A question concerning test case 4.12.10

[Ville Heikkala <heikkala@ssh.com>]

Dear all,

I have some problems trying to understand why the path in 4.12.10 should
not validate succesfully. Comparing to 4.12.9, where the path should
validate (assuming initial-policy-set includes NIST-test-policy-1), the
first difference in the paths (starting from Trust Anchor Root
Certificate) occurs in the self-signed CA certificates of subCA2.  They
are both of the Base Intermediate Certificate base type, self-signed by
inhibitAnyPolicy1 subCA2, assert anyPolicy (at an acceptable distance from
inhibitAnyPolicy1 CA Cert, which has inhibitAnyPolicy set to 1). As far as
I can tell, the only differences are in the keyUsageExtension,
SerialNumber, and key information. Then, in 4.12.9, this subCA2
self-signed cert is used to sign the EE cert, and the path should validate
succesfully. But why should the path in 4.12.10, which ends at the subCA2
self-signed cert itself, not validate?

Having studied RFC 3280, I have also not found a reason why 4.12.10 should
not validate. What am I missing here?

Thanks,
Ville Heikkala.