Policy Qualifiers in Resource Public Key Infrastructure (RPKI) Certificates
updates
- rfc-6487 — A Profile for X.509 PKIX Resource Certificates
Extracted elements (9)
RFC 6487 neither explicitly allowed nor disallowed PolicyQualifierInfo objects, creating ambiguity. Some RPKI Certificate Authorities have an operational need to include policy qualifiers (specifically CPS URIs) in their certificates, motivating this clarifying update.
A relying party that performs strict validation based on RFC 6487 without implementing the updates described in RFC 7318 would incorrectly invalidate RPKI objects that include a CPS policy qualifier. Validators must be updated to accept the broadened profile.
Any optional policy qualifier that MAY be present in a resource certificate MUST NOT change the definition of the RPKI CP (RFC 6484). Qualifiers are not expected to change the definition of the policy.
Exactly one policy qualifier MAY be included in the certificate policies extension of an RPKI resource certificate.
If a policy qualifier is included, the policyQualifierId MUST be the Certification Practice Statement (CPS) pointer qualifier type (id-qt-cps). No other qualifier types are permitted.
The certificate policies extension MUST be present and MUST be marked critical in RPKI resource certificates. It MUST include exactly one policy, as specified in the RPKI CP (RFC 6484).
PolicyQualifierInfo objects may optionally appear within the PolicyInformation sequence of the certificate policies extension, as defined in RFC 5280 Section 4.2.1.4. RFC 7318 explicitly permits at most one such object in RPKI certificates.
Including a CPS URI as a policy qualifier could provide a denial-of-service (DoS) vector: a target host may be subjected to bogus work if relying parties dereference the URI. However, neither RFC 7318 nor RFC 5280 places any processing requirements on dereferencing the URI, so validation implementations SHOULD NOT dereference it.
This document broadens the class of conformant RPKI certificates by explicitly permitting those containing a CPS policy qualifier. The Security Considerations of RFC 6487 continue to apply.