Subject: [pkix] Guidance for assigning CertPolicyID values

From: <[email-masked]>
Date: Tue, 11 Oct 2011 09:55:09 -0400

Hi,

Looking through the various RFCs I can't seem to find any solid guidance on
what OID values to use for CertPolicyID (within the Certificate Policies
extension) when I'm setting up a private enterprise PKI. Are there any
conventions that are generally used for assigning such values? 

Thanks,

Walter Goulet

Senior Practice Consultant

RSA, The Security Division of EMC

M: (224) 277-6821

---

From: "Miller, Timothy J." <[email-masked]>
Date: Tue, 11 Oct 2011 14:12:32 +0000

If your organization already owns an OID arc, get a branch allocated and
go to town.

If you don't have an OID arc of your own, establish one.   You can go to
the ISO for this, or any of a number of sub-organizations (e.g., ANSI or
IANA).

-- T

On 10/11/11 8:55 AM, "[email-masked]" <[email-masked]> wrote:

>Hi,
> 
>Looking through the various RFCs I can¹t seem to find any solid guidance
>on what OID values to use for CertPolicyID (within the Certificate
>Policies extension) when I¹m setting up a private enterprise PKI. Are
>there any conventions that are generally used for assigning such values?
> 
>Thanks,
>Walter Goulet
>_______________________________________________
>pkix mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/pkix

---

From: "David A. Cooper" <[email-masked]>
Date: Tue, 11 Oct 2011 15:04:04 -0400

There really aren't any generic certificate policies that have been 
defined, so there couldn't be any generic guidance about what OID values 
to use.

For a private enterprise PKI, if you have developed a certificate 
policy, then you can assign it an OID from an OID arc that your 
organization owns, as suggested below.  Otherwise, I would suggest 
simply not including a certificatePolicies extension in the 
certificates.  If all of the certificates in the private enterprise PKI 
will be issued under the same policy, and this PKI will not become part 
of a larger PKI through cross-certification, then there may not be a 
need to include certificate policy information in the certificates.

On 10/11/2011 10:12 AM, Miller, Timothy J. wrote:
> On 10/11/11 8:55 AM, "[email-masked]"<[email-masked]>  wrote:
>> Hi,
>>

---

From: <[email-masked]>
Date: Tue, 11 Oct 2011 15:07:34 -0400

Ok, thanks for the guidance. I'll go with allocating an OID arc that the
organization already owns.

Walter

> -----Original Message-----
> From: David A. Cooper [mailto:[email-masked]]
> Sent: Tuesday, October 11, 2011 2:04 PM
> To: Goulet, Walter
> Cc: [email-masked]
> Subject: Re: [pkix] Guidance for assigning CertPolicyID values
> 
defined, so
> there couldn't be any generic guidance about what OID values to use.
> 
> For a private enterprise PKI, if you have developed a certificate policy,
then
> you can assign it an OID from an OID arc that your organization owns, as
> suggested below.  Otherwise, I would suggest simply not including a
> certificatePolicies extension in the certificates.  If all of the
certificates in the
> private enterprise PKI will be issued under the same policy, and this PKI
will
> not become part of a larger PKI through cross-certification, then there
may
> not be a need to include certificate policy information in the
certificates.
> > If your organization already owns an OID arc, get a branch allocated
> > and go to town.
> >
> > the ISO for this, or any of a number of sub-organizations (e.g., ANSI
> > or IANA).
> >
> > -- T
> >
> >> Looking through the various RFCs I can¹t seem to find any solid
> >> guidance on what OID values to use for CertPolicyID (within the
> >> Certificate Policies extension) when I¹m setting up a private
> >> enterprise PKI. Are there any conventions that are generally used for
> assigning such values?
> >>
> >> Thanks,
> >> Walter Goulet

---

From: Michael StJohns <[email-masked]>
Date: Tue, 11 Oct 2011 15:18:26 -0400

As someone who has screwed this up at least twice, I recommend creating a second level of groupings under your top-level OID - e.g. extension ids, policy ids, etc and then stick your policies under the policy branch rather than directly under your top-level OID.

If the question you're asking is which of the existing policy IDs you should use for an enterprise system - that's a different question than the one Tim answered.  If the scope of your private PKI is internal, and you don't have any need to differentiate between various policy domains, then don't use any.   As far as I know there is no "Private Enterprise PKI" general policy that's been defined.

Mike