A question about CPS (CPS processing) and CAPolicy.inf file.

Question

Hello All
Can someone please help me with the following question.
Background, I am building a 3-tier PKI infrastructure. offline Root, offline Policy (intermediate), online issuing.
Now my first question is about CPS (certificate practice statement) for this example lets just call this the InternalIssuancePolicy as below.
Basically I was thinking it is best not to set a given certificate (aka issuance) policy at the Root, the reason being I may wish to have different issuance policies at a latter date.
For example right now I just want an issuance policy (CPS) for internal certificates only, therefore I am thinking set this at the Policy CA level, as below [InternalIssuancePolicy] (example OID) and then issuing CA certs from this Policy CA to the
internal issuing CAs. If at a latter date I want a different policy (CPS) for issuance of external certificates I can build a new Policy CA under the existing Root with a different policy extension.
Is the above logic sound?
Questions:
I am assuming from recent study that the CA cert issued to the Issuing CA will contain a single issuance policy "only" i.e. the one that was specified in the Policy CA 1.3.6.1.4.11111111.1.1.1.  If so I believe you cannot build a new
issuing CA and submit the CSR to the Policy CA asking for a CA cert with any other certificate policy extension other than 1.3.6.1.4.11111111.1.1.1
Is that correct?
Also
I saw a blog post which stated if are going to use certificate/issuance policies (other than all issuance policies) you should mark the extension as critical=true otherwise the policy just becomes glorified comment. I take the point but that leads me to
two more questions
1: How does the certificate changing engine or CryptoAPI enforce a certificate policy (as it is just a policy, e.g. written procedure). I am assuming all this means is it forces the client to process the extension and therefore check the certificate
policy extension in the certificate does not violate the certificate chain but that is all it can do?
2: If the certificate policy extension is set to critical and the URL referenced in the extension is not available (e.g. on a WEB Server and the client is working offline, but has a cached CRL), does setting the extension to critical also force the
client to try and access the URL listed, or not (I am assuming not as you could just have a text block rather than URL).
Any comments suggestions on my proposed three CAPolicy.inf files below for the 3-tier PKI (again offline Root and Policy)
** Root **
[Version]
Signature= "$Windows NT$"
[Certsrv_Server]
RenewalKeyLength=4096
RenewalValidityPeriodUnits=Years
RenewalValidityPeriod=20
CRLPeriod=Years
CRLPeriodUnits=1
LoadDefaultTemplates=False
AlternateSignatureAlgorithm=0
[CRLDistributionPoint]
[AuthorityInformationAccess]
basicconstraintsextension]
pathlength = 2
critical=true
PolicyStatementExtension]
Policies = AllIssuancePolicy
Critical = FALSE
[AllIssuancePolicy]
OID = 2.5.29.32.0
** Policy CA **
[Version]
Signature= "$Windows NT$"
[Certsrv_Server]
RenewalKeyLength=2048
RenewalValidityPeriodUnits=Years
RenewalValidityPeriod=10
CRLPeriod=Years
CRLPeriodUnits=1
[PolicyStatementExtension]
Policies = InternalIssuancePolicy
Critical = False
[InternalIssuancePolicy]
OID = 1.3.6.1.4.11111111.1.1.1
Notice = "Internal Certificate Policy"
URL="http://pki.lab.local/Certenroll/CPS.txt"
[AuthorityInformationAccess]
URL=http://pki.lab.local/Certenroll/PolicyCA01.crt
[CRLDistributionPoint]
URL=http://pki.lab.local/Certenroll/PolicyCA01.crl
[basicconstraintsextension]
pathlength = 1
critical=true
** Issuing CA **
[Version]
Signature= "$Windows NT$"
[Certsrv_Server]
RenewalKeyLength=2048
RenewalValidityPeriodUnits=Years
RenewalValidityPeriod=5
CRLPeriod=Weeks
CRLPeriodUnits=1
CRLDeltaPeriod=Days
CRLDeltaPeriodUnits=1
LoadDefaultTemplates=False
AlternateSignatureAlgorithm=0
[AuthorityInformationAccess]
URL=http://pki.lab.local/Certenroll/IssuingCA01.crt
[CRLDistributionPoint]
URL=http://pki.lab.local/Certenroll/IssuingCA01.crl
[basicconstraintsextension]
pathlength = 0
critical=true
Thanks All
AAnotherUser__

Answer 1

> Is the above logic sound?
not that much. In this case 3-tier PKI could be reduced to 2-tier. Make default Offline Root CA and below it issuing CAs with desired policy OIDs. You will combine issuing CA with policy CA functionality. Additional tier will cost you a license, administration
overhead and increased certificate chain processing delays. There is nothing wrong if you combine policy CAs with issuing.
> I saw a blog post which stated if are going to use certificate/issuance policies (other than all issuance policies) you should mark the extension as critical=true
where did you get this? Certificate policies should not be marked critical. Certificate chaining engine will take care of it, when application reqests CCE to validate desired policy.
> does setting the extension to critical also force the client to try and access the URL listed
no. Certificate chaining engine do not inspect policy qualifier URLs.
> Any comments suggestions on my proposed three CAPolicy.inf files below for the 3-tier PKI (again offline Root and Policy)
[CRLDistributionPoint]
[AuthorityInformationAccess]
[PolicyStatementExtension]
Policies = AllIssuancePolicy
Critical = FALSE
[AllIssuancePolicy]
OID = 2.5.29.32.0
these sections are not required in root CA.
[AuthorityInformationAccess]
URL=http://pki.lab.local/Certenroll/PolicyCA01.crt
[CRLDistributionPoint]
URL=http://pki.lab.local/Certenroll/PolicyCA01.crl
[basicconstraintsextension]
pathlength = 1
critical=true
These sections are not required at policy CA. Afaik, CDP and AIA extensions are not supported in non-root CA configuration files. The same is with issuing CA. And your issuing CA is missing PolicyStatementExtension section.
Vadims Podāns, aka PowerShell CryptoGuy
My weblog: en-us.sysadmins.lv
PowerShell PKI Module: pspki.codeplex.com
PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
Check out new: SSL Certificate Verifier
Check out new:
PowerShell File Checksum Integrity Verifier tool.