Re: Certificate policy question

[pgut001@xxxxxxxxxxxxxxxxx (Peter Gutmann)]

Richard Levitte - VMS Whacker <levitte@xxxxx> writes:

>What kind of certificate are we talking about, an EE certificate or a CA one?

It's an EE cert.

>If I assume a somewhat bastardous attitude, I'd say such a certificate
>invalidates the whole path, IF you end up having those clashing policies in
>your state at the end of path construction/validation.

I have yet to find anything [0] which even notices the two conflicting
policies (there are two different policy OIDs and two pointers to different
CPSes), thus my comment that while standard practice appears to be to totally
ignore policies, I really feel that I should be doing something about it, I'm
just not sure what.

Peter.

[0] At least in the set of generally-used, publicly-available PKI software,
    there are probably commercial/proprietary products around which get it
    right.