Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 494 / 554

Appendix A. Certificate and CRL Extensions
472
A.3.16.3. Discussion
The Subject Key Identifier extension identifies the public key certified by this certificate. This extension
provides a way of distinguishing public keys if more than one is available for a given subject name.
The value of this extension should be calculated by performing a SHA-1 hash of the certificate's DER-
encoded
subjectPublicKey
, as recommended by PKIX. The Subject Key Identifier extension is
used in conjunction with the Authority Key Identifier extension for CA certificates. If the CA certificate
has a Subject Key Identifier extension, the key identifier in the Authority Key Identifier extension of the
certificate being verified should match the key identifier of the CA's Subject Key Identifier extension. It
is not necessary for the verifier to recompute the key identifier in this case.
PKIX Part 1 requires this extension for all CA certificates and recommends it for all other certificates.
A.4. Introduction to CRL Extensions
Since its initial publication, the X.509 standard for CRL formats has been amended to include
additional information within a CRL. This information is added through CRL extensions.
The extensions defined by ANSI X9 and ISO/IEC/ITU for X.509 CRLs [X.509] [X9.55] allow additional
attributes to be associated with CRLs. The
Internet X.509 Public Key Infrastructure Certificate and
CRL Profile
, available at
http://www.ietf.org/rfc/rfc3280.txt
, recommends a set of extensions to be used
in CRLs. These extensions are called
standard CRL extensions
.
The standard also allows custom extensions to be created and included in CRLs. These extensions
are called
private
,
proprietary
, or
custom
CRL extensions and carry information unique to an
organization or business. Applications may not able to validate CRLs that contain private critical
extensions, so it is not recommended that custom extensions be used in a general context.
NOTE
Abstract Syntax Notation One (ASN.1) and Distinguished Encoding Rules (DER)
standards are specified in the CCITT Recommendations X.208 and X.209. For a quick
summary of ASN.1 and DER, see
A Layman's Guide to a Subset of ASN.1, BER, and
DER
, which is available at RSA Laboratories' web site,
http://www.rsa.com
.
A.4.1. Structure of CRL Extensions
A CRL extension consists of the following parts:
• The object identifier (OID) for the extension. This identifier uniquely identifies the extension. It
also determines the ASN.1 type of value in the value field and how the value is interpreted. When
an extension appears in a CRL, the OID appears as the extension ID field (
extnID
) and the
corresponding ASN.1 encoded structure appears as the value of the octet string (
extnValue
);
examples are shown in
Section A.1.2, “Sample Certificate Extensions”
.
• A flag or boolean field called
critical
.
The
true
or
false
value assigned to this field indicates whether the extension is critical or
noncritical to the CRL.
• If the extension is critical and the CRL is sent to an application that does not understand the
extension based on the extension's ID, the application must reject the CRL.