Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 495 / 554

Sample CRL and CRL Entry Extensions
473
• If the extension is not critical and the CRL is sent to an application that does not understand the
extension based on the extension's ID, the application can ignore the extension and accept the
CRL.
• An octet string containing the DER encoding of the value of the extension.
The application receiving the CRL checks the extension ID to determine if it can recognize the ID. If it
can, it uses the extension ID to determine the type of value used.
A.4.2. Sample CRL and CRL Entry Extensions
The following is an example of the section of a CRL containing X.509 v2 extensions. The Certificate
System can display CRLs in readable pretty-print format, as shown here. As shown in the example,
CRL extensions appear in sequence and only one instance of a particular extension may appear per
CRL; for example, a CRL may contain only one Authority Key Identifier extension. However, CRL-entry
extensions appear in appropriate entries in the CRL.
Certificate Revocation List:
Data:
Version: v2
...
Extensions:
Identifier: Authority Key Identifier
Critical: no
Key Identifier:
2c:22:c6:ae:4e:4b:91:c7:fb:4c:cc:ae:84:e8:aa:5b:46:6a:a0:ad
Revoked Certificates:
Serial Number: 0x12
Revocation Date: Tuesday, December 15, 1998 5:20:42 AM
Extensions:
Identifier: Revocation Reason - 2.5.29.21
Critical: no
Reason: Key_Compromise
Serial Number: 0x11
Revocation Date: Wednesday, December 16, 1998 4:51:54 AM
Extensions:
Identifier: Revocation Reason - 2.5.29.21
Critical: no
Reason: CA_Compromise
Serial Number: 0x10
Revocation Date: Thursday, December 17, 1998 2:37:24 AM
Extensions:
Identifier: Revocation Reason - 2.5.29.21
Critical: no
Reason: Key_Compromise
Serial Number: 0xA
Revocation Date: Wednesday, November 25, 1998 5:11:18 AM
Extensions:
Identifier: Revocation Reason - 2.5.29.21
Critical: no
Reason: Affiliation_Changed
...