Return to Revisions

The base idea is that a policy describes the certification process over the whole path, not just at the level of a given CA. Within a given certificate C, the Certificate Policies extension gives the set of policies to which the process which resulted in the creation of C conforms.

During validation (see section 6.1 of RFC 5280), the verifier computes the "policy tree". In simple cases (see below for possible complications), the leaves of valid_policy_tree at the end of the processing will be the intersection of the sets of policies in all certificates in the path (the steps "prune the policy tree" are what really computes the intersection). In simple words, the set of policy which you obtain at the end will be the set of policies which appear in all the certificates in the path. It is quite logical: you can say that a given path conforms to policy 1.2.3.4.5 only if all certificates in the path were issued in ways compatible with policy 1.2.3.4.5, a property that the certificates themselves advertise by containing policy 1.2.3.4.5 in their Certificate Policies extension.

It is not required that each certificate only uses a subset of the certificates from the upper CA. This would be ill-defined, because paths may merge (a given CA may obtain several certificates from several über-CA, and they could contain distinct policies). The intersection work is done at validation, when a single path is considered. Conceptually, there is no path until validation.

Possible complications:

• There can be certificates without the Certificate Policies extension.
• There can be policy mappings, which allow for replacing some policies with others along the path.
• There is a special policy called anyPolicy which alters the processing.
• There are extensions which can inhibit anyPolicy, and/or require an explicit policy, beginning with a given path depth.

I have encountered a great many CA which get it wrong with regards to policies; that is, they include in each certificate a (non critical) Certificate Policies extension where they put a unique policy which is specific to that CA. End result is that, upon validation, valid_policy_tree is empty (this is not fatal, since these certificates do not include any extension requiring an explicit policy). This is using the extension as a kind of glorified comment.