What is a Certificate Policy?
Each certificate authority (CA) has a set of rules about what certificates it is willing to make. These policies are often published on the web pages of the CA’s owner, and may also be electronically embedded in certificates. If your computer successfully validates a certificate, you can safely assume that the certificate’s signing CA has determined that its policies have been followed, if you trust the CA itself. For example, you can assume that the email address contained in a certificate actually belongs to the owner of the certificate’s digital identity.

What is a Trust Policy?
A trust policy is a software process that determines how a certificate can be evaluated (how genuine it is). Not all certificates are created equally. They are created for specific purposes and are evaluated differently. A Trust Policy evaluates a certificate based on how the certificate will be used (signing email, or web authentication, for example).