Certificate policies is a mandatory to support extension for the client, but policy mapping is optional, therefore the minimal conformant client with son of 2459 can only support CA hierarchies with homogeneous certificate issuance policies and practices. This client does not support policy mapping therefore can only operate in a controlled issuance policy environment. We are expecting the need to use the inhibit any policy extension in such an environment?
This does not seem consistent.
If the CAs are operating to a homogeneous set of issuance policies, you can legislate in said policies, whether a CA can have the all policy OID or not rather than require the client to support such an extension.
Why do we need to mandate support for this extension, in our profile for such an environment?
Trevor Freeman
Program Manager
Phone: (425) 936-8477
Pager: 800-759-8352, id#1631457
Pager email: 1631457@xxxxxxxxxx