Netscape Certificate Management System 6.0, Руководство пользователя

Страница: 330 / 377

Introduction to Certificate Extensions
330 Netscape Certificate Management System Plug-Ins Guide • March 2002
Structure of Certificate Extensions
In RFC 2459, an X.509 certificate extension is defined as follows:
Extension ::= SEQUENCE {
extnID OBJECT IDENTIFIER,
critical BOOLEAN DEFAULT FALSE,
extnValue OCTET STRING }
Which means, a certificate extension consists of the following:
• The object identifier (OID) for the extension; see Appendix B, “Object
Identifiers.”
This identifier uniquely identifies the extension. It also determines the ASN.1
type of value in the value field and how the value is interpreted. That is, when
an extension appears in a certificate, the OID appears as the extension ID field
(
extnID
) and the corresponding ASN.1 encoded structure appears as the value
of the octet string (
extnValue
); see the examples in “Sample Certificate
Extensions” on page 331.
• A flag or boolean field called
critical
.
The value, which can be either true or false, assigned to this field indicates
whether the extension is critical or noncritical to the certificate.
❍
If the extension is critical and the certificate is sent to an application that
does not understand the extension (based on the extension’s ID), the
application must reject the certificate.
❍
If the extension is not critical and the certificate is sent to an application
that does not understand the extension (based on the extension’s ID), the
application can ignore the extension and accept the certificate.
• An octet string containing the DER encoding of the value of the extension.
Typically, the application receiving the certificate checks the extension ID to
determine if it can recognize the ID. If it can, it uses the extension ID to
determine the type of value used.
Examples of standard extensions defined in the X.509 v3 standard include the
following:
• Authority Key Identifier Extension—an extension for identifying the certificate
authority’s public key (the key used to sign the certificate).
• Subject Key Identifier Extension—an extension for identifying the subject’s
public key (the key being certified).