Authorityinfoaccess; The Authoritykeyidentifier - Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION Administration Manual

Appendix A. Certificate and CRL Extensions
A.3.1. authorityInfoAccess
A.3.1.1. OID
1.3.6.1.5.5.7.1.1
A.3.1.2. Criticality
This extension must be noncritical.
A.3.1.3. Discussion
The Authority Information Access extension indicates how and where to access information about
the issuer of the certificate. The extension contains an accessMethod and an accessLocation
field. accessMethod specifies by OID the type and format of information about the issuer named in
accessLocation.
PKIX Part 1 defines one accessMethod (id-ad-caIssuers) to get a list of CAs that have
issued certificates higher in the CA chain than the issuer of the certificate using the extension. The
accessLocation field then typically contains a URL indicating the location and protocol (LDAP,
HTTP, or FTP) used to retrieve the list.
The Online Certificate Status Protocol (RFC 2560), available at http://www.ietf.org/rfc/rfc2560.txt,
defines an accessMethod (id-ad-ocsp) for using OCSP to verify certificates. The accessLocation
field then contains a URL indicating the location and protocol used to access an OCSP responder that
can validate the certificate.
A.3.2. The authorityKeyIdentifier
A.3.2.1. OID
2.5.29.35
A.3.2.2. Criticality
This extension is always noncritical and is always evaluated.
A.3.2.3. Discussion
The Authority Key Identifier extension identifies the public key corresponding to the private key used to
sign a certificate. This extension is useful when an issuer has multiple signing keys.
The extension consists of one or both of the following:
• An explicit key identifier, set in the keyIdentifier field
• An issuer, set in the authorityCertIssuer field, and serial number, set in the
authorityCertSerialNumber field, identifying a certificate
If the keyIdentifier field exists, it is used to select the certificate with a matching
subjectKeyIdentifier extension. If the authorityCertIssuer and
authorityCertSerialNumber fields are present, then they are used to identify the correct
certificate by issuer and serialNumber.
464