4.1.2.5.1 UTCTime
The universal time type, UTCTime, is a standard ASN.1 type intended
for representation of dates and time. UTCTime specifies the year
through the two low order digits and time is specified to the
precision of one minute or one second. UTCTime includes either Z
(for Zulu, or Greenwich Mean Time) or a time differential.
For the purposes of this profile, UTCTime values MUST be expressed
Greenwich Mean Time (Zulu) and MUST include seconds (i.e., times are
YYMMDDHHMMSSZ), even where the number of seconds is zero. Conforming
systems MUST interpret the year field (YY) as follows:
Where YY is greater than or equal to 50, the year SHALL be
interpreted as 19YY; and
Where YY is less than 50, the year SHALL be interpreted as 20YY.
4.1.2.5.2 GeneralizedTime
The generalized time type, GeneralizedTime, is a standard ASN.1 type
for variable precision representation of time. Optionally, the
GeneralizedTime field can include a representation of the time
differential between local and Greenwich Mean Time.
For the purposes of this profile, GeneralizedTime values MUST be
expressed Greenwich Mean Time (Zulu) and MUST include seconds (i.e.,
times are YYYYMMDDHHMMSSZ), even where the number of seconds is zero.
GeneralizedTime values MUST NOT include fractional seconds.
4.1.2.6 Subject
The subject field identifies the entity associated with the public
key stored in the subject public key field. The subject name MAY be
carried in the subject field and/or the subjectAltName extension. If
the subject is a CA (e.g., the basic constraints extension, as
discussed in 4.2.1.10, is present and the value of cA is TRUE), then
the subject field MUST be populated with a non-empty distinguished
name matching the contents of the issuer field (section 4.1.2.4) in
all certificates issued by the subject CA. If the subject is a CRL
issuer (e.g., the key usage extension, as discussed in 4.2.1.3, is
present and the value of cRLSign is TRUE) then the subject field MUST
be populated with a non-empty distinguished name matching the
contents of the issuer field (section 4.1.2.4) in all CRLs issued by
the subject CRL issuer. If subject naming information is present
only in the subjectAltName extension (e.g., a key bound only to an
email address or URI), then the subject name MUST be an empty
sequence and the subjectAltName extension MUST be critical.
Where it is non-empty, the subject field MUST contain an X.500
distinguished name (DN). The DN MUST be unique for each subject
entity certified by the one CA as defined by the issuer name field.
A CA MAY issue more than one certificate with the same DN to the same
subject entity.
The subject name field is defined as the X.501 type Name.
Implementation requirements for this field are those defined for the
issuer field (section 4.1.2.4). When encoding attribute values of
type DirectoryString, the encoding rules for the issuer field MUST be
implemented. Implementations of this specification MUST be prepared
to receive subject names containing the attribute types required for
the issuer field. Implementations of this specification SHOULD be
prepared to receive subject names containing the recommended
attribute types for the issuer field. The syntax and associated
object identifiers (OIDs) for these attribute types are provided in
the ASN.1 modules in Appendix A. Implementations of this
specification MAY use these comparison rules to process unfamiliar
attribute types (i.e., for name chaining). This allows
implementations to process certificates with unfamiliar attributes in
the subject name.
In addition, legacy implementations exist where an RFC822 name is
embedded in the subject distinguished name as an EmailAddress
attribute. The attribute value for EmailAddress is of type IA5String
to permit inclusion of the character '@', which is not part of the
PrintableString character set. EmailAddress attribute values are not
case sensitive (e.g., "fanfeedback@redsox.com" is the same as
"FANFEEDBACK@REDSOX.COM").
Conforming implementations generating new certificates with
electronic mail addresses MUST use the rfc822Name in the subject
alternative name field (section 4.2.1.7) to describe such identities.
Simultaneous inclusion of the EmailAddress attribute in the subject
distinguished name to support legacy implementations is deprecated
but permitted.
4.1.2.7 Subject Public Key Info
This field is used to carry the public key and identify the algorithm
with which the key is used (e.g., RSA, DSA, or Diffie-Hellman). The
algorithm is identified using the AlgorithmIdentifier structure
specified in section 4.1.1.2. The object identifiers for the
supported algorithms and the methods for encoding the public key
materials (public key and parameters) are specified in [PKIXALGS].
4.1.2.8 Unique Identifiers
These fields MUST only appear if the version is 2 or 3 (section
4.1.2.1). These fields MUST NOT appear if the version is 1. The
subject and issuer unique identifiers are present in the certificate
to handle the possibility of reuse of subject and/or issuer names
over time. This profile RECOMMENDS that names not be reused for
different entities and that Internet certificates not make use of
unique identifiers. CAs conforming to this profile SHOULD NOT
generate certificates with unique identifiers. Applications
conforming to this profile SHOULD be capable of parsing unique
identifiers.
4.1.2.9 Extensions
This field MUST only appear if the version is 3 (section 4.1.2.1).
If present, this field is a SEQUENCE of one or more certificate
extensions. The format and content of certificate extensions in the
Internet PKI is defined in section 4.2.
