Subject: Question about certificate policy handling

From: Mike <[email-masked]>
Date: Fri, 08 Dec 2006 08:39:46 -0800

Hello,

I am having trouble understanding what I'm supposed
to do with certificate policies in path validation.
When you connect to https://www.verisign.com, for
example, it returns three certificates in the TLS
handshake:

     root  policies = { }
       |
       v
      CA   policies = 2.16.840.1.113733.1.7.1.1
       |
       v
      EE   policies = 2.16.840.1.113733.1.7.23.3

It seems to me from reading the PKIX specs, that this
should fail path validation since the policy in the
end entity certificate is not listed in the CA
certificate.  Or maybe since the policy extension is
not labeled as critical, it is ok?

In another example, https://www.microsoft.com returns
the following certificates:

      CA  policies = { 1.2.840.113763.1.2.1.5, any }
       |
       v
      CA  policies = 1.3.6.1.4.1.311.42.1.1
       |
       v
      EE  policies = { }

The policy of the second CA is Ok since the first
contains anyPolicy, but what does it mean when the end
entity certificate doesn't have a policy?  Should the
path be rejected?

Thanks for any help in understanding this.

Mike

---

From: "Santosh Chokhani" <[email-masked]>
Date: Fri, 8 Dec 2006 13:52:24 -0800

Mike and Rick,

Certificate policies extension in Root is not processed when doing
certification path validation.

The answer to Mike's question is that the path should fail if due to
initial conditions or from certificate require explicit policy gets set.

Most likely, that is not getting set and hence path is acceptable, but
for no policies.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Andrews, Rick
Sent: Friday, December 08, 2006 3:18 PM
To: Mike; [email-masked]
Subject: RE: Question about certificate policy handling

Mike,

For www.verisign.com, the root is a v1 cert with no extensions at all;
that's why it doesn't have a policy value. I would imagine (thought I'm
no expert in PKIX) that that should be interpreted as anyPolicy. That's
how we've always interpreted it.

-Rick

-- 
Rick Andrews                 __o    Phone: 650-426-3401
VeriSign, Inc.             _ \>,_   Fax:   650-426-5195
487 E. Middlefield Rd. ...(_)/ (_)  URL:   www.verisign.com
Mountain View, CA  94043            email: [email-masked] 

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Mike
> Sent: Friday, December 08, 2006 8:40 AM
> To: [email-masked]
> Subject: Question about certificate policy handling
> 
> 
> Hello,
> 
> I am having trouble understanding what I'm supposed to do 
> with certificate policies in path validation.
> When you connect to https://www.verisign.com, for example, it 
> returns three certificates in the TLS
> handshake:
> 
>      root  policies = { }
>        |
>        v
> It seems to me from reading the PKIX specs, that this should 
> fail path validation since the policy in the end entity 
> certificate is not listed in the CA certificate.  Or maybe 
> since the policy extension is not labeled as critical, it is ok?
> 
> In another example, https://www.microsoft.com returns the 
> following certificates:
> 
> The policy of the second CA is Ok since the first contains 
> anyPolicy, but what does it mean when the end entity 
> certificate doesn't have a policy?  Should the path be rejected?
>