Subject: RE: End-Entity Certificate Policies

From: Sharon Boeyen <[email-masked]>
Date: Wed, 1 Sep 1999 09:47:32 -0400

I don't support limiting to a single policy OID or limiting the use of 
qualifiers only to end-entity certs. Even if this was agreed as part of 
the PKIX profile for what CAs were to do, relying parties presumably would
need to be able to deal with certs that were created outside of PKIX and
these might very well have multiple policies in the end-entity certs and
qualifiers in the CA certs. So at best this proposal might impose limits
on CA behavior for PKIX CAs, but probably couldn't on PKIX relying parties 
unless we want to isolate the PKIX world from the rest of the world :-(

Sharon 

-----Original Message-----
From: Charles Moore [mailto:[email-masked]]
Sent: Wednesday, September 01, 1999 5:25 AM
To: [email-masked]'
Cc: [email-masked]'
Subject: RE: End-Entity Certificate Policies

----- Original Message -----
From: Russ Housley <[email-masked]>
To: <[email-masked]>
Sent: Wednesday, September 01, 1999 6:56 AM
Subject: End-Entity Certificate Policies

> Tim Polk and I got together today to discuss the changes needed to address
> the policy mapping bug (as discussed at the Oslo meeting).  As part of
this
> discussion, we discussed the certificate policy extension.
>
> We believe that a CA certificate may contain one or more certificate
policy
> OID.  On the other hand, we believe that an end-entity certificate
> containing a certificate policy extension must  contain a single
> certificate policy OID.  RFC 2459 says:
>
>     The certificate policies extension contains a sequence of one or more
>     policy information terms, each of which consists of an object
>     identifier (OID) and optional qualifiers.  These policy information
>     terms indicate the policy under which the certificate has been issued
>     and the purposes for which the certificate may be used.  Optional
>     qualifiers, which may be present, are not expected to change the
>     definition of the policy.

cm>Believe we should stick to the above text and not limit to one OID...

>
> We would like to add words to make it more clear that an end-entity
> certificate may only contain a single certificate policy OID.  The
> explanation of this extension's purpose in a CA certificate was not
spelled
> out, so we propose to fix that too.  Our proposed text is:
>
>     The certificate policies extension contains a sequence of one or more
>     policy information terms, each of which consists of an object
>     identifier (OID) and optional qualifiers.  In an end-entity
certificate,
>     these policy information terms indicate the single policy under which
>     the certificate has been issued and the purposes for which the
certificate
>     may be used.
Cm> See above, should not limit...The rest is ok...
For info what is the rational for limiting??

 In a CA certificate,  these policy information terms
>     limit the set of policies for certification paths which include this
>     certificate.  Optional qualifiers, which may be present, are not
>     expected to change the definition of the policy.
cm> Believe the intent is "expected to restrict the definition of the
policy"
rather than 'change'

>
> Does anyone disagree?
>
> Tim and I also discussed certificate policy qualifiers.  Tim and I agree
> that certificate policy qualifiers should only appear in end-entity
> certificates.  That is, we agree that certificate policy qualifier should
> never appear in a CA certificate.  Does anyone (besides Mike Baum)
disagree?

cm> I see no reason to limit the aplication of policy qualifiers, a CP can
cover a CA as well so why not allow qualification of the CP at any
element....

Would be interested in the rational as well...

> Russ

---

From: Mack Hicks <[email-masked]>
Date: Wed, 01 Sep 1999 08:17:31 -0700

Sharon,

I agree with you. I have a real business need for multiple OIDs in an End Entity
Certificate.

In the Identrus community, all certificates under the Identrus Root must have
the OID of Identrus. It is expected that relying parties may be receiving
certificates from multiple participants and sub-CAs within the structure. It is
easier for the relying party to be able to identify an Identrus certificate and
its context of use through the Identrus OID. Restricting the number of OIDs
means that the relying party has no way of determining a membership in a broader
community. Further, the sub-CAs have no way for providing further policy context
of an end-entity certificate. (I realize that cert path validation would
identify these communities, but the relying party may not have all the
certificates in the path.)

I do not see the any advantage to mandating  only a single OID in an EE
certificate. From a business view, the result is to proliferate the number of
policy documents.

Mack Hicks

--
-------------------------------------------------------------------
Mack Hicks, VP     [email-masked]
Bank of America  +1-415-436-5809