Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE, Руководство администратора, Страница: 450 / 512

Appendix A. Certificate and CRL Extensions
430
A.3.1.2. Criticality
This extension must be noncritical.
A.3.1.3. Discussion
The Authority Information Access extension indicates how and where to access information about
the issuer of the certificate. The extension contains an
accessMethod
and an
accessLocation
field.
accessMethod
specifies by OID the type and format of information about the issuer named in
accessLocation
.
PKIX Part 1 defines one
accessMethod
(
id-ad-caIssuers
) to get a list of CAs that have
issued certificates higher in the CA chain than the issuer of the certificate using the extension. The
accessLocation
field then typically contains a URL indicating the location and protocol (LDAP,
HTTP, or FTP) used to retrieve the list.
The Online Certificate Status Protocol (RFC 2560), available at
http://www.ietf.org/rfc/rfc2560.txt
,
defines an
accessMethod
(
id-ad-ocsp
) for using OCSP to verify certificates. The
accessLocation
field then contains a URL indicating the location and protocol used to access an OCSP responder that
can validate the certificate.
A.3.2. The authorityKeyIdentifier
A.3.2.1. OID
2.5.29.35
A.3.2.2. Criticality
This extension is always noncritical and is always evaluated.
A.3.2.3. Discussion
The Authority Key Identifier extension identifies the public key corresponding to the private key used to
sign a certificate. This extension is useful when an issuer has multiple signing keys.
The extension consists of one or both of the following:
• An explicit key identifier, set in the
keyIdentifier
field
• An issuer, set in the
authorityCertIssuer
field, and serial number, set in the
authorityCertSerialNumber
field, identifying a certificate
If the
keyIdentifier
field exists, it is used to select the certificate with a matching
subjectKeyIdentifier
extension. If the
authorityCertIssuer
and
authorityCertSerialNumber
fields are present, then they are used to identify the correct
certificate by
issuer
and
serialNumber
.
If this extension is not present, then the issuer name alone is used to identify the issuer certificate.
PKIX Part 1 requires this extension for all certificates except self-signed root CA certificates. Where
a key identifier has not been established, PKIX recommends that the
authorityCertIssuer
and
authorityCertSerialNumber
fields be specified. These fields permit construction of a complete
certificate chain by matching the
SubjectName
and
CertificateSerialNumber
fields in the