Subject: [pkix] Best practices for Certificate Policy OIDs in certificates

From: David CARELLA <[email-masked]>
Date: Mon, 30 May 2011 17:56:56 +0200

Hi all,

After reading RFC 5280, § 4.2.1.4 Certificate Policies, I have several 
questions about the best practices on certificate policies:
- certificate policies writing (number of documents),
- setting the certificate policy OIDs (and qualifiers) in CA and end 
entities certificates.

I suppose that I have:
- entities and theirs certificates:
     - Root CA,
     - Sub CA 1 (Intermediate CA), issued by Root CA,
     - Sub CA 2 (End CA), issued by Sub CA 1,
     - End entities (EE), issued by Sub CA 2;
- certificate policies:
     - Root CA certificate policy (describe Root CA and Sub CA 1): OID-0,
     - Sub CA 1 certificate policy (describe Sub CA 1 and Sub CA 2): OID-1,
     - Sub CA 2 certificate policy (describe Sub CA 2 and End entities): 
OID-2.

Which is the best practice, for certificate policies writing?
1. One certificate policy (CP) by CA (cf. above),
    i.e.:
    - one CP for Root CA,
    - one CP for each level 1 Sub CA,
    - and one CP for each level 2 Sub CA,
2. One certificate policy for Root CA and level 1 Sub CA,
    and one certificate policy for each level 2 Sub CA (as End CA),
3. Other case?

Which is the best technical practice, among the following examples, or 
other cases?

--- Example 1
According to RFC 5280, and strictly respected.

Root CA: Certificate policy:
- policyIdentifier: anyPolicy [2.5.29.32.0]
- policyQualifiers: - cPSuri: URI

Sub CA 1: Certificate policy:
- policyIdentifier: anyPolicy [2.5.29.32.0]
- policyQualifiers: - cPSuri: URI

Sub CA 2: Certificate policy:
- policyIdentifier: anyPolicy [2.5.29.32.0]
- policyQualifiers: - cPSuri: URI

End entity: Certificate policy:
- policyIdentifier: OID (OID-2)

--> E.g. URI = http://pki.project.org/cps/

--- Example 2
According to RFC 5280, and according to what I saw in Firefox 
("conformed" built-in CAs).

Root CA: Certificate policy:
- policyIdentifier: anyPolicy [2.5.29.32.0]
- policyQualifiers: - cPSuri: URI

Sub CA 1: Certificate policy:
- policyIdentifier: anyPolicy [2.5.29.32.0]
- policyQualifiers: - cPSuri: URI

Sub CA 2: Certificate policy:
- policyIdentifier: OID (OID-2)
- policyQualifiers: - cPSuri: URI

End entity: Certificate policy:
- policyIdentifier: OID (OID-2)
- policyQualifiers:
     - cPSuri: URI
     - userNotice: - explicitText: text (if need)

--> E.g. URI = http://pki.project.org/cps/

--- Example 3
Sometimes, I saw the following case (for the Sub CA 2, from my example 
2), but it isn't conformed to the recommendations described in RFC 5280, 
because there are two OIDs, and cPSuri isn't needful for OID!=anyPolicy.
Is it still a good practice?

Sub CA 2:
Certificate policy:
- policyIdentifier: OID (OID-2)
- policyQualifiers: - cPSuri: URI
Certificate policy:
- policyIdentifier: anyPolicy [2.5.29.32.0]

--> E.g. URI = http://pki.project.org/cps/

Best regards,
David CARELLA