Re: Certificate policy question

[pgut001@xxxxxxxxxxxxxxxxx (Peter Gutmann)]

Richard Levitte - VMS Whacker <levitte@xxxxx> writes:

>Additionally, it could be a good thing to have the possibility to distrust
>certain CAs (no, I don't believe a CRL entry is the right thing, or is there
>a reason code that means "the CA made a fool of itself"?  Either way, that
>would also only be possible in a mesh-type PKI, I think).

I've got that in my code, so you can specifically say "I don't trust this CA",
or "I don't trust this CA to issue certificates".  Unfortunately there's no
way to express "I don't trust this CA to not send out its private key as a
PKCS #12 file/encrypt its CRLs so you can't read them/engineer its way out of
a wet paper bag/etc".

>or is there a reason code that means "the CA made a fool of itself"?

There's always my idiotPolicy suggestion :-).

Peter.