Subject: certificate chain validation(policy extension)

From: Kong QiuYan <[email-masked]>
Date: Fri, 30 Jun 2000 17:06:30 +0900

Suppose I have a certificate chain consisting of a Root, a CA and a User
certificate.

The policy extension in the Root certificate contains one oid of 1.1.1(critical)
The policy extension in the CA certificate does not exist.
The policy extension in the User certificate contains one oid of 1.1.1(critical)

Assuming all other data is valid, is this a valid certificate chain?

It appears to me that the algorithm defined in RFC2459 would determine that
this certificate path is valid.  

-----------
RFC2459 6.1 says:
 
      (e)  Verify that policy information is consistent with the
      acceptable policy set:

         (1) if the certificate policies extension is marked critical,
         the intersection of the policies extension and the acceptable
         policy set shall be non-null;

         (2) the acceptable policy set is assigned the resulting
         intersection as its new value.

      (g) Verify that the intersection of the acceptable policy set and
      the initial policy set is non-null.
---------

Personally, I think that all of the certificates in a valid path must have
policy extension(critical or non-critical). Am I wrong? 

QiuYan Kong,
Fujitsu Ltd