Subject: Re: [pkix] Ambiguity in 5280 Regarding EKU Processing During Certification Path Processing

From: Jean-Marc Desperrier <[email-masked]>
Date: Mon, 02 Nov 2009 16:33:18 +0100

Nelson B Bolyard wrote:
> [...]
> The RFC 5280 model seems to be that all root and intermediate CAs are
> trusted to issue certs for all purposes, and constraints on usages are
> only placed on EE certs.  [...]
> I've been told that Certificate Policies extensions were supposed to
> address these needs, but it appears to me that they haven't.[...]

Let's me add my two cents here :

- the theory is that the EKU extension in a CA applies to the 
certificate that contains it and doesn't constrain the certificate path
- the practice is that the EKU extension in a CA doesn't apply to the 
certificate that contains it and instead represents a constraint for the 
certificate path built using it

- the theory is that the Certificate Policies extension in a CA doesn't 
apply to the certificate that contains it and instead represent a 
constraint for the certificate path built using it
- the practice is that the Certificate Policies in a CA describes the 
certificate policy that applies to it and doesn't constrain the 
certificate path

OK, the introduction of EV certificates quite modified the last point.

No there two mode depending on context : Either RFC compliant for EV 
certs, or compatible with the existing usage described above.

> For one
> thing, there's certainly no standardized set of certificate policy OIDs
> for policies constraining application usages.