Structure Of Crl Extensions - Red Hat CERTIFICATE SYSTEM 7.1 - ADMINISTRATOR Administrator's Manual

Introduction to CRL Extensions
The standard also suggests that you can define your own extensions and include them in
CRLs you issue. These extensions are called private, proprietary, or custom CRL
extensions and they carry information unique to your organization or business. Keep in
mind that applications may not able to validate CRLs that contain private, critical
extensions, thus preventing the use of these CRLs in a general context.
NOTE

Structure of CRL Extensions

A CRL extension consists of the following:
• The object identifier (OID) for the extension; see Appendix H, "Object Identifiers."
This identifier uniquely identifies the extension. It also determines the ASN.1 type of
value in the value field and how the value is interpreted. That is, when an extension
appears in a CRL, the OID appears as the extension ID field (
corresponding ASN.1 encoded structure appears as the value of the octet string
(
• A flag or boolean field called
The
critical (true) or noncritical (false) to the CRL.
❍
❍
• An octet string containing the DER encoding of the value of the extension.
Typically, the application receiving the CRL checks the extension ID to determine if it
can recognize the ID. If it can, it uses the extension ID to determine the type of value
used.
742 Red Hat Certificate System Administrator's Guide • September 2005
Some explanations in this chapter make reference to Abstract Syntax
Notation One (ASN.1) and Distinguished Encoding Rules (DER). These
are specified in the CCITT Recommendations X.208 and X.209. For a
quick summary of ASN.1 and DER, see A Layman's Guide to a Subset of
ASN.1, BER, and DER, which is available at RSA Laboratories' web site
(
http://www.rsa.com
); see the examples in "Sample Certificate Extensions" on page 728.
extnValue
or value assigned to this field indicates whether the extension is
true false
If the extension is critical and the CRL is sent to an application that does not
understand the extension (based on the extension's ID), the application must reject
the CRL.
If the extension is not critical and the CRL is sent to an application that does not
understand the extension (based on the extension's ID), the application can ignore
the extension and accept the CRL.
).
.
critical
) and the
extnID