交互認證之下屬憑證機構（Cross-Certified Subordinate CA）憑證之憑證原則（Certificate Policies）

Cross-Certified Subordinate CA Certificate Certificate Policies

The Certificate Policies extension MUST contain at least one PolicyInformation. Each PolicyInformation MUST match the following profile:

憑證原則（Certificate Policies）擴充欄位應（MUST）包含至少一個 PolicyInformation。每個 PolicyInformation 應（MUST）符合下列剖繪：

No Policy Restrictions (Affiliated CA)

Field	Presence	Contents
policyIdentifier	MUST	When the Issuing CA wishes to express that there are no policy restrictions, and if the Subordinate CA is an Affiliate of the Issuing CA, then the Issuing CA MAY use the anyPolicy Policy Identifier, which MUST be the only PolicyInformation value.
anyPolicy	MUST
policyQualifiers	NOT RECOMMENDED	If present, MUST contain only permitted policyQualifiers from the table below.

Policy Restricted

Field	Presence	Contents
policyIdentifier	MUST	One of the following policy identifiers:
A Reserved Certificate Policy Identifier	MUST	The CA MUST include at least one Reserved Certificate Policy Identifier (see Section 7.1.6.1) associated with the given Subscriber Certificate type (see Section 7.1.2.7.1) transitively issued by this Certificate.
anyPolicy	MUST NOT	The anyPolicy Policy Identifier MUST NOT be present.
Any other identifier	MAY	If present, MUST be defined by the CA and documented by the CA in its Certificate Policy and/or Certification Practice Statement.
policyQualifiers	NOT RECOMMENDED	If present, MUST contain only permitted policyQualifiers from the table below.

This Profile RECOMMENDS that the first PolicyInformation value within the Certificate Policies extension contains the Reserved Certificate Policy Identifier (see 7.1.6.1)¹. Regardless of the order of PolicyInformation values, the Certificate Policies extension MUST include at least one Reserved Certificate Policy Identifier. If any Subscriber Certificates will chain up directly to the Certificate issued under this Certificate Profile, this Cross-Certified Subordinate CA Certificate MUST contain exactly one Reserved Certificate Policy Identifier.

本剖繪建議（RECOMMENDED）憑證原則擴充欄位中之第一個 PolicyInformation 值包含保留憑證政策識別碼（參見第 7.1.6.1 節）¹。無論 PolicyInformation 值之順序為何，憑證原則擴充欄位應（MUST）至少包含一個保留憑證政策識別碼。若有任何用戶憑證直接串鏈至依本憑證剖繪所簽發之憑證，則本交互認證之下屬憑證機構憑證應（MUST）包含僅有一個保留憑證政策識別碼。

Note: policyQualifiers is NOT RECOMMENDED to be present in any Certificate issued under this Certificate Profile because this information increases the size of the Certificate without providing any value to a typical Relying Party, and the information may be obtained by other means when necessary.

注意：本憑證剖繪所簽發之任何憑證均不建議（NOT RECOMMENDED）包含 policyQualifiers，因為此資訊會增加憑證大小，但對一般信賴憑證者並無實質價值，且於必要時可透過其他方式取得。

If the policyQualifiers is permitted and present within a PolicyInformation field, it MUST be formatted as follows:

若允許使用 policyQualifiers，且其存在於 PolicyInformation 欄位中，應（MUST）依下列格式編排：

Permitted policyQualifiers

Qualifier ID	Presence	Field Type	Contents
id-qt-cps (OID: 1.3.6.1.5.5.7.2.1)	MAY	IA5String	The HTTP or HTTPS URL for the Issuing CA’s Certificate Policies, Certification Practice Statement, Relying Party Agreement, or other pointer to online policy information provided by the Issuing CA.
Any other qualifier	MUST NOT	-	-