Netscape Certificate Management System 6.1, Administrator'S Manual

Page: 736 / 840

Introduction to CRL Extensions
736 Netscape Certificate Management System Administrator’s Guide • February 2003
Typically, the application receiving the CRL checks the extension ID to
determine if it can recognize the ID. If it can, it uses the extension ID to
determine the type of value used.
Sample CRL and CRL Entry Extensions
The following is an example of the section of a CRL containing X.509 v2 extensions.
(CMS can display CRLs in human-readable format, as shown here.) As shown in
the example, CRL extensions appear in sequence and only one instance of a
particular extension may appear in a particular CRL; for example, a CRL may
contain only one authority key identifier extension. However, CRL-entry
extensions appear in appropriate entries in the CRL.
Certificate Revocation List:
Data:
Version: v2
...
Extensions:
Identifier: Authority Key Identifier
Critical: no
Key Identifier:
2c:22:c6:ae:4e:4b:91:c7:fb:4c:cc:ae:84:e8:aa:5b:46:6a:a0:ad
Revoked Certificates:
Serial Number: 0x12
Revocation Date: Tuesday, December 15, 1998 5:20:42 AM
Extensions:
Identifier: Revocation Reason - 2.5.29.21
Critical: no
Reason: Key_Compromise
Serial Number: 0x11
Revocation Date: Wednesday, December 16, 1998 4:51:54 AM
Extensions:
Identifier: Revocation Reason - 2.5.29.21
Critical: no
Reason: CA_Compromise
Serial Number: 0x10
Revocation Date: Thursday, December 17, 1998 2:37:24 AM
Extensions:
Identifier: Revocation Reason - 2.5.29.21
Critical: no
Reason: Key_Compromise