Re: Bug in RFC 2459

["David P. Kemp" <dpkemp@xxxxxxxxxxxxxx>]

> From: pgut001@cs.auckland.ac.nz (Peter Gutmann)
> 
> (ObGrumble: You have to wonder why anyone even bothers adding half the 
>  extensions in a cert for all the attention that gets paid to them - the 
>  policy extension could probably have just about anything in there and noone 
>  would even notice).

That would be an implementation bug.

If an implementation follows the path validation procedure of section
6, it pays attention to the certificatePolicies extension.  If an
implementation can't be bothered with path validation, you could make
the same statement about anything:  "the { signatureValue | validity |
issuerDN | CRL | ... } could probably have just about anything in there
and noone would even notice."