Subject: RE: End-Entity Certificate Policies

From: Charles Moore <[email-masked]>
Date: Wed, 1 Sep 1999 19:25:05 +1000

----- Original Message -----
From: Russ Housley <[email-masked]>
To: <[email-masked]>
Sent: Wednesday, September 01, 1999 6:56 AM
Subject: End-Entity Certificate Policies

> Tim Polk and I got together today to discuss the changes needed to address
> the policy mapping bug (as discussed at the Oslo meeting).  As part of
this
> discussion, we discussed the certificate policy extension.
>
> We believe that a CA certificate may contain one or more certificate
policy
> OID.  On the other hand, we believe that an end-entity certificate
> containing a certificate policy extension must  contain a single
> certificate policy OID.  RFC 2459 says:
>
>     The certificate policies extension contains a sequence of one or more
>     policy information terms, each of which consists of an object
>     identifier (OID) and optional qualifiers.  These policy information
>     terms indicate the policy under which the certificate has been issued
>     and the purposes for which the certificate may be used.  Optional
>     qualifiers, which may be present, are not expected to change the
>     definition of the policy.

cm>Believe we should stick to the above text and not limit to one OID...

>
> We would like to add words to make it more clear that an end-entity
> certificate may only contain a single certificate policy OID.  The
> explanation of this extension's purpose in a CA certificate was not
spelled
> out, so we propose to fix that too.  Our proposed text is:
>
>     The certificate policies extension contains a sequence of one or more
>     policy information terms, each of which consists of an object
>     identifier (OID) and optional qualifiers.  In an end-entity
certificate,
>     these policy information terms indicate the single policy under which
>     the certificate has been issued and the purposes for which the
certificate
>     may be used.
Cm> See above, should not limit...The rest is ok...
For info what is the rational for limiting??

 In a CA certificate,  these policy information terms
>     limit the set of policies for certification paths which include this
>     certificate.  Optional qualifiers, which may be present, are not
>     expected to change the definition of the policy.
cm> Believe the intent is "expected to restrict the definition of the
policy"
rather than 'change'

>
> Does anyone disagree?
>
> Tim and I also discussed certificate policy qualifiers.  Tim and I agree
> that certificate policy qualifiers should only appear in end-entity
> certificates.  That is, we agree that certificate policy qualifier should
> never appear in a CA certificate.  Does anyone (besides Mike Baum)
disagree?

cm> I see no reason to limit the aplication of policy qualifiers, a CP can
cover a CA as well so why not allow qualification of the CP at any
element....

Would be interested in the rational as well...

> Russ

---

From: Stefan Santesson <[email-masked]>
Date: Wed, 01 Sep 1999 15:58:47 +0200

I would agree with Charles here,

What are the reasons for limiting to one policy OID in end-entity certificates.

The case I see is when a community of relying parties accept 2 different
policies, which are possible to meet within the same certificate. The CA
want to issue a certificate and assure that both these policies are
fullfilled. The CA document how these two ploicies are implemented in a CPS.

This scenario is fully compatible with validation algorithms in X.509.

Why should this be forbidden.

Further I have troubble to see why policy qualifiers should be forbidden in
CA-certificates. In most cases I have seen, CA certificates carry the same
policy as end-entity certificates issued under that CA. I therefore fail to
see why the policy information should be expressed differently in
CA-certificates.

Please elaborate on what problems you try to fix with these changes.

/Stefan

>Would be interested in the rational as well...

-------------------------------------------------------------------
Stefan Santesson                <[email-masked]>
Accurata AB                     http://www.accurata.se
Slagthuset                      Tel. +46-40 108588              
211 20  Malmö                   Fax. +46-40 150790              
Sweden                        Mobile +46-70 5247799

PGP fingerprint: 89BC 6C79 5B3D 591B 8547  1512 7D11 DBF4 528F 29A0
-------------------------------------------------------------------