Critical certificate policies extension

Niklas Matthies <[email protected]> Mon, 11 Jul 2022 16:29:02 +0200
Newsgroups gmane.ietf.x509
Message-ID <[email protected]>
Dear all,

Regarding the certificate policies extension, RFC 5280 section 4.2.1.4 
states:

     If this extension is critical,
     the path validation software MUST be able to interpret this extension
     (including the optional qualifier), or MUST reject the certificate.

What exactly does "able to interpret" mean? Does it mean that the 
software must know the meaning of the specific policy OIDs (and 
qualifiers), or does it just mean that it must understand the 
extension syntactically and perform the checks specified in section 
6.1 (path validation)?

The reason I'm asking is that the Java path building and validation 
implementation (formerly by Sun/Oracle, now OpenJDK) by default 
rejects certificates with a critical certificate policies extension
if it contain any qualifiers [1] (even for the standard qualifiers 
CPSuri and UserNotice, despite the RFC explicitly stating for the 
former that "No action is mandated by this specification regardless of 
the criticality value asserted for the extension"), but is fine with 
critical certificate policies extensions specifying custom policy OIDs 
as long as they do not have any qualifiers.

Regarding the "MUST" requirements quoted above:

1. Does that Java behavior make any sense?
2. What would be the correct behavior for unknown policy OIDs without 
qualifiers, or with only CPSuri and/or UserNotice qualifiers?
3. Does it make a difference whether the extension occurs in an EE or 
CA certificate?

Any clarification would be greatly appreciated.

Niklas

[1] https://github.com/openjdk/jdk/blob/master/src/java.base/share/classes/sun/security/provider/certpath/PolicyChecker.java#L483