[Cscwg-public] MUST overridden by a MAY - Subordinate CA policies

[Bruce Morton]

Hi Martijn,

I agree that the language needs improvement. It might be better if the requirement was:

A Certificate issued after 31 March 2022 to a Subordinate CA that issues Timestamp Certificates and is an Affiliate of the Issuing CA MUST include one of the following:

  1.  The CA/Browser Forum reserved identifier (2.23.140.1.4.2) to indicate the Subordinate CA’s compliance with these Requirements; OR
  2.  The “anyPolicy” identifier (2.5.29.32.0).

Does that work? If so, then maybe we should also cleanup the whole section. Also, we might also consider deleting “to indicate the Subordinate CA’s compliance with these Requirements”.


Thanks, Bruce.

From: Cscwg-public <cscwg-public-bounces at cabforum.org> On Behalf Of Martijn Katerbarg via Cscwg-public
Sent: Wednesday, November 22, 2023 11:07 AM
To: cscwg-public at cabforum.org
Subject: [EXTERNAL] [Cscwg-public] MUST overridden by a MAY - Subordinate CA policies

All,

CSBR section 7.1.6.3 states:

”A Certificate issued to a Subordinate CA that issues Code Signing Certificates and is an Affiliate of the Issuing CA:

  1.  MUST include the CA/Browser Forum reserved identifier specified in Section 7.1.6.1<https://github.com/cabforum/code-signing/blob/main/docs/CSBR.md#7161-reserved-certificate-policy-identifiers> to indicate the Subordinate CA's compliance with these Requirements, and
  2.  MAY contain the "anyPolicy" identifier (2.5.29.32.0) in place of an explicit policy identifier.

A Certificate issued after 31 March 2022 to a Subordinate CA that issues Timestamp Certificates and is an Affiliate of the Issuing CA:

  1.  MUST include the CA/Browser Forum reserved identifier specified in Section 7.1.6.1<https://github.com/cabforum/code-signing/blob/main/docs/CSBR.md#7161-reserved-certificate-policy-identifiers> to indicate the Subordinate CA’s compliance with these Requirements, and
  2.  MAY contain the “anyPolicy” identifier (2.5.29.32.0) in place of an explicit policy identifier.”
I find there’s a few issues with this:

  *   “MUST include the CA/Browser Forum reserved identifier specified in Section 7.1.6.1<https://github.com/cabforum/code-signing/blob/main/docs/CSBR.md#7161-reserved-certificate-policy-identifiers>”, seems to state there’s only one policy OID to use, while in fact there are 3 in the named section, 2 which are for code signing certificates. This is a minor issue though and could be fixed in a cleanup ballot.
  *   More concerning I find the MUST and MAY language. If we take the language related to CA Certificates for Code Signing Certificates, what does this language actually state? Should this be interpreted as:
     *   MUST include a CABF OID and MAY additionally contain the “anyPolicy” OID.
or does it state:
     *   MUST include either a CABF OID or the “anyPolicy” OID?
I would like to think the intent here is to allow CA Certificates with just the “anyPolicy” OID, but at the same time, a MAY overriding a MUST, seems counterproductive.
Any thoughts on this?
Regards,

Martijn
Any email and files/attachments transmitted with it are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/cscwg-public/attachments/20231122/655b9a7e/attachment-0001.html>