Subject: RE: No policy OID. Was: Policy User Interfaces (was RE: Setting X.509

From: Peter Gutmann <[email-masked]>
Date: Thu, 19 Feb 2004 00:41:20 +1300

"Al Arsenault" <[email-masked]> writes:

>So Anders' statement that "TLS and SSL which are very popular security
>protocols do not support client certificate filtering using policy OIDs" is
>incorrect.

It's not incorrect, it's correct in that the protocol doesn't care what you do
with OIDs (or policies).  Your cert validation engine can do what it wants,
but all the TLS protocol itself cares about is a bUseThisCert flag.  The only
thing you can specify in TLS is the CA name, and even that's frequently left
empty (see the note in the RFC) because the server is in a better position to
know which certs it'll accept than the user, and matching certs by DN is
better done by the server software than by presenting the user with a dialog
asking for a cert with the following issuer DN.

>It may be the case that one or more popular implementations of TLS/SSL do not
>support such certificate filtering, but that's not the same as the protocol
>not supporting it.

Actually the protocol really doesn't support it - there's nothing in the TLS
protocol that allows you to specify any kind of cert policy information.

Peter.

---

From: Peter Gutmann <[email-masked]>
Date: Thu, 19 Feb 2004 00:41:20 +1300

Peter.