4.2 Certificate Extensions
The extensions defined for X.509 v3 certificates provide methods for
associating additional attributes with users or public keys and for
managing a certification hierarchy. The X.509 v3 certificate format
also allows communities to define private extensions to carry
information unique to those communities. Each extension in a
certificate is designated as either critical or non-critical. A
certificate using system MUST reject the certificate if it encounters
a critical extension it does not recognize; however, a non-critical
extension MAY be ignored if it is not recognized. The following
sections present recommended extensions used within Internet
certificates and standard locations for information. Communities may
elect to use additional extensions; however, caution ought to be
exercised in adopting any critical extensions in certificates which
might prevent use in a general context.
Each extension includes an OID and an ASN.1 structure. When an
extension appears in a certificate, the OID appears as the field
extnID and the corresponding ASN.1 encoded structure is the value of
the octet string extnValue. A certificate MUST NOT include more than
one instance of a particular extension. For example, a certificate
may contain only one authority key identifier extension (section
4.2.1.1). An extension includes the boolean critical, with a default
value of FALSE. The text for each extension specifies the acceptable
values for the critical field.
Conforming CAs MUST support key identifiers (sections 4.2.1.1 and
4.2.1.2), basic constraints (section 4.2.1.10), key usage (section
4.2.1.3), and certificate policies (section 4.2.1.5) extensions. If
the CA issues certificates with an empty sequence for the subject
field, the CA MUST support the subject alternative name extension
(section 4.2.1.7). Support for the remaining extensions is OPTIONAL.
Conforming CAs MAY support extensions that are not identified within
this specification; certificate issuers are cautioned that marking
such extensions as critical may inhibit interoperability.
At a minimum, applications conforming to this profile MUST recognize
the following extensions: key usage (section 4.2.1.3), certificate
policies (section 4.2.1.5), the subject alternative name (section
4.2.1.7), basic constraints (section 4.2.1.10), name constraints
(section 4.2.1.11), policy constraints (section 4.2.1.12), extended
key usage (section 4.2.1.13), and inhibit any-policy (section
4.2.1.15).
In addition, applications conforming to this profile SHOULD recognize
the authority and subject key identifier (sections 4.2.1.1 and
4.2.1.2), and policy mapping (section 4.2.1.6) extensions.
4.2.1 Standard Extensions
This section identifies standard certificate extensions defined in
[X.509] for use in the Internet PKI. Each extension is associated
with an OID defined in [X.509]. These OIDs are members of the id-ce
arc, which is defined by the following:
id-ce OBJECT IDENTIFIER ::= { joint-iso-ccitt(2) ds(5) 29 }
4.2.1.1 Authority Key Identifier
The authority key identifier extension provides a means of
identifying the public key corresponding to the private key used to
sign a certificate. This extension is used where an issuer has
multiple signing keys (either due to multiple concurrent key pairs or
due to changeover). The identification MAY be based on either the
key identifier (the subject key identifier in the issuer's
certificate) or on the issuer name and serial number.
The keyIdentifier field of the authorityKeyIdentifier extension MUST
be included in all certificates generated by conforming CAs to
facilitate certification path construction. There is one exception;
where a CA distributes its public key in the form of a "self-signed"
certificate, the authority key identifier MAY be omitted. The
signature on a self-signed certificate is generated with the private
key associated with the certificate's subject public key. (This
proves that the issuer possesses both the public and private keys.)
In this case, the subject and authority key identifiers would be
identical, but only the subject key identifier is needed for
certification path building.
The value of the keyIdentifier field SHOULD be derived from the
public key used to verify the certificate's signature or a method
that generates unique values. Two common methods for generating key
identifiers from the public key, and one common method for generating
unique values, are described in section 4.2.1.2. Where a key
identifier has not been previously established, this specification
RECOMMENDS use of one of these methods for generating keyIdentifiers.
Where a key identifier has been previously established, the CA SHOULD
use the previously established identifier.
This profile RECOMMENDS support for the key identifier method by all
certificate users.
This extension MUST NOT be marked critical.
id-ce-authorityKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 35 }
AuthorityKeyIdentifier ::= SEQUENCE {
keyIdentifier [0] KeyIdentifier OPTIONAL,
authorityCertIssuer [1] GeneralNames OPTIONAL,
authorityCertSerialNumber [2] CertificateSerialNumber OPTIONAL }
KeyIdentifier ::= OCTET STRING
4.2.1.2 Subject Key Identifier
The subject key identifier extension provides a means of identifying
certificates that contain a particular public key.
To facilitate certification path construction, this extension MUST
appear in all conforming CA certificates, that is, all certificates
including the basic constraints extension (section 4.2.1.10) where
the value of cA is TRUE. The value of the subject key identifier
MUST be the value placed in the key identifier field of the Authority
Key Identifier extension (section 4.2.1.1) of certificates issued by
the subject of this certificate.
For CA certificates, subject key identifiers SHOULD be derived from
the public key or a method that generates unique values. Two common
methods for generating key identifiers from the public key are:
(1) The keyIdentifier is composed of the 160-bit SHA-1 hash of the
value of the BIT STRING subjectPublicKey (excluding the tag,
length, and number of unused bits).
