Re: Extended Key Usage and path validation

[Frank Balluffi <frankb@xxxxxxxxxxxx>]

Terry Hayes said:

> In fact, I probably could be convinced that Certificate 
> Policies is the correct way of checking the validity of a 
> path for a particular purpose.

Using certificate policies makes a lot of sense, but note that the CA
issuing the end-entity certificate still has some flexibility over what
policy identifiers are included in the end-entity certificate. In the
following example (which I believe to be legal), CA 1 asserts nothing about
signing S/MIME messages:

Issuer  Subject  Policy Identifiers
------  -------  ------------------
CA 1    CA 2     id-foo, id-goo
CA 2    CA 3     id-goo, id-hoo
CA 3    Alice    id-goo, id-smime

In the above example, the most superior certificate is not self signed.

Frank