Netscape Certificate Management System 6.1, Руководство администратора

Страница: 720 / 840

Introduction to Certificate Extensions
720 Netscape Certificate Management System Administrator’s Guide • February 2003
This identifier uniquely identifies the extension. It also determines the ASN.1
type of value in the value field and how the value is interpreted. That is, when
an extension appears in a certificate, the OID appears as the extension ID field
(
extnID
) and the corresponding ASN.1 encoded structure appears as the value
of the octet string (
extnValue
); see the examples in “Sample Certificate
Extensions” on page 721.
• A flag or boolean field called
critical
.
The value, which can be either true or false, assigned to this field indicates
whether the extension is critical or noncritical to the certificate.
❍
If the extension is critical and the certificate is sent to an application that
does not understand the extension (based on the extension’s ID), the
application must reject the certificate.
❍
If the extension is not critical and the certificate is sent to an application
that does not understand the extension (based on the extension’s ID), the
application can ignore the extension and accept the certificate.
• An octet string containing the DER encoding of the value of the extension.
Typically, the application receiving the certificate checks the extension ID to
determine if it can recognize the ID. If it can, it uses the extension ID to
determine the type of value used.
Examples of standard extensions defined in the X.509 v3 standard include the
following:
• Authority Key Identifier Extension—an extension for identifying the certificate
authority’s public key (the key used to sign the certificate).
• Subject Key Identifier Extension—an extension for identifying the subject’s
public key (the key being certified).
Note that not all applications support certificates with version 3 extensions.
Applications that do support these extensions may not be able to interpret some or
all of these specific extensions.