(2) The keyIdentifier is composed of a four bit type field with
the value 0100 followed by the least significant 60 bits of the
SHA-1 hash of the value of the BIT STRING subjectPublicKey
(excluding the tag, length, and number of unused bit string bits).
One common method for generating unique values is a monotonically
increasing sequence of integers.
For end entity certificates, the subject key identifier extension
provides a means for identifying certificates containing the
particular public key used in an application. Where an end entity
has obtained multiple certificates, especially from multiple CAs, the
subject key identifier provides a means to quickly identify the set
of certificates containing a particular public key. To assist
applications in identifying the appropriate end entity certificate,
this extension SHOULD be included in all end entity certificates.
For end entity certificates, subject key identifiers SHOULD be
derived from the public key. Two common methods for generating key
identifiers from the public key are identified above.
Where a key identifier has not been previously established, this
specification RECOMMENDS use of one of these methods for generating
keyIdentifiers. Where a key identifier has been previously
established, the CA SHOULD use the previously established identifier.
This extension MUST NOT be marked critical.
id-ce-subjectKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 14 }
SubjectKeyIdentifier ::= KeyIdentifier
4.2.1.3 Key Usage
The key usage extension defines the purpose (e.g., encipherment,
signature, certificate signing) of the key contained in the
certificate. The usage restriction might be employed when a key that
could be used for more than one operation is to be restricted. For
example, when an RSA key should be used only to verify signatures on
objects other than public key certificates and CRLs, the
digitalSignature and/or nonRepudiation bits would be asserted.
Likewise, when an RSA key should be used only for key management, the
keyEncipherment bit would be asserted.
This extension MUST appear in certificates that contain public keys
that are used to validate digital signatures on other public key
certificates or CRLs. When this extension appears, it SHOULD be
marked critical.
id-ce-keyUsage OBJECT IDENTIFIER ::= { id-ce 15 }
KeyUsage ::= BIT STRING {
digitalSignature (0),
nonRepudiation (1),
keyEncipherment (2),
dataEncipherment (3),
keyAgreement (4),
keyCertSign (5),
cRLSign (6),
encipherOnly (7),
decipherOnly (8) }
Bits in the KeyUsage type are used as follows:
The digitalSignature bit is asserted when the subject public key
is used with a digital signature mechanism to support security
services other than certificate signing (bit 5), or CRL signing
(bit 6). Digital signature mechanisms are often used for entity
authentication and data origin authentication with integrity.
The nonRepudiation bit is asserted when the subject public key is
used to verify digital signatures used to provide a non-
repudiation service which protects against the signing entity
falsely denying some action, excluding certificate or CRL signing.
In the case of later conflict, a reliable third party may
determine the authenticity of the signed data.
Further distinctions between the digitalSignature and
nonRepudiation bits may be provided in specific certificate
policies.
The keyEncipherment bit is asserted when the subject public key is
used for key transport. For example, when an RSA key is to be
used for key management, then this bit is set.
The dataEncipherment bit is asserted when the subject public key
is used for enciphering user data, other than cryptographic keys.
The keyAgreement bit is asserted when the subject public key is
used for key agreement. For example, when a Diffie-Hellman key is
to be used for key management, then this bit is set.
The keyCertSign bit is asserted when the subject public key is
used for verifying a signature on public key certificates. If the
keyCertSign bit is asserted, then the cA bit in the basic
constraints extension (section 4.2.1.10) MUST also be asserted.
The cRLSign bit is asserted when the subject public key is used
for verifying a signature on certificate revocation list (e.g., a
CRL, delta CRL, or an ARL). This bit MUST be asserted in
certificates that are used to verify signatures on CRLs.
The meaning of the encipherOnly bit is undefined in the absence of
the keyAgreement bit. When the encipherOnly bit is asserted and
the keyAgreement bit is also set, the subject public key may be
used only for enciphering data while performing key agreement.
The meaning of the decipherOnly bit is undefined in the absence of
the keyAgreement bit. When the decipherOnly bit is asserted and
the keyAgreement bit is also set, the subject public key may be
used only for deciphering data while performing key agreement.
This profile does not restrict the combinations of bits that may be
set in an instantiation of the keyUsage extension. However,
appropriate values for keyUsage extensions for particular algorithms
are specified in [PKIXALGS].
4.2.1.4 Private Key Usage Period
This extension SHOULD NOT be used within the Internet PKI. CAs
conforming to this profile MUST NOT generate certificates that
include a critical private key usage period extension.
The private key usage period extension allows the certificate issuer
to specify a different validity period for the private key than the
certificate. This extension is intended for use with digital
signature keys. This extension consists of two optional components,
notBefore and notAfter. The private key associated with the
certificate SHOULD NOT be used to sign objects before or after the
times specified by the two components, respectively. CAs conforming
to this profile MUST NOT generate certificates with private key usage
period extensions unless at least one of the two components is
present and the extension is non-critical.
