Subject: [pkix] Question about RFC5280 certificate validation algorithm

From: Security Developer <[email-masked]>
Date: Sat, 21 Jan 2012 21:29:21 +0500

Hi,

Could anybody please explain PKIX policy node contents?

The policy node contents include:

- valid_policy
- qualifier_set
- expected_policy_set

Also what value does expected_policy_set add in RFC5280 certificate
validation.

Thanks for your time.

---

From: Russ Housley <[email-masked]>
Date: Sat, 21 Jan 2012 15:43:29 -0500

> The policy node contents include:

The initial value of the valid_policy_tree is a single node with:
  -  valid_policy is set to anyPolicy;
  - qualifier_set is set to the empty set; and
  -  expected_policy_set is set to anyPolicy.

The algorithm in section 6 shows how the nodes in the valid_policy_tree are built as each certificate in the path is processed.

> Also what value does expected_policy_set add in RFC5280 certificate validation.

The expected_policy_set contains one or more policy OIDs that would satisfy this policy in the certificate x+1.  The certificate x+1 ought to contain a policy from this set.

Russ