Critical certificate policies extension
Niklas Matthies <[email protected]> Mon, 11 Jul 2022 16:29:02 +0200
| Newsgroups | gmane.ietf.x509 |
|---|---|
| Message-ID | <[email protected]> |
Dear all,
Regarding the certificate policies extension, RFC 5280 section 4.2.1.4
states:
If this extension is critical,
the path validation software MUST be able to interpret this extension
(including the optional qualifier), or MUST reject the certificate.
What exactly does "able to interpret" mean? Does it mean that the
software must know the meaning of the specific policy OIDs (and
qualifiers), or does it just mean that it must understand the
extension syntactically and perform the checks specified in section
6.1 (path validation)?
The reason I'm asking is that the Java path building and validation
implementation (formerly by Sun/Oracle, now OpenJDK) by default
rejects certificates with a critical certificate policies extension
if it contain any qualifiers [1] (even for the standard qualifiers
CPSuri and UserNotice, despite the RFC explicitly stating for the
former that "No action is mandated by this specification regardless of
the criticality value asserted for the extension"), but is fine with
critical certificate policies extensions specifying custom policy OIDs
as long as they do not have any qualifiers.
Regarding the "MUST" requirements quoted above:
1. Does that Java behavior make any sense?
2. What would be the correct behavior for unknown policy OIDs without
qualifiers, or with only CPSuri and/or UserNotice qualifiers?
3. Does it make a difference whether the extension occurs in an EE or
CA certificate?
Any clarification would be greatly appreciated.
Niklas
[1] https://github.com/openjdk/jdk/blob/master/src/java.base/share/classes/sun/security/provider/certpath/PolicyChecker.java#L483