Where used, notBefore and notAfter are represented as GeneralizedTime
and MUST be specified and interpreted as defined in section
4.1.2.5.2.
id-ce-privateKeyUsagePeriod OBJECT IDENTIFIER ::= { id-ce 16 }
PrivateKeyUsagePeriod ::= SEQUENCE {
notBefore [0] GeneralizedTime OPTIONAL,
notAfter [1] GeneralizedTime OPTIONAL }
4.2.1.5 Certificate Policies
The certificate policies extension contains a sequence of one or more
policy information terms, each of which consists of an object
identifier (OID) and optional qualifiers. Optional qualifiers, which
MAY be present, are not expected to change the definition of the
policy.
In an end entity certificate, these policy information terms indicate
the policy under which the certificate has been issued and the
purposes for which the certificate may be used. In a CA certificate,
these policy information terms limit the set of policies for
certification paths which include this certificate. When a CA does
not wish to limit the set of policies for certification paths which
include this certificate, it MAY assert the special policy anyPolicy,
with a value of { 2 5 29 32 0 }.
Applications with specific policy requirements are expected to have a
list of those policies which they will accept and to compare the
policy OIDs in the certificate to that list. If this extension is
critical, the path validation software MUST be able to interpret this
extension (including the optional qualifier), or MUST reject the
certificate.
To promote interoperability, this profile RECOMMENDS that policy
information terms consist of only an OID. Where an OID alone is
insufficient, this profile strongly recommends that use of qualifiers
be limited to those identified in this section. When qualifiers are
used with the special policy anyPolicy, they MUST be limited to the
qualifiers identified in this section.
This specification defines two policy qualifier types for use by
certificate policy writers and certificate issuers. The qualifier
types are the CPS Pointer and User Notice qualifiers.
The CPS Pointer qualifier contains a pointer to a Certification
Practice Statement (CPS) published by the CA. The pointer is in the
form of a URI. Processing requirements for this qualifier are a
local matter. No action is mandated by this specification regardless
of the criticality value asserted for the extension.
User notice is intended for display to a relying party when a
certificate is used. The application software SHOULD display all
user notices in all certificates of the certification path used,
except that if a notice is duplicated only one copy need be
displayed. To prevent such duplication, this qualifier SHOULD only
be present in end entity certificates and CA certificates issued to
other organizations.
The user notice has two optional fields: the noticeRef field and the
explicitText field.
The noticeRef field, if used, names an organization and
identifies, by number, a particular textual statement prepared by
that organization. For example, it might identify the
organization "CertsRUs" and notice number 1. In a typical
implementation, the application software will have a notice file
containing the current set of notices for CertsRUs; the
application will extract the notice text from the file and display
it. Messages MAY be multilingual, allowing the software to select
the particular language message for its own environment.
An explicitText field includes the textual statement directly in
the certificate. The explicitText field is a string with a
maximum size of 200 characters.
If both the noticeRef and explicitText options are included in the
one qualifier and if the application software can locate the notice
text indicated by the noticeRef option, then that text SHOULD be
displayed; otherwise, the explicitText string SHOULD be displayed.
Note: While the explicitText has a maximum size of 200 characters,
some non-conforming CAs exceed this limit. Therefore, certificate
users SHOULD gracefully handle explicitText with more than 200
characters.
id-ce-certificatePolicies OBJECT IDENTIFIER ::= { id-ce 32 }
anyPolicy OBJECT IDENTIFIER ::= { id-ce-certificate-policies 0 }
certificatePolicies ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation
PolicyInformation ::= SEQUENCE {
policyIdentifier CertPolicyId,
policyQualifiers SEQUENCE SIZE (1..MAX) OF
PolicyQualifierInfo OPTIONAL }
CertPolicyId ::= OBJECT IDENTIFIER
PolicyQualifierInfo ::= SEQUENCE {
policyQualifierId PolicyQualifierId,
qualifier ANY DEFINED BY policyQualifierId }
-- policyQualifierIds for Internet policy qualifiers
id-qt OBJECT IDENTIFIER ::= { id-pkix 2 }
id-qt-cps OBJECT IDENTIFIER ::= { id-qt 1 }
id-qt-unotice OBJECT IDENTIFIER ::= { id-qt 2 }
PolicyQualifierId ::=
OBJECT IDENTIFIER ( id-qt-cps | id-qt-unotice )
Qualifier ::= CHOICE {
cPSuri CPSuri,
userNotice UserNotice }
CPSuri ::= IA5String
UserNotice ::= SEQUENCE {
noticeRef NoticeReference OPTIONAL,
explicitText DisplayText OPTIONAL}
NoticeReference ::= SEQUENCE {
organization DisplayText,
noticeNumbers SEQUENCE OF INTEGER }
DisplayText ::= CHOICE {
ia5String IA5String (SIZE (1..200)),
visibleString VisibleString (SIZE (1..200)),
bmpString BMPString (SIZE (1..200)),
utf8String UTF8String (SIZE (1..200)) }
4.2.1.6 Policy Mappings
This extension is used in CA certificates. It lists one or more
pairs of OIDs; each pair includes an issuerDomainPolicy and a
subjectDomainPolicy. The pairing indicates the issuing CA considers
its issuerDomainPolicy equivalent to the subject CA's
subjectDomainPolicy.
The issuing CA's users might accept an issuerDomainPolicy for certain
applications. The policy mapping defines the list of policies
associated with the subject CA that may be accepted as comparable to
the issuerDomainPolicy.
