Subject: End-Entity Certificate Policies

From: Russ Housley <[email-masked]>
Date: Tue, 31 Aug 1999 16:56:31 -0400

Tim Polk and I got together today to discuss the changes needed to address 
the policy mapping bug (as discussed at the Oslo meeting).  As part of this 
discussion, we discussed the certificate policy extension.

We believe that a CA certificate may contain one or more certificate policy 
OID.  On the other hand, we believe that an end-entity certificate 
containing a certificate policy extension must  contain a single 
certificate policy OID.  RFC 2459 says:

    The certificate policies extension contains a sequence of one or more
    policy information terms, each of which consists of an object
    identifier (OID) and optional qualifiers.  These policy information
    terms indicate the policy under which the certificate has been issued
    and the purposes for which the certificate may be used.  Optional
    qualifiers, which may be present, are not expected to change the
    definition of the policy.

We would like to add words to make it more clear that an end-entity 
certificate may only contain a single certificate policy OID.  The 
explanation of this extension's purpose in a CA certificate was not spelled 
out, so we propose to fix that too.  Our proposed text is:

    The certificate policies extension contains a sequence of one or more
    policy information terms, each of which consists of an object
    identifier (OID) and optional qualifiers.  In an end-entity certificate,
    these policy information terms indicate the single policy under which
    the certificate has been issued and the purposes for which the certificate
    may be used.  In a CA certificate,  these policy information terms
    limit the set of policies for certification paths which include this
    certificate.  Optional qualifiers, which may be present, are not
    expected to change the definition of the policy.

Does anyone disagree?

Tim and I also discussed certificate policy qualifiers.  Tim and I agree 
that certificate policy qualifiers should only appear in end-entity 
certificates.  That is, we agree that certificate policy qualifier should 
never appear in a CA certificate.  Does anyone (besides Mike Baum) disagree?

Russ

---

From: "Peter Williams" <[email-masked]>
Date: Tue, 31 Aug 1999 18:05:19 -0700

I vote no on both propositions, I suggest
alternative bug fixes be found.

Breaking today's infrastructure to fix
a problem in a theoretical part of X.509 which
has never been deployed to Internet
users is just not fair on the CA
community, their now millions
of users, and hundred thousand odd
commercial customers.

> -----Original Message-----
> From: Russ Housley [mailto:[email-masked]]
> Sent: Tuesday, August 31, 1999 1:57 PM
> To: [email-masked]
> Subject: End-Entity Certificate Policies
>
>