PKIX Validation.

When replacing the IBM Spectrum Protect Instance Self-signed certificate, with a CA signed certificate, the client to server or server to server validation of the CA signed certificate expects that the OID in the certificate chain must be an exact match. Only IBM Spectrum Protect applies this strict validation. As a result, the certificates generated by our corporate Certificate Authority are accepted by all products EXCEPT by IBM Spectrum Protect client to server / server to server.

Please add an option to disable the additional PKIX validation in order to get around this.

This request is based on the following response I received from the IBM developer:

We would need to add an option to totally disable the additional PKIX validation in order to get around this.

RFC 5280 does say that the OID must be an exact match unless the certificate has a policy mapping which still also needs to match exactly. See sections 6.1.1 and 6.1.2 and in particular figure 4 of the RFC.

The older version of the RFC 3647 states it more clearly:

"When processing a certification path, a CP that is acceptable to the relying party application must be present in every certificate in the path, i.e., in CA-certificates as well as end entity certificates."

https://tools.ietf.org/html/rfc3647#section-3.1

The OID is not a unique identifier for a CA. It is a reference to the validation and usage policy for the certificate.