Each issuerDomainPolicy named in the policy mapping extension SHOULD
also be asserted in a certificate policies extension in the same
certificate. Policies SHOULD NOT be mapped either to or from the
special value anyPolicy (section 4.2.1.5).
This extension MAY be supported by CAs and/or applications, and it
MUST be non-critical.
id-ce-policyMappings OBJECT IDENTIFIER ::= { id-ce 33 }
PolicyMappings ::= SEQUENCE SIZE (1..MAX) OF SEQUENCE {
issuerDomainPolicy CertPolicyId,
subjectDomainPolicy CertPolicyId }
4.2.1.7 Subject Alternative Name
The subject alternative names extension allows additional identities
to be bound to the subject of the certificate. Defined options
include an Internet electronic mail address, a DNS name, an IP
address, and a uniform resource identifier (URI). Other options
exist, including completely local definitions. Multiple name forms,
and multiple instances of each name form, MAY be included. Whenever
such identities are to be bound into a certificate, the subject
alternative name (or issuer alternative name) extension MUST be used;
however, a DNS name MAY be represented in the subject field using the
domainComponent attribute as described in section 4.1.2.4.
Because the subject alternative name is considered to be definitively
bound to the public key, all parts of the subject alternative name
MUST be verified by the CA.
Further, if the only subject identity included in the certificate is
an alternative name form (e.g., an electronic mail address), then the
subject distinguished name MUST be empty (an empty sequence), and the
subjectAltName extension MUST be present. If the subject field
contains an empty sequence, the subjectAltName extension MUST be
marked critical.
When the subjectAltName extension contains an Internet mail address,
the address MUST be included as an rfc822Name. The format of an
rfc822Name is an "addr-spec" as defined in RFC822 [RFC822]. An
addr-spec has the form "local-part@domain". Note that an addr-spec
has no phrase (such as a common name) before it, has no comment (text
surrounded in parentheses) after it, and is not surrounded by "<" and
">". Note that while upper and lower case letters are allowed in an
RFC822 addr-spec, no significance is attached to the case.
When the subjectAltName extension contains a iPAddress, the address
MUST be stored in the octet string in "network byte order," as
specified in RFC791 [RFC791]. The least significant bit (LSB) of
each octet is the LSB of the corresponding byte in the network
address. For IP Version 4, as specified in RFC791, the octet string
MUST contain exactly four octets. For IP Version 6, as specified in
RFC1883, the octet string MUST contain exactly sixteen octets [RFC
1883].
When the subjectAltName extension contains a domain name system
label, the domain name MUST be stored in the dNSName (an IA5String).
The name MUST be in the "preferred name syntax," as specified by RFC
1034 [RFC1034]. Note that while upper and lower case letters are
allowed in domain names, no signifigance is attached to the case. In
addition, while the string " " is a legal domain name, subjectAltName
extensions with a dNSName of " " MUST NOT be used. Finally, the use
of the DNS representation for Internet mail addresses (wpolk.nist.gov
instead of wpolk@nist.gov) MUST NOT be used; such identities are to
be encoded as rfc822Name.
Note: work is currently underway to specify domain names in
international character sets. Such names will likely not be
accommodated by IA5String. Once this work is complete, this profile
will be revisited and the appropriate functionality will be added.
When the subjectAltName extension contains a URI, the name MUST be
stored in the uniformResourceIdentifier (an IA5String). The name
MUST NOT be a relative URL, and it MUST follow the URL syntax and
encoding rules specified in [RFC1738]. The name MUST include both a
scheme (e.g., "http" or "ftp") and a scheme-specific-part. The
scheme-specific-part MUST include a fully qualified domain name or IP
address as the host.
As specified in [RFC1738], the scheme name is not case-sensitive
(e.g., "http" is equivalent to "HTTP"). The host part is also not
case-sensitive, but other components of the scheme-specific-part may
be case-sensitive. When comparing URIs, conforming implementations
MUST compare the scheme and host without regard to case, but assume
the remainder of the scheme-specific-part is case sensitive.
When the subjectAltName extension contains a DN in the directoryName,
the DN MUST be unique for each subject entity certified by the one CA
as defined by the issuer name field. A CA MAY issue more than one
certificate with the same DN to the same subject entity.
The subjectAltName MAY carry additional name types through the use of
the otherName field. The format and semantics of the name are
indicated through the OBJECT IDENTIFIER in the type-id field. The
name itself is conveyed as value field in otherName. For example,
Kerberos [RFC1510] format names can be encoded into the otherName,
using using a Kerberos 5 principal name OID and a SEQUENCE of the
Realm and the PrincipalName.
Subject alternative names MAY be constrained in the same manner as
subject distinguished names using the name constraints extension as
described in section 4.2.1.11.
If the subjectAltName extension is present, the sequence MUST contain
at least one entry. Unlike the subject field, conforming CAs MUST
NOT issue certificates with subjectAltNames containing empty
GeneralName fields. For example, an rfc822Name is represented as an
IA5String. While an empty string is a valid IA5String, such an
rfc822Name is not permitted by this profile. The behavior of clients
that encounter such a certificate when processing a certificication
path is not defined by this profile.
