Subject: Certificate Polilcy Criticality

From: Russ Housley <[email-masked]>
Date: Fri, 10 Sep 1999 14:17:25 -0400

An update to X.509 is presently being balloted.  This update fixes defects 
that have been identified.  One of these defects is the certificate policy 
mapping that was discussed at the IETF Meeting in Oslo. The X.509 update 
handles all certificate policy extensions in the same manner (whether they 
are marked critical or non-critical).

I suggest that the Internet PKI Profile be updated to always mark 
certificate policy extensions as critical.  This will ensure the correct 
behavior by all implementations.  Old implementations that do not know 
about the update will naturally handle the certificate policy extensions as 
critical because they are marked critical.

Any concerns?

Russ

---

From: Robert Moskowitz <[email-masked]>
Date: Mon, 13 Sep 1999 07:48:44 -0400

At 02:17 PM 9/10/1999 -0400, Russ Housley wrote:
>behavior by all implementations.

Policy is always critical to me.

Robert Moskowitz
ICSA
Security Interest EMail: [email-masked]