Netscape Certificate Management System 6.1, Administrator'S Manual

Page: 725 / 840

Standard X.509 v3 Certificate Extensions
Appendix G Certificate and CRL Extensions 725
by matching the
SubjectName
and
CertificateSerialNumber
fields in the
issuer’s certificate against the
authortiyCertIssuer
and
authorityCertSerialNumber
in the
AuthorityKeyIdentifier
extension of the
subject certificate.
CMS Version Support
Supported since CMS 4.1. Refer to “AuthorityKeyIdentifierExt” on page 513.
Note that CMS does not use or support the
authorityCertSerialNumber
field in
the Authority Key Identifier extension.
basicConstraints
OID
2.5.29.19
Criticality
PKIX Part 1 requires that this extension be marked critical. This extension is
evaluated regardless of its criticality.
Discussion
This extension is used during the certificate chain verification process to identify
CA certificates and to apply certificate chain path length constraints. The
cA
component should be set to true for all CA certificates. PKIX recommends that this
extension should not appear in end-entity certificates.
If the
pathLenConstraint
component is present, its value must be greater than the
number of CA certificates that have been processed so far (starting with the
end-entity certificate and moving up the chain). If
pathLenConstraint
is omitted,
then all of the higher level CA certificates in the chain must not include this
component when the extension is present.
See “CA Certificates and Extension Interactions” on page 742 regarding the
interaction of
the
this extension with the Netscape Certificate Type extension.
CMS Version Support
Supported since CMS 4.1. Refer to “BasicConstraintsExt” on page 514.
certificatePolicies
OID
2.5.29.32