Check Certificate Policies in S/MIME intermediates

[robstradling]

For this Server Authentication intermediate, pkilint returns a cabf.serverauth.ca_missing_reserved_policy_oid finding.

For this Email Protection intermediate, pkilint doesn't currently detect what is essentially the same problem - namely that, per SBR 7.1.6.3, one or more reserved policy OIDs and/or anyPolicy must be included in the Certificate Policies extension.

[CBonnell]

Thanks for reporting this, @robstradling. Currently, pkilint does not have a SMIME ICA-specific linter (the SMIME linter only covers end-entity certificates).

I am planning to tackle SMIME ICA linting if/when the SMBR certificate profiles are updated in a manner similar to servercert ballot SC-62, which will allow for greater reuse of existing serverauth validators as opposed to writing the validators from scratch.

I'll keep this issue open for tracking this specific enhancement.