Certificate Path Validation

[Sunil Agrawal <sagrawal@xxxxxxxxx>]

Dear PKIX WG:

I need some help on Certificate Path Validation.

If my trust anchor is a non self signed certificate, what should be the 
contents
of the initial permitted_subtrees.

permitted_subtrees is defined as "a set of root names for each name type 
(e.g.,
X.500 distinguished names, email addresses, or ip addresses) defining a set of
subtrees within which all subject names in subsequent certificates in the 
certification
path MUST fall".

The RFC 3280, section 6.1.2, subsection b, says

"the initial value for the set for Distinguished Names is the set of all 
Distinguished
names;"

So is the RFC recommending ignoring the Name constraints extension (if 
present) in
the CA certificates that are higher in the hierarchy that the trust anchor ?

Is the recommendation same for excluded_subtrees and other policies?

TIA,
Sunil