Finally, the semantics of subject alternative names that include
wildcard characters (e.g., as a placeholder for a set of names) are
not addressed by this specification. Applications with specific
requirements MAY use such names, but they must define the semantics.
id-ce-subjectAltName OBJECT IDENTIFIER ::= { id-ce 17 }
SubjectAltName ::= GeneralNames
GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
GeneralName ::= CHOICE {
otherName [0] OtherName,
rfc822Name [1] IA5String,
dNSName [2] IA5String,
x400Address [3] ORAddress,
directoryName [4] Name,
ediPartyName [5] EDIPartyName,
uniformResourceIdentifier [6] IA5String,
iPAddress [7] OCTET STRING,
registeredID [8] OBJECT IDENTIFIER }
OtherName ::= SEQUENCE {
type-id OBJECT IDENTIFIER,
value [0] EXPLICIT ANY DEFINED BY type-id }
EDIPartyName ::= SEQUENCE {
nameAssigner [0] DirectoryString OPTIONAL,
partyName [1] DirectoryString }
4.2.1.8 Issuer Alternative Names
As with 4.2.1.7, this extension is used to associate Internet style
identities with the certificate issuer. Issuer alternative names
MUST be encoded as in 4.2.1.7.
Where present, this extension SHOULD NOT be marked critical.
id-ce-issuerAltName OBJECT IDENTIFIER ::= { id-ce 18 }
IssuerAltName ::= GeneralNames
4.2.1.9 Subject Directory Attributes
The subject directory attributes extension is used to convey
identification attributes (e.g., nationality) of the subject. The
extension is defined as a sequence of one or more attributes. This
extension MUST be non-critical.
id-ce-subjectDirectoryAttributes OBJECT IDENTIFIER ::= { id-ce 9 }
SubjectDirectoryAttributes ::= SEQUENCE SIZE (1..MAX) OF Attribute
4.2.1.10 Basic Constraints
The basic constraints extension identifies whether the subject of the
certificate is a CA and the maximum depth of valid certification
paths that include this certificate.
The cA boolean indicates whether the certified public key belongs to
a CA. If the cA boolean is not asserted, then the keyCertSign bit in
the key usage extension MUST NOT be asserted.
The pathLenConstraint field is meaningful only if the cA boolean is
asserted and the key usage extension asserts the keyCertSign bit
(section 4.2.1.3). In this case, it gives the maximum number of non-
self-issued intermediate certificates that may follow this
certificate in a valid certification path. A certificate is self-
issued if the DNs that appear in the subject and issuer fields are
identical and are not empty. (Note: The last certificate in the
certification path is not an intermediate certificate, and is not
included in this limit. Usually, the last certificate is an end
entity certificate, but it can be a CA certificate.) A
pathLenConstraint of zero indicates that only one more certificate
may follow in a valid certification path. Where it appears, the
pathLenConstraint field MUST be greater than or equal to zero. Where
pathLenConstraint does not appear, no limit is imposed.
This extension MUST appear as a critical extension in all CA
certificates that contain public keys used to validate digital
signatures on certificates. This extension MAY appear as a critical
or non-critical extension in CA certificates that contain public keys
used exclusively for purposes other than validating digital
signatures on certificates. Such CA certificates include ones that
contain public keys used exclusively for validating digital
signatures on CRLs and ones that contain key management public keys
used with certificate enrollment protocols. This extension MAY
appear as a critical or non-critical extension in end entity
certificates.
CAs MUST NOT include the pathLenConstraint field unless the cA
boolean is asserted and the key usage extension asserts the
keyCertSign bit.
id-ce-basicConstraints OBJECT IDENTIFIER ::= { id-ce 19 }
BasicConstraints ::= SEQUENCE {
cA BOOLEAN DEFAULT FALSE,
pathLenConstraint INTEGER (0..MAX) OPTIONAL }
4.2.1.11 Name Constraints
The name constraints extension, which MUST be used only in a CA
certificate, indicates a name space within which all subject names in
subsequent certificates in a certification path MUST be located.
Restrictions apply to the subject distinguished name and apply to
subject alternative names. Restrictions apply only when the
specified name form is present. If no name of the type is in the
certificate, the certificate is acceptable.
Name constraints are not applied to certificates whose issuer and
subject are identical (unless the certificate is the final
certificate in the path). (This could prevent CAs that use name
constraints from employing self-issued certificates to implement key
rollover.)
Restrictions are defined in terms of permitted or excluded name
subtrees. Any name matching a restriction in the excludedSubtrees
field is invalid regardless of information appearing in the
permittedSubtrees. This extension MUST be critical.
Within this profile, the minimum and maximum fields are not used with
any name forms, thus minimum MUST be zero, and maximum MUST be
absent.
For URIs, the constraint applies to the host part of the name. The
constraint MAY specify a host or a domain. Examples would be
"foo.bar.com"; and ".xyz.com". When the the constraint begins with
a period, it MAY be expanded with one or more subdomains. That is,
the constraint ".xyz.com" is satisfied by both abc.xyz.com and
abc.def.xyz.com. However, the constraint ".xyz.com" is not satisfied
by "xyz.com". When the constraint does not begin with a period, it
specifies a host.
