Netscape Certificate Management System 6.2, Administrator'S Manual

Page: 769 / 874

Introduction to CRL Extensions
Appendix G Certificate and CRL Extensions 769
The standard also suggests that you can define your own extensions and include
them in CRLs you issue. These extensions are called private, proprietary, or custom
CRL extensions and they carry information unique to your organization or
business. Keep in mind that applications may not able to validate CRLs that
contain private, critical extensions, thus preventing the use of these CRLs in a
general context.
Structure of CRL Extensions
A CRL extension consists of the following:
• The object identifier (OID) for the extension; see Appendix H, “Object
Identifiers.”
This identifier uniquely identifies the extension. It also determines the ASN.1
type of value in the value field and how the value is interpreted. That is, when
an extension appears in a CRL, the OID appears as the extension ID field
(
extnID
) and the corresponding ASN.1 encoded structure appears as the value
of the octet string (
extnValue
); see the examples in “Sample Certificate
Extensions” on page 755.
• A flag or boolean field called
critical
.
The
true
or
false
value assigned to this field indicates whether the extension
is critical (true) or noncritical (false) to the CRL.
❍
If the extension is critical and the CRL is sent to an application that does
not understand the extension (based on the extension’s ID), the application
must reject the CRL.
❍
If the extension is not critical and the CRL is sent to an application that
does not understand the extension (based on the extension’s ID), the
application can ignore the extension and accept the CRL.
• An octet string containing the DER encoding of the value of the extension.
NOTE
Some explanations in this chapter make reference to Abstract
Syntax Notation One (ASN.1) and Distinguished Encoding Rules
(DER). These are specified in the CCITT Recommendations X.208
and X.209. For a quick summary of ASN.1 and DER, see A Layman’s
Guide to a Subset of ASN.1, BER, and DER, which is available at RSA
Laboratories’ web site (
http://www.rsa.com
).