Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE, Руководство администратора, Страница: 452 / 512

Appendix A. Certificate and CRL Extensions
432
A.3.5.2. Criticality
PKIX recommends that this extension be marked noncritical and that it be supported for all certificates.
A.3.5.3. Discussion
This extension defines how CRL information is obtained. It should be used if the system is configured
to use CRL issuing points.
If the extension contains a
DistributionPointName
with a type set to URI, the URI is assumed to
be a pointer to the current CRL for the specified revocation reasons and will be issued by the named
cRLIssuer
. The expected values for the URI are those defined for the Subject Alternative Name
extension. If the
distributionPoint
omits reasons, the CRL must include revocations for all
reasons. If the
distributionPoint
omits
cRLIssuer
, the CRL must be issued by the CA that
issued the certificate.
PKIX recommends that this extension be supported by CAs and applications.
A.3.6. extKeyUsage
A.3.6.1. OID
2.5.29.37
A.3.6.2. Criticality
If this extension is marked critical, the certificate must be used for one of the indicated purposes only.
If it is not marked critical, it is treated as an advisory field that may be used to identify keys but does
not restrict the use of the certificate to the indicated purposes.
A.3.6.3. Discussion
The Extended Key Usage extension indicates the purposes for which the certified public key may be
used. These purposes may be in addition to or in place of the basic purposes indicated in the Key
Usage extension.
The Extended Key Usage extension must include
OCSP Signing
in an OCSP responder's certificate
unless the CA signing key that signed the certificates validated by the responder is also the OCSP
signing key. The OCSP responder's certificate must be issued directly by the CA that signs certificates
the responder will validate.
The Key Usage, Extended Key Usage, and Basic Constraints extensions act together to define the
purposes for which the certificate is intended to be used. Applications can use these extensions to
disallow the use of a certificate in inappropriate contexts.
Table A.1, “PKIX Extended Key Usage Extension Uses”
lists the uses defined by PKIX for this
extension, and
Table A.2, “Private Extended Key Usage Extension Uses”
lists uses privately defined
by Netscape.
Use OID
Server authentication 1.3.6.1.5.5.7.3.1
Client authentication 1.3.6.1.5.5.7.3.2