A name constraint for Internet mail addresses MAY specify a
particular mailbox, all addresses at a particular host, or all
mailboxes in a domain. To indicate a particular mailbox, the
constraint is the complete mail address. For example, "root@xyz.com"
indicates the root mailbox on the host "xyz.com". To indicate all
Internet mail addresses on a particular host, the constraint is
specified as the host name. For example, the constraint "xyz.com" is
satisfied by any mail address at the host "xyz.com". To specify any
address within a domain, the constraint is specified with a leading
period (as with URIs). For example, ".xyz.com" indicates all the
Internet mail addresses in the domain "xyz.com", but not Internet
mail addresses on the host "xyz.com".
DNS name restrictions are expressed as foo.bar.com. Any DNS name
that can be constructed by simply adding to the left hand side of the
name satisfies the name constraint. For example, www.foo.bar.com
would satisfy the constraint but foo1.bar.com would not.
Legacy implementations exist where an RFC822 name is embedded in the
subject distinguished name in an attribute of type EmailAddress
(section 4.1.2.6). When rfc822 names are constrained, but the
certificate does not include a subject alternative name, the rfc822
name constraint MUST be applied to the attribute of type EmailAddress
in the subject distinguished name. The ASN.1 syntax for EmailAddress
and the corresponding OID are supplied in Appendix A.
Restrictions of the form directoryName MUST be applied to the subject
field in the certificate and to the subjectAltName extensions of type
directoryName. Restrictions of the form x400Address MUST be applied
to subjectAltName extensions of type x400Address.
When applying restrictions of the form directoryName, an
implementation MUST compare DN attributes. At a minimum,
implementations MUST perform the DN comparison rules specified in
Section 4.1.2.4. CAs issuing certificates with a restriction of the
form directoryName SHOULD NOT rely on implementation of the full ISO
DN name comparison algorithm. This implies name restrictions MUST be
stated identically to the encoding used in the subject field or
subjectAltName extension.
The syntax of iPAddress MUST be as described in section 4.2.1.7 with
the following additions specifically for Name Constraints. For IPv4
addresses, the ipAddress field of generalName MUST contain eight (8)
octets, encoded in the style of RFC1519 (CIDR) to represent an
address range [RFC1519]. For IPv6 addresses, the ipAddress field
MUST contain 32 octets similarly encoded. For example, a name
constraint for "class C" subnet 10.9.8.0 is represented as the octets
0A 09 08 00 FF FF FF 00, representing the CIDR notation
10.9.8.0/255.255.255.0.
The syntax and semantics for name constraints for otherName,
ediPartyName, and registeredID are not defined by this specification.
id-ce-nameConstraints OBJECT IDENTIFIER ::= { id-ce 30 }
NameConstraints ::= SEQUENCE {
permittedSubtrees [0] GeneralSubtrees OPTIONAL,
excludedSubtrees [1] GeneralSubtrees OPTIONAL }
GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
GeneralSubtree ::= SEQUENCE {
base GeneralName,
minimum [0] BaseDistance DEFAULT 0,
maximum [1] BaseDistance OPTIONAL }
BaseDistance ::= INTEGER (0..MAX)
4.2.1.12 Policy Constraints
The policy constraints extension can be used in certificates issued
to CAs. The policy constraints extension constrains path validation
in two ways. It can be used to prohibit policy mapping or require
that each certificate in a path contain an acceptable policy
identifier.
If the inhibitPolicyMapping field is present, the value indicates the
number of additional certificates that may appear in the path before
policy mapping is no longer permitted. For example, a value of one
indicates that policy mapping may be processed in certificates issued
by the subject of this certificate, but not in additional
certificates in the path.
If the requireExplicitPolicy field is present, the value of
requireExplicitPolicy indicates the number of additional certificates
that may appear in the path before an explicit policy is required for
the entire path. When an explicit policy is required, it is
necessary for all certificates in the path to contain an acceptable
policy identifier in the certificate policies extension. An
acceptable policy identifier is the identifier of a policy required
by the user of the certification path or the identifier of a policy
which has been declared equivalent through policy mapping.
Conforming CAs MUST NOT issue certificates where policy constraints
is a empty sequence. That is, at least one of the
inhibitPolicyMapping field or the requireExplicitPolicy field MUST be
present. The behavior of clients that encounter a empty policy
constraints field is not addressed in this profile.
This extension MAY be critical or non-critical.
id-ce-policyConstraints OBJECT IDENTIFIER ::= { id-ce 36 }
PolicyConstraints ::= SEQUENCE {
requireExplicitPolicy [0] SkipCerts OPTIONAL,
inhibitPolicyMapping [1] SkipCerts OPTIONAL }
SkipCerts ::= INTEGER (0..MAX)
4.2.1.13 Extended Key Usage
This extension indicates one or more purposes for which the certified
public key may be used, in addition to or in place of the basic
purposes indicated in the key usage extension. In general, this
extension will appear only in end entity certificates. This
extension is defined as follows:
id-ce-extKeyUsage OBJECT IDENTIFIER ::= { id-ce 37 }
ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId
KeyPurposeId ::= OBJECT IDENTIFIER
Key purposes may be defined by any organization with a need. Object
identifiers used to identify key purposes MUST be assigned in
accordance with IANA or ITU-T Recommendation X.660 [X.660].
