RFC 7229

RFC 7229: Object Identifiers for Test Certificate Policies 🎀

okay bestie, here's the title block, the important facts first 💅

• RFC number: 7229
• Title: Object Identifiers for Test Certificate Policies
• Author: Russell Housley, Vigil Security 🦋
• Category: Informational
• Date: May 2014
• ISSN: 2070-1721
• Obsoletes / Updates: the title block doesn't list anything here, so there's no Obsoletes or Updates entry in this document 🌸

---

Abstract ✨

okay so this doc gives you a handful of certificate policy identifiers that you can use for testing certificate handling software. literally that's the whole vibe 🧪

Status of This Memo 📋

this one is not an Internet Standards Track spec, it's just published for info purposes 💜

it's still a product of the IETF, so it does reflect the consensus of the IETF community. it went through public review and the IESG approved it for publication. not every IESG-approved doc is a candidate for any level of Internet Standard though, so check Section 2 of RFC 5741 if you want the deets 🤓

if you want the current status, any errata, or a way to send feedback, head to http://www.rfc-editor.org/info/rfc7229 🌈

Copyright Notice ©️

Copyright (c) 2014 IETF Trust and the persons identified as the document authors. All rights reserved. 🫶

this doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stood on the publication date. please actually read those, because they spell out your rights and restrictions for this doc, no skipping 🙈

if you pull Code Components out of this doc, they have to include the Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions. they come with no warranty, as described in the Simplified BSD License ⚠️

1. Introduction 🧚

same energy as the abstract: this doc gives you several certificate policy identifiers for testing certificate handling software. these identifiers are not meant for the public Internet, so don't go putting them on real certs 💀

the identifiers line up with the certificate profile in [RFC5280]. they're good for testing certificate policy processing, especially the handling of the certificate policy extension, the policy constraints extension, and the policy mapping extension 🍓

2. Certificate Policy Identifiers for Testing 🦋

these are the test certificate policy identifiers. ASN.1 [ASN1-2008] object identifiers are how the policies get named 💖

   id-pkix OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
               dod(6) internet(1) security(5) mechanisms(5) pkix(7) }

   id-TEST OBJECT IDENTIFIER ::= { id-pkix 13 }

   -- Object Identifiers used ONLY for TESTING
   id-TEST-certPolicyOne       OBJECT IDENTIFIER ::= { id-TEST 1 }
   id-TEST-certPolicyTwo       OBJECT IDENTIFIER ::= { id-TEST 2 }
   id-TEST-certPolicyThree     OBJECT IDENTIFIER ::= { id-TEST 3 }
   id-TEST-certPolicyFour      OBJECT IDENTIFIER ::= { id-TEST 4 }
   id-TEST-certPolicyFive      OBJECT IDENTIFIER ::= { id-TEST 5 }
   id-TEST-certPolicySix       OBJECT IDENTIFIER ::= { id-TEST 6 }
   id-TEST-certPolicySeven     OBJECT IDENTIFIER ::= { id-TEST 7 }
   id-TEST-certPolicyEight     OBJECT IDENTIFIER ::= { id-TEST 8 }

3. Security Considerations 🔥

this spec doesn't pick out any particular certificate policies for the Internet public key infrastructure, so you won't find a "real" policy in here 🙅‍♀️

the policies used on production certificates can seriously affect how much confidence you can put in a certificate. No confidence should be placed in any certificate that makes use of these certificate policy identifiers, since they're meant ONLY for testing. I'm not kidding, this is a "do not trust" situation 😭🚨

4. IANA Considerations 🌸

the object identifiers in this doc live in an arc that IANA delegated to the PKIX Working Group. IANA doesn't need to do anything for this doc or for any updates that might come later 💅

5. Normative References 📚

• [ASN1-2008] International Telecommunications Union, "Abstract Syntax Notation One (ASN.1): Specification of basic notation", ITU-T Recommendation X.680, November 2008.
• [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., Housley, R., and W. Polk, "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 5280, May 2008.

Appendix A. ASN.1 Module 🧸

this appendix has the same certificate policy identifiers (object identifiers), but packaged as an ASN.1 module. there are no fancy structures, so the module is compatible with [ASN1-2008] ✨

   PKIXTestCertPolicies { iso(1) identified-organization(3) dod(6)
      internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
      id-mod-TEST-certPolicies(83) }

   DEFINITIONS IMPLICIT TAGS ::=

   BEGIN

   -- EXPORTS ALL --
   -- IMPORTS NONE --

   id-pkix OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
               dod(6) internet(1) security(5) mechanisms(5) pkix(7) }

   id-TEST OBJECT IDENTIFIER ::= { id-pkix 13 }

   -- Object Identifiers used ONLY for TESTING
   id-TEST-certPolicyOne       OBJECT IDENTIFIER ::= { id-TEST 1 }
   id-TEST-certPolicyTwo       OBJECT IDENTIFIER ::= { id-TEST 2 }
   id-TEST-certPolicyThree     OBJECT IDENTIFIER ::= { id-TEST 3 }
   id-TEST-certPolicyFour      OBJECT IDENTIFIER ::= { id-TEST 4 }
   id-TEST-certPolicyFive      OBJECT IDENTIFIER ::= { id-TEST 5 }
   id-TEST-certPolicySix       OBJECT IDENTIFIER ::= { id-TEST 6 }
   id-TEST-certPolicySeven     OBJECT IDENTIFIER ::= { id-TEST 7 }
   id-TEST-certPolicyEight     OBJECT IDENTIFIER ::= { id-TEST 8 }

   END

Author's Address 💌

Russell Housley Vigil Security, LLC 918 Spring Knoll Drive Herndon, VA 20170 USA

EMail: housley@vigilsec.com 🦋