Subject: RE: End-Entity Certificate Policies

From: Michael Myers <[email-masked]>
Date: Tue, 31 Aug 1999 17:51:22 -0700

Russ,

I agree with your proposal for a single policy OID in an end-entity
certificate.  This is the only way I've seen it used.  Might I suggest
however a refinement of the proposed text.

An organization could operate under a single policy in accordance ". . .
these policy information terms indicate the single policy under which . . ."
but represent this single policy as ". . . a sequence of one or more . . .
terms" (that is, more than one OID) and yet defensibly conform to the
standard.

Text along the lines "SHALL include a single policy OID" would sharpen the
requirement and so prevent this interpretation.

I must disagree though regarding the exclusion of certificate policy
qualifiers in CA certs.  Consider the CPS pointer.  A CA cert and entity
cert whose signature validates using that CA cert may need to point to
different CPSs.  This situation may occur in cross certification / hub
certification / bridge certification contexts (choose a favorite term).

Mike

> -----Original Message-----
> From: Russ Housley [mailto:[email-masked]]
> Sent: Tuesday, August 31, 1999 1:57 PM
> To: [email-masked]
> Subject: End-Entity Certificate Policies
> 
> 
> Tim Polk and I got together today to discuss the changes 
> needed to address 
> the policy mapping bug (as discussed at the Oslo meeting).  
> As part of this 
> discussion, we discussed the certificate policy extension.
> 
> We believe that a CA certificate may contain one or more 
> certificate policy 
> OID.  On the other hand, we believe that an end-entity certificate 
> containing a certificate policy extension must  contain a single 
> certificate policy OID.  RFC 2459 says:
> 
>     The certificate policies extension contains a sequence of 
> one or more
>     policy information terms, each of which consists of an object
>     identifier (OID) and optional qualifiers.  These policy 
> information
>     terms indicate the policy under which the certificate has 
> been issued
>     and the purposes for which the certificate may be used.  Optional
>     qualifiers, which may be present, are not expected to change the
>     definition of the policy.
> 
> We would like to add words to make it more clear that an end-entity 
> certificate may only contain a single certificate policy OID.  The 
> explanation of this extension's purpose in a CA certificate 
> was not spelled 
> out, so we propose to fix that too.  Our proposed text is:
> 
>     The certificate policies extension contains a sequence of 
> one or more
>     policy information terms, each of which consists of an object
>     identifier (OID) and optional qualifiers.  In an 
> end-entity certificate,
>     these policy information terms indicate the single policy 
> under which
>     the certificate has been issued and the purposes for 
> which the certificate
>     may be used.  In a CA certificate,  these policy information terms
>     limit the set of policies for certification paths which 
> include this
>     certificate.  Optional qualifiers, which may be present, are not
>     expected to change the definition of the policy.
> 
> Does anyone disagree?
> 
> Tim and I also discussed certificate policy qualifiers.  Tim 
> and I agree 
> that certificate policy qualifiers should only appear in end-entity 
> certificates.  That is, we agree that certificate policy 
> qualifier should 
> never appear in a CA certificate.  Does anyone (besides Mike 
> Baum) disagree?
> 
> Russ
>