Subject: Re: End-Entity Certificate Policies

From: "Andrew Probert" <[email-masked]>
Date: Wed, 13 Oct 1999 21:02:31 +1000

CAs would never use the *same* policy OID as they surely they would be
issuing policies prefixed by their own unique company's / CAs OID!

That's why cross-certification and policy-mapping was invented.

I think the process breaks down if you take the shared policy OID approach.

Regards.

----- Original Message -----
From: Russ Housley <[email-masked]>
To: <[email-masked]>
Sent: Friday, September 10, 1999 4:00 AM
Subject: RE: End-Entity Certificate Policies

> I want to send a quick message to summarize the impact that this thread
has
> had on my thinking.  This thoughts have not been coordinated with the
other
> RFC 2459 authors.
>
> First, I have been convinced that there are times when it is appropriate
to
> include more than one certificate policy OID in an end
> entity-certificate.  However, it is clear to me that some policies should
> not be combined in one certificate.  I guess that there are many errors
> that a CA could make, and that this is just one more.  Can anyone suggest
a
> subjective rule for the types of policies that might appear in one
> end-entity certificate?  If not, how about a subjective rule for the types
> of policies that should not appear in one end-entity certificate?
>
> Second, I remain concerned about the use of qualifier with certificate
> policies in CA certificates.
>
> The certificate policy qualifiers do not impact the certificate path
> validation algorithm.  Rather, the certificate policy qualifiers are
> provided as an output of the algorithm to the certificate user (a.k.a.
> relying party) to help determine whether or not the end-entity certificate
> is appropriate for the task at hand.
>
> While the X.509 path validation algorithm does not prohibit an
> implementation from returning information that tells which certificate
> provided particular qualifiers, the algorithm does not require that this
> information be provided.  Therefore, we must assume that this information
> is not available to the certificate user.
>
> I still think that it is important that the set of certificate policy
> qualifiers not include contradictions.
>
> I belive that it is possible that two CAs can support the same certificate
> policy using different CPSs.  Thus, certificates issued by the two CAs
> would have the same certificate policy OID, but they would include
> different values for the CPS pointer qualifier.  If a path includes
> certificates from both of these CAs, the output of the certificate path
> validation algorithm would include the common certificate policy OID and
> two different CPS pointer qualifiers.
>
> Since the certificate validation algorithm does not use certificate policy
> qualifiers, how do certificate policy qualifiers in CA certificates help
> the certificate user?
>
> Russ
>

---

From: Paul Koning <[email-masked]>
Date: Wed, 13 Oct 1999 10:04:52 -0400

>>>>> "Andrew" == Andrew Probert <[email-masked]> writes:

 Andrew> CAs would never use the *same* policy OID as they surely they
 Andrew> would be issuing policies prefixed by their own unique
 Andrew> company's / CAs OID!

Not necessarily.  What if a CA adopted the Standard Terms and
Conditions created by the European Professional Association of CAs?
There are plenty of examples like that in current business practice. 

	paul