Re: Certificate policy question

[pgut001@xxxxxxxxxxxxxxxxx (Peter Gutmann)]

Richard Levitte - VMS Whacker <levitte@xxxxx> writes:

>So, out of curiosity, would you regard that cerificate as valid or invalid (I
>hope to code better validation into OpenSSL, and handling of policies is
>certainly a large part, so I'm interested as well :-))? I'd opt for invalid
>unless someone can tell me I should regard as valid and why.  I'd even go one
>step further and regard an EE certificate with more than policy as suspicious,
>at least.

I regarded it as suspicious and checked the CPS, whereupon I regarded it as
*really* suspicious.  However from some of the other comments posted here, it
makes sense to regard the policies as a OR b OR c rather than a AND b AND c
(or UNION or INTERSECTION or something similar).  It'd be useful to have this
mentioned explicitly somewhere though, since reverse-engineering the effect of
the path-processing algorithm, and then trying to decide whether the effect
achieved when two incompatible policies are present is intentional or
coincidental, is rather tricky.

Peter.