1

I have noticed there are some policy features in x509 certificates. Are there some ways to enforce these policies in the certificates?

For example, let's take a certificate with imaginary oid 1.2.3 which means "public key length is 2048 bits". Is there an automatic procedure which able to process this policy and deny certificates with other key lengths?

  • it is not duplicate, in my last question I have not asked about policies , I have asked about features. However, the example is the same. – adi May 28 '18 at 17:10
4

The enforcement of policies is done in the systems using these certificates for authentication or similar, i.e. web browser, mobile apps, mail clients (S/MIME), IPSec peers, ... . There are a few policies which are clearly defined in the standards and which are usually implemented in all of the systems dealing with X509 certificates (i.e. things like expiration, key usage...).

Any uncommon and/or vendor specific policies will likely not be supported universally. They might be supported for a specific use case (i.e. authentication in HTTPS) or in some vendor specific environments but not everywhere.

X509 has a way to mark extensions as required though and a client which does not understand a specific extension still knows if the understanding of a extension is required or not. This means that a standard-conforming client which does not understand a specific required extension will treat the certificate as invalid. If the extension instead is not marked as required then the client can simply ignore such an unknown extension.

  • I see, so it is the organization's responsibility to write a code which enforce these policies. (I talk about uncommon policies.) – adi May 28 '18 at 17:13
  • 1
    @adi: yes, if somebody wants to add some new kind of policy he has to make sure that all clients which should enforce the policy actually have code for this in their implementations. There is no magic propagation of the necessary code with the certificate. But see the edit about the possibility of marking important extension as required, even if these are vendor specific. – Steffen Ullrich May 28 '18 at 17:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.