Subject: certificate policies extension in RFC2459 and son of RFC2459

From: TAKIGUCHI Naruhito <[email-masked]>
Date: Tue, 06 Jun 2000 18:20:42 +0900

Hi, all.

It seems to me that there is an inconsistency between RFC2459 and 
son of RFC2459 about verifying the certificate policies extension.

In RFC2459, if the certificate policies extension is marked as 
non-critical, it is not processed. 
But in son of RFC2459, the certificate policies extension is 
processed regardless of its critical flag.

For example, consider there is a certificate path such below, 
and the acceptable policy set is (A). In RFC2459, this path's validation
processing will succeed. But in son of RFC2459, this path's validation
processing will be failed.

    +------------------------+
    | root CA cert           |
    |                        |
    | critical policy(A)     |
    +------------------------+
                |
    +------------------------+
    | end entity cert        |
    |                        |
    | non-critical policy(B) |
    +------------------------+

And, son of RFC2459 requires that certificate must have a certificate
policies extension?

Thus, son of RFC2459 doesn't have compatibility with a certificate
which was issued based on RFC2459?
Do I misunderstand?

Could anyone advice me?

Thanks in advance.

-----
Naruhito TAKIGUCHI
FUJITSU HOKURIKU SYSTEMS LTD.