Suppose I have a certificate chain consisting of a Root, a CA and a User certificate. The policy extension in the Root certificate contains one oid of 1.2.4. The policy extension in the CA certificate contains one oid of 1.2.4. The policy extension in the User certificate contains one oid of 1.2.4.1. Assuming all other data is valid, is this a valid certificate chain? It appears to me that the algorithm defined in draft-ietf-pkix-new-part1-00 would determine that this certificate path is invalid. And the way to correct it would be to add a policy mapping to the CA certificate for the oid 1.2.4.1. Is the policy mapping necessary in a closed-community, if the Relying Party trusts all certs issued with a policy oid of 1.2.4 and all certs issued with a policy oid of 1.2.4.1?