate policies in path validation.
> When you connect to https://www.verisign.com, for example, it 
> returns three certificates in the TLS
> handshake:
> 
>      root  policies = { }
>        |
>        v
>       CA   policies = 2.16.840.1.113733.1.7.1.1
>        |
>        v
>       EE   policies = 2.16.840.1.113733.1.7.23.3
> 
> It seems to me from reading the PKIX specs, that this should 
> fail path validation since the policy in the end entity 
> certificate is not listed in the CA certificate.  Or maybe 
> since the policy extension is not labeled as critical, it is ok?
> 
> In another example, https://www.microsoft.com returns the 
> following certificates:
> 
>       CA  policies = { 1.2.840.113763.1.2.1.5, any }
>        |
>        v
>       CA  policies = 1.3.6.1.4.1.311.42.1.1
>        |
>        v
>       EE  policies = { }
> 
> The policy of the second CA is Ok since the first contains 
> anyPolicy, but what does it mean when the end entity 
> certificate doesn't have a policy?  Should the path be rejected?
> 
> Thanks for any help in understanding this.
> 
> Mike
> 
> 
>

---

From: Mike <[email-masked]>
Date: Fri, 08 Dec 2006 12:25:25 -0800

Thanks for the reply, but I wasn't concerned about the root certificate.
The question I have is that the end entity certificate has a policy
which is not listed in the intermediate CA certificate (and the inter-
mediate certificate does not specify anyPolicy).

Mike