Subject: questions on CertificatePolicies processing

From: Kopylov Denis <[email-masked]>
Date: Wed, 15 Nov 2006 16:00:07 +0300

Q1: Is there any sense in setting user-initial-policy-set without
setting initial_explicit_policy?

Q2: How should be threated a valid certificate if validation with
non-empty user-initial-policy-set resulted in empty valid_policy_tree?

-- 
Kopylov Denis
kopylov at top-cross.ru

---

From: Kopylov Denis <[email-masked]>
Date: Wed, 15 Nov 2006 18:35:24 +0300

Peter Rybar пишет:
> Some info are in
>
> http://www.nbusr.sk/sep/leg_rozne/kontrola_cert_cesty_en.pdf
>   
Thank you for the link. But there is no answer in that PDF - just one 
more description for validation procedure.
Main thought behind my questions is that there should be some difference 
in interpretation of empty valid_policy_set - depending on 
user_initial_policy_set value.

-- 
======================================================
Kopylov Denis
kopylov at top-cross.ru

---

From: "Matt Cooper" <[email-masked]>
Date: Wed, 15 Nov 2006 08:59:46 -0800

Q1: Is there any sense in setting user-initial-policy-set without
setting initial_explicit_policy?
[Matt] In some circumstances it may be of value during authentication
and authorization.  For example, if the certificate is valid, but valid
for no policies, allow access only to A.  If valid for policy X, allow
access to A and B, etc.  However, in many circumstances, I think
software may choose to set initial-explicit-policy if an initial policy
set is supplied, as this would frequently be the intent of supplying the
initial set.  I think this decision is dependent on what you are
attempting to achieve through the certificate validation and what sort
of feedback (if any) the software will supply to the user relating to
the final policy set.  In any case, if an initial policy set can be
supplied, there should be a way to turn on initial-require-explicit if
this is not the default behavior of the software.

Q2: How should be treated a valid certificate if validation with
non-empty user-initial-policy-set resulted in empty valid_policy_tree?
[Matt] If require explicit policy is set, either initially or by a
certificate in the path, the certificate is not valid if the final
policy set is empty.

Matt Cooper
CygnaCom Solutions
7925 Jones Branch Dr, Suite 5200
McLean, VA  22102
http://www.cygnacom.com

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Kopylov Denis
Sent: Wednesday, November 15, 2006 8:00 AM
To: [email-masked]
Subject: questions on CertificatePolicies processing

--
Kopylov Denis
kopylov at top-cross.ru