Subject: RE: Certificate policy question

From: [email-masked] (Peter Gutmann)
Date: Fri, 13 Dec 2002 14:16:39 +1300

I wrote:

>Actually that probably provides the answer to the question: > 1 policy in an
>EE cert, where one policy isn't a subset/refinement/compatible version of the
>other [0], demonstrates that the issuer is sufficiently confused over policy
>issues that the cert should be regarded as following no policy at all :-).

Actually taking this a step further, what we really need is an idiotPolicy to
match anyPolicy:

  A CA that asserts two incompatible policies in EE certs, or has a CA cert
  with the basicConstraints CA flag set to FALSE, or keyUsage set to disallow
  the issuing of certificates, SHALL be assumed to be implicitly asserting the
  idiotPolicy.  Applications SHALL display certs from this CA as being issued
  under this policy.

Russ, could we get an OID for that? :-).

Peter.

---

From: Russ Housley <[email-masked]>
Date: Mon, 16 Dec 2002 14:35:40 -0500

Peter:

We only assign OIDs to things that are documented in RFCs (or documents
that are intended to be published as an RFC),  When you write the document
describing idiotPolicy, I'll assign the OID  ;-)

Russ