Re: Critical certificate policies extension

Niklas Matthies <[email protected]> writes:

>The reason I'm asking is that the Java path building and validation
>implementation (formerly by Sun/Oracle, now OpenJDK) by default rejects
>certificates with a critical certificate policies extension if it contain any
>qualifiers [1]

... and if the implementation has been configured to do so via the
rejectPolicyQualifiers flag.  So it's doing what the user asked it to do.

>despite the RFC explicitly stating for the former that "No action is mandated
>by this specification regardless of the criticality value asserted for the
>extension"),

That sentence is preceded by "Processing requirements for this qualifier are a
local matter", so it's saying "what you do with this is up to you, we're not
going to mandate anything".  So this part makes sense too.

>1. Does that Java behavior make any sense?

Seems to.

>2. What would be the correct behavior for unknown policy OIDs without
>qualifiers, or with only CPSuri and/or UserNotice qualifiers?

This was one of the many parts of the standard that, when it was originally
discussed, no two people could agree on, see e.g. the thread "Dave's Critical
Proposal" from 1997.  There were many more like that.

So probably the best behaviour is "try and be consistent, and document what
you do somewhere".

Peter.