if mbedtls can support other certs policy？ about mbedtls

[gilles-peskine-arm]

I don't understand what you're asking. Can you please clarify?

Mbed TLS can parse certificates that contain the certificate policies extension. But Mbed TLS itself doesn't know about policies. By default, certificates containing anything other than anyPolicy are rejected. To allow certificates with a policy, you need to provide a callback function that decides whether the policy is met. Call mbedtls_x509_crt_parse_der_with_ext_cb. The callback should return 0 if the policy is met and a negative value (e.g. MBEDTLS_ERR_X509_INVALID_EXTENSIONS, or a value that's different from any MBEDTLS_ERR_xxx if you prefer) if the policy is not met. You can find an example callback parse_crt_ext_cb() in tests/suites/test_suite_x509parse.function.

[gilles-peskine-arm]

I'm closing this issue because as far as I can tell, Mbed TLS does have the requested feature. Please don't hesitate to respond if I've misunderstood, we can reopen the issue.

If you need help with using existing features, please post on the mailing list: https://lists.trustedfirmware.org/mailman3/lists/mbed-tls.lists.trustedfirmware.org/

[LubanTech1]

Thank you for your reply. But，My service uses a certificate whose policy_oid is not ANY_POLICY during SSL link establishment. The x509_get_certificate_policies function returns an error when determining that policy_oid is not MBEDTLS_OID_ANY_POLICY. How should I deal with this situation?

[gilles-peskine-arm]

You need to write a callback to handle the CERTIFICATE_POLICIES extension, like this.