[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Cert chain validation
Suppose I have a certificate chain consisting of a Root, a CA and a User
certificate.
The policy extension in the Root certificate contains one oid of 1.2.4.
The policy extension in the CA certificate contains one oid of 1.2.4.
The policy extension in the User certificate contains one oid of 1.2.4.1.
Assuming all other data is valid, is this a valid certificate chain?
It appears to me that the algorithm defined in draft-ietf-pkix-new-part1-00
would determine that this certificate path is invalid. And the way to
correct it would be to add a policy mapping to the CA certificate for the
oid 1.2.4.1.
Is the policy mapping necessary in a closed-community, if the Relying Party
trusts all certs issued with a policy oid of 1.2.4 and all certs issued with
a policy oid of 1.2.4.1?