AuthorityKeyIdentifier Rule
Chapter
7
CRL Extension Plug-in Modules
281
AuthorityKeyIdentifier Rule
The
AuthorityKeyIdentifier
rule enables you to configure a Certificate Manager
to set the Authority Key Identifier Extension defined in X.509 and PKIX standard RFC
2459 (see
http://www.ietf.org/rfc/rfc2459.txt
) in CRLs. The extension is
used to identify the public key that corresponds to the private key used by a CA to
sign CRLs.
The PKIX standard recommends that the CA must include this extension in all
CRLs it issues. Therefore, you should consider adding this extension to all CRLs
issued by the Certificate Manager. The reason for this is that in certain situations, a
CA’s public key may change (for example, when the key gets updated) or the CA
may have multiple signing keys (either because of multiple concurrent key pairs or
because of key changeover). In these cases, the CA ends up with more than one key
pair. When verifying a signature on a certificate, other applications need to know
which key was used in the signature. The extension, if present in a certificate,
enables applications (those that can use the extension) to identify the correct key to
use in situations when multiple keys exist; the extension specifies the public key to
be used to verify the signature on the CRL.
Table 7-1
Default CRL extension modules
Plug-in module name
Function
AuthorityKeyIdentifier
Sets the Authority Key Identifier extension in CRLs. For details, see
“AuthorityKeyIdentifier Rule” on page 281.
CRLNumber
Sets the CRL Number extension in CRLs. For details, see “CRLNumber
Rule” on page 283.
CRLReason
Sets the Reason Code extension in CRL entries. For details, see
“CRLReason Rule” on page 284.
HoldInstruction
Sets the Hold Instruction Code extension in CRL entries. For details, see
“HoldInstruction Rule” on page 286.
InvalidityDate
Sets the Invalidity Date extension in CRL entries. For details, see
“InvalidityDate Rule” on page 287.
IssuerAlternativeName
Sets the Issuer Alternative Name extension in CRLs. For details, see
“IssuerAlternativeName Rule” on page 289.
IssuingDistributionPoint
Sets the Issuing Distribution Point extension in CRLs. For details, see
“IssuingDistributionPoint Rule” on page 293.
Summary of Contents for Certificate Management System 6.01
Page 1: ...Plug Ins Guide Netscape Certificate Management System Version6 01 May 2002...
Page 10: ...10 Netscape Certificate Management System Plug Ins Guide May 2002...
Page 62: ...Enrollment Forms 62 Netscape Certificate Management System Plug Ins Guide May 2002...
Page 308: ...NTEventLog Plug in Module 308 Netscape Certificate Management System Plug Ins Guide May 2002...
