A question viewing certifcate information via the padlock symbol in IE 11 (works on Chrome brower)

Question

Hello All
Can someone please help me with the following questions,
J
1:
I have a CA whose CA certificate has an Issuance (aka certificate) Policy.
Next I created a CSR for a WEBServer certificate, I created the CSR by first creating a .inf (request file) containing the usual including the following
[RequestAttributes]
CertificateTemplate=WebServer
OID=1.3.6.1.5.5.7.3.1
IssuancePolicy="My Certificate Policy"
OID=1.3.6.1.4.145389.1.1.1
Turned the above into a CSR (base64 encoded) then submitted and retrieved the relevant certificate from the CA
If I open the certificate flat file the resultant certificate has the relevant Issuance Policy listed under the section
‘This certificate is intended for the following purposes’
So all good so far
Next I install the certificate to the WEB Site and bind it etc. When I go the WEB Site e.g.
Https://TestSite the certificate works and the traffic is encrypted etc… e.g. click on the padlock in Internet Explorer provides the expected information, but when I click on View Certificate via this padlock symbol; in Internet
Explorer the certificate come up OK but under
‘This certificate is intended for the following purposes’
It does not show my issuance policy e.g. just the standard application policy for a WEBServer cert.
If I then look under the details/extensions tab of the certificate it does show certificate policy under the certificate policies extension, so looks OK from the extensions tab, but policy does not show up under ‘This certificate is intended for the following
purposes’ when certificate is viewed via padlock on IE but does show up if I open the certificate flat file (either original certificate file or copy to file then view certificate as a flat file).
The OID for the policy is registered in both active directory and local OID databases.
So the question is why do I not see the issuance policy when viewing cert via padlock in IE but does when viewing flat file.
I am using IE 11.x
When doing the same thing from Chrome browser the certificate policy does show up OK, therefore is this a possible bug with IE 11.x
Thanks All
AAnotherUser__
AAnotherUser__

Answer 1

Hello Brian
Thanks for the reply,
The OID is in the Issuing CA Certificate (online CA) e.g. was part of the CAPolicy.inf file when installing the Issuing CA. The OffLine Root and OffLine Policy CA have the All Issuance Policy set in their CA Certificates.
briefly as mentioned above when opening the cert (.cer) as a flat file by double clicking on it you can see the Issuance Policy listed as expected. When viewing the same cert via Internet Explorer (v11.x) PadLock > View Certificate it shows the Application
Policy, but not the Issuance Policy (e.g. in the general tab) but does show the Issuance Policy under Extensions Tab. If I use Chrome, click on the PadLock > View Certificate it does show the Issuance Policy (as it always does when opening the flat
file).
Therefore was kind of wondering if a Bug in IE, when doing a CertUtil -f -urlfetch -verify Cert.Cer it passed all tests and shows it was validated against the Issuance Policy OK, therefore  perhaps bug in IE
No big deal, just wanted to know if any one else saw this or was another explanation
Thank you
AAnotherUser__
AAnotherUser__