This extension MAY, at the option of the certificate issuer, be
either critical or non-critical.
If the extension is present, then the certificate MUST only be used
for one of the purposes indicated. If multiple purposes are
indicated the application need not recognize all purposes indicated,
as long as the intended purpose is present. Certificate using
applications MAY require that a particular purpose be indicated in
order for the certificate to be acceptable to that application.
If a CA includes extended key usages to satisfy such applications,
but does not wish to restrict usages of the key, the CA can include
the special keyPurposeID anyExtendedKeyUsage. If the
anyExtendedKeyUsage keyPurposeID is present, the extension SHOULD NOT
be critical.
If a certificate contains both a key usage extension and an extended
key usage extension, then both extensions MUST be processed
independently and the certificate MUST only be used for a purpose
consistent with both extensions. If there is no purpose consistent
with both extensions, then the certificate MUST NOT be used for any
purpose.
The following key usage purposes are defined:
anyExtendedKeyUsage OBJECT IDENTIFIER ::= { id-ce-extKeyUsage 0 }
id-kp OBJECT IDENTIFIER ::= { id-pkix 3 }
id-kp-serverAuth OBJECT IDENTIFIER ::= { id-kp 1 }
-- TLS WWW server authentication
-- Key usage bits that may be consistent: digitalSignature,
-- keyEncipherment or keyAgreement
id-kp-clientAuth OBJECT IDENTIFIER ::= { id-kp 2 }
-- TLS WWW client authentication
-- Key usage bits that may be consistent: digitalSignature
-- and/or keyAgreement
id-kp-codeSigning OBJECT IDENTIFIER ::= { id-kp 3 }
-- Signing of downloadable executable code
-- Key usage bits that may be consistent: digitalSignature
id-kp-emailProtection OBJECT IDENTIFIER ::= { id-kp 4 }
-- E-mail protection
-- Key usage bits that may be consistent: digitalSignature,
-- nonRepudiation, and/or (keyEncipherment or keyAgreement)
id-kp-timeStamping OBJECT IDENTIFIER ::= { id-kp 8 }
-- Binding the hash of an object to a time
-- Key usage bits that may be consistent: digitalSignature
-- and/or nonRepudiation
id-kp-OCSPSigning OBJECT IDENTIFIER ::= { id-kp 9 }
-- Signing OCSP responses
-- Key usage bits that may be consistent: digitalSignature
-- and/or nonRepudiation
4.2.1.14 CRL Distribution Points
The CRL distribution points extension identifies how CRL information
is obtained. The extension SHOULD be non-critical, but this profile
RECOMMENDS support for this extension by CAs and applications.
Further discussion of CRL management is contained in section 5.
The cRLDistributionPoints extension is a SEQUENCE of
DistributionPoint. A DistributionPoint consists of three fields,
each of which is optional: distributionPoint, reasons, and cRLIssuer.
While each of these fields is optional, a DistributionPoint MUST NOT
consist of only the reasons field; either distributionPoint or
cRLIssuer MUST be present. If the certificate issuer is not the CRL
issuer, then the cRLIssuer field MUST be present and contain the Name
of the CRL issuer. If the certificate issuer is also the CRL issuer,
then the cRLIssuer field MUST be omitted and the distributionPoint
field MUST be present. If the distributionPoint field is omitted,
cRLIssuer MUST be present and include a Name corresponding to an
X.500 or LDAP directory entry where the CRL is located.
When the distributionPoint field is present, it contains either a
SEQUENCE of general names or a single value, nameRelativeToCRLIssuer.
If the cRLDistributionPoints extension contains a general name of
type URI, the following semantics MUST be assumed: the URI is a
pointer to the current CRL for the associated reasons and will be
issued by the associated cRLIssuer. The expected values for the URI
are those defined in 4.2.1.7. Processing rules for other values are
not defined by this specification.
If the DistributionPointName contains multiple values, each name
describes a different mechanism to obtain the same CRL. For example,
the same CRL could be available for retrieval through both LDAP and
HTTP.
If the DistributionPointName contains the single value
nameRelativeToCRLIssuer, the value provides a distinguished name
fragment. The fragment is appended to the X.500 distinguished name
of the CRL issuer to obtain the distribution point name. If the
cRLIssuer field in the DistributionPoint is present, then the name
fragment is appended to the distinguished name that it contains;
otherwise, the name fragment is appended to the certificate issuer
distinguished name. The DistributionPointName MUST NOT use the
nameRealtiveToCRLIssuer alternative when cRLIssuer contains more than
one distinguished name.
If the DistributionPoint omits the reasons field, the CRL MUST
include revocation information for all reasons.
The cRLIssuer identifies the entity who signs and issues the CRL. If
present, the cRLIssuer MUST contain at least one an X.500
distinguished name (DN), and MAY also contain other name forms.
Since the cRLIssuer is compared to the CRL issuer name, the X.501
type Name MUST follow the encoding rules for the issuer name field in
the certificate (section 4.1.2.4).