Subject: Re: [pkix] OID Processing between Intermediate CA and End Entity Certificates

From: "Ben Wilson" <[email-masked]>
Date: Fri, 8 Mar 2013 10:36:34 -0700

I've received a couple of clarifications off-list,  but just to clarify -
policy OIDs at the CA level are constraints on what policies an end entity
certificate may include/assert.  

So if you are creating a subCA, and you are going to use it to issue
certificates under multiple end entity policies, it's better to omit the CP
OID altogether.  Alternatives include specifying all policies (which you may
not know beforehand) or the allpolicies OID.

"In other words, contrary of what some people believe there are no policies
for CAs, there are only policy OIDs for EE certificates."  

 So, the OID arc structure will not work as I thought it might -  like a
filter reading left to right.

Thanks,

Ben

---

From: Santosh Chokhani <[email-masked]>
Date: Fri, 8 Mar 2013 12:46:02 -0500

Omitting policy OID may not work.  The chain may be invalid and is at the best not good for any policies.

From: [email-masked] [mailto:[email-masked]] On Behalf Of Ben Wilson
Sent: Friday, March 08, 2013 12:37 PM
To: 'pkix'
Subject: Re: [pkix] OID Processing between Intermediate CA and End Entity Certificates

I've received a couple of clarifications off-list,  but just to clarify - policy OIDs at the CA level are constraints on what policies an end entity certificate may include/assert.
So if you are creating a subCA, and you are going to use it to issue certificates under multiple end entity policies, it's better to omit the CP OID altogether.  Alternatives include specifying all policies (which you may not know beforehand) or the allpolicies OID.
"In other words, contrary of what some people believe there are no policies for CAs, there are only policy OIDs for EE certificates."
 So, the OID arc structure will not work as I thought it might -  like a filter reading left to right.
Thanks,
Ben

---

From: "Ben Wilson" <[email-masked]>
Date: Fri, 8 Mar 2013 10:49:54 -0700

Thanks, Santosh.  So, is best practice to put in the 2.5.29.32.0 -
"anyPolicy" OID? 

From: Santosh Chokhani [mailto:[email-masked]] 
Sent: Friday, March 08, 2013 10:46 AM
To: [email-masked]; 'pkix'
Subject: RE: [pkix] OID Processing between Intermediate CA and End Entity
Certificates

Omitting policy OID may not work.  The chain may be invalid and is at the
best not good for any policies.

From: [email-masked] [mailto:[email-masked]] On Behalf Of Ben
Wilson
Sent: Friday, March 08, 2013 12:37 PM
To: 'pkix'
Subject: Re: [pkix] OID Processing between Intermediate CA and End Entity
Certificates

Thanks,

Ben

---

From: Santosh Chokhani <[email-masked]>
Date: Fri, 8 Mar 2013 12:52:17 -0500

Yes, except some products such as Windows XP and other toolkits may  treat "anyPolicy" as a simple OID and not a wild card.

I generally recommend customers to spell out the OIDs.

From: Ben Wilson [mailto:[email-masked]]
Sent: Friday, March 08, 2013 12:50 PM
To: Santosh Chokhani; 'pkix'
Subject: RE: [pkix] OID Processing between Intermediate CA and End Entity Certificates

Thanks, Santosh.  So, is best practice to put in the 2.5.29.32.0 - "anyPolicy" OID?

From: Santosh Chokhani [mailto:[email-masked]]
Sent: Friday, March 08, 2013 10:46 AM
To: [email-masked]<mailto:[email-masked]>; 'pkix'
Subject: RE: [pkix] OID Processing between Intermediate CA and End Entity Certificates

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of Ben Wilson
Sent: Friday, March 08, 2013 12:37 PM
To: 'pkix'
Subject: Re: [pkix] OID Processing between Intermediate CA and End Entity Certificates

---

From: Carl Wallace <[email-masked]>
Date: Fri, 08 Mar 2013 12:52:58 -0500

Sounds like you may be looking for EKU-type semantics, at least before those
were altered to be like the certificate policy semantics that won't work for
you.  

From:  Ben Wilson <[email-masked]>
Organization:  DigiCert
Reply-To:  <[email-masked]>
Date:  Friday, March 8, 2013 12:49 PM
To:  Santosh Chokhani <[email-masked]>, 'pkix' <[email-masked]>
Subject:  Re: [pkix] OID Processing between Intermediate CA and End Entity
Certificates

> Thanks, Santosh.  So, is best practice to put in the 2.5.29.32.0 - "anyPolicy²
> OID? 
>  
> 
> I¹ve received a couple of clarifications off-list,  but just to clarify 
> certificates under multiple end entity policies, it¹s better to omit the CP
> ³In other words, contrary of what some people believe there are no policies
> for CAs, there are only policy OIDs for EE certificates.²
> _______________________________________________ pkix mailing list
> [email-masked] https://www.ietf.org/mailman/listinfo/pkix

---

From: "Piyush Jain" <[email-masked]>
Date: Fri, 8 Mar 2013 10:36:05 -0800

That may be the reason why some CA certificates have explicit policy OIDs as
well as "anyPolicy" OID in the CP extension.

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Santosh Chokhani
Sent: Friday, March 08, 2013 9:52 AM
To: [email-masked]; 'pkix'
Subject: Re: [pkix] OID Processing between Intermediate CA and End Entity
Certificates

Yes, except some products such as Windows XP and other toolkits may  treat
"anyPolicy" as a simple OID and not a wild card.

Thanks,

Ben