Re: [pkix] A non-compliant use of the EKU extension in Mozilla's CA Certificate Policy Version 2.1.

Again I'm not here to defend MSFT, but I can shead some light about the
rationale.

Don't make the mistake to believe that this was done by ignorant people with
no respect for standards.
Nor assume that they were to lazy to come up with their own extension and
such.

This was introduced well over 10 years ago and I truly believe that the
engineers at the time did their best and thought they did the right thing.
They did try their own extension, but that is a rocky road. MSFT tried with
ApplicationPolicy. But it didn't do the job. Presumably because no once
cared to implement it besides Microsoft.
Certificate policy does not work either. As we at that time discovered the
hard way, certificate policy implementations are terribly broken.
A huge amount of PKI:s put policies in CA certificates that has nothing to
do with the constraining mechanism defined in X.509 and RFC 5280 path
processing.

As deployments as they are effectively prevents standards compliant path
processing of policies, the result is that no one really checks policies as
per 5280 path processing, and if they do, they don't use the resulting
policy set for anything useful.
As a result, no one discover their error and corrects it. And the problems
goes on and on forever.

/Stefan

From:  Erwann Abalea <eabalea@gmail.com>
Date:  Wednesday, February 20, 2013 5:26 PM
To:  Piyush Jain <piyush@ditenity.com>
Cc:  Stefan Santesson <stefan@aaa-sec.com>, pkix <pkix@ietf.org>
Subject:  Re: [pkix] A non-compliant use of the EKU extension in Mozilla's
CA Certificate Policy Version 2.1.

> 
> 2013/2/20 Piyush Jain <piyush@ditenity.com>
>> 
>> really?
>> 
>>  implementers can choose to define another eku like extension with a
>> different OID. it does not break the standards and serves their need.
>> Their attitude will change only when their customers start complaining that
>> their products are cannot inter operate with others because they don't follow
>> the standards.
> 
> They can define their own extension, like MS ApplicationPolicy, or
> NetscapeCertType.
> They can also rely on CertificatePolicies (which they do for EV certificates,
> and are starting to do for DV/OV).
> 
> -- 
> Erwann. _______________________________________________ pkix mailing list
> pkix@ietf.org https://www.ietf.org/mailman/listinfo/pkix