7.1.2.3.2 已翻譯對應原文版本：2.3.0

受技術約束之非 TLS 下屬憑證機構（Technically Constrained Non-TLS Subordinate CA）之憑證原則（Certificate Policies）

Technically Constrained Non-TLS Subordinate CA Certificate Policies

If present, the Certificate Policies extension MUST be formatted as one of the two tables below:

若存在，憑證原則（Certificate Policies）擴充欄位應（MUST）依下列兩個表格其中之一的格式編排：

No Policy Restrictions (Affiliated CA)
Field Presence Contents
policyIdentifier MUST When the Issuing CA wishes to express that there are no policy restrictions, the Subordinate CA MUST be an Affiliate of the Issuing CA. The Certificate Policies extension MUST contain only a single PolicyInformation value, which MUST contain the anyPolicy Policy Identifier.
anyPolicy MUST
policyQualifiers NOT RECOMMENDED If present, MUST contain only permitted policyQualifiers from the table below.

No Policy Restrictions (Affiliated CA)
Field	Presence	Contents
`policyIdentifier`	MUST	When the Issuing CA wishes to express that there are no policy restrictions, the Subordinate CA MUST be an Affiliate of the Issuing CA. The Certificate Policies extension MUST contain only a single `PolicyInformation` value, which MUST contain the `anyPolicy` Policy Identifier.
`anyPolicy`	MUST
`policyQualifiers`	NOT RECOMMENDED	If present, MUST contain only permitted `policyQualifiers` from the table below.

無政策限制（適用於關係企業 CA）
欄位	必要性	內容
`policyIdentifier`	應（MUST）	當簽發憑證機構（Issuing CA）欲表示不存在何政策限制時，下屬憑證機構（Subordinate CA）應（MUST）為簽發憑證機構的關係企業。憑證原則擴充欄位應（MUST）僅包含一個 `PolicyInformation` 值，且該值應（MUST）包含 `anyPolicy` 政策識別碼。
`anyPolicy`	應（MUST）
`policyQualifiers`	不建議（NOT RECOMMENDED）	若存在，應（MUST）僅包含下表所列之允許 `policyQualifiers`。

Policy Restricted
Field Presence Contents
policyIdentifier MUST One of the following policy identifiers:
A Reserved Certificate Policy Identifier MUST NOT
anyPolicy MUST NOT The anyPolicy Policy Identifier MUST NOT be present.
Any other identifier MAY If present, MUST be documented by the CA in its Certificate Policy and/or Certification Practice Statement.
policyQualifiers NOT RECOMMENDED If present, MUST contain only permitted policyQualifiers from the table below.

Policy Restricted
Field	Presence	Contents
`policyIdentifier`	MUST	One of the following policy identifiers:
A Reserved Certificate Policy Identifier	MUST NOT
`anyPolicy`	MUST NOT	The `anyPolicy` Policy Identifier MUST NOT be present.
Any other identifier	MAY	If present, MUST be documented by the CA in its Certificate Policy and/or Certification Practice Statement.
`policyQualifiers`	NOT RECOMMENDED	If present, MUST contain only permitted `policyQualifiers` from the table below.

受政策限制
欄位	必要性	內容
`policyIdentifier`	應（MUST）	下列政策識別碼之一：
保留憑證政策識別碼	不得（MUST NOT）
`anyPolicy`	不得（MUST NOT）	`anyPolicy` 政策識別碼不得（MUST NOT）存在。
任何其他識別碼	得（MAY）	若存在，應（MUST）由 CA 載明於其憑證政策（CP）及／或憑證實務作業基準（CPS）中。
`policyQualifiers`	不建議（NOT RECOMMENDED）	若存在，應（MUST）僅包含下表所列之允許 `policyQualifiers`。

Permitted policyQualifiers
Qualifier ID Presence Field Type Contents
id-qt-cps (OID: 1.3.6.1.5.5.7.2.1) MAY IA5String The HTTP or HTTPS URL for the Issuing CA’s Certificate Policies, Certification Practice Statement, Relying Party Agreement, or other pointer to online policy information provided by the Issuing CA.
Any other qualifier MUST NOT - -

Permitted `policyQualifiers`
Qualifier ID	Presence	Field Type	Contents
`id-qt-cps` (OID: 1.3.6.1.5.5.7.2.1)	MAY	`IA5String`	The HTTP or HTTPS URL for the Issuing CA’s Certificate Policies, Certification Practice Statement, Relying Party Agreement, or other pointer to online policy information provided by the Issuing CA.
Any other qualifier	MUST NOT	-	-

允許之 `policyQualifiers`
Qualifier ID	必要性	欄位型別	內容
`id-qt-cps`（OID：1.3.6.1.5.5.7.2.1）	得（MAY）	`IA5String`	簽發憑證機構（Issuing CA）之憑證政策（CP）、憑證實務作業基準（CPS）、信賴憑證者協議（Relying Party Agreement），或其他由簽發憑證機構提供的線上政策資訊之 HTTP 或 HTTPS URL。
任何其他 qualifier	不得（MUST NOT）	-	-