Crldistributionpoints; Extkeyusage - Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION Administration Manual

Appendix A. Certificate and CRL Extensions
A.3.5. CRLDistributionPoints
A.3.5.1. OID
2.5.29.31
A.3.5.2. Criticality
PKIX recommends that this extension be marked noncritical and that it be supported for all certificates.
A.3.5.3. Discussion
This extension defines how CRL information is obtained. It should be used if the system is configured
to use CRL issuing points.
If the extension contains a DistributionPointName with a type set to URI, the URI is assumed to
be a pointer to the current CRL for the specified revocation reasons and will be issued by the named
cRLIssuer. The expected values for the URI are those defined for the Subject Alternative Name
extension. If the distributionPoint omits reasons, the CRL must include revocations for all
reasons. If the distributionPoint omits cRLIssuer, the CRL must be issued by the CA that
issued the certificate.
PKIX recommends that this extension be supported by CAs and applications.
A.3.6. extKeyUsage
A.3.6.1. OID
2.5.29.37
A.3.6.2. Criticality
If this extension is marked critical, the certificate must be used for one of the indicated purposes only.
If it is not marked critical, it is treated as an advisory field that may be used to identify keys but does
not restrict the use of the certificate to the indicated purposes.
A.3.6.3. Discussion
The Extended Key Usage extension indicates the purposes for which the certified public key may be
used. These purposes may be in addition to or in place of the basic purposes indicated in the Key
Usage extension.
The Extended Key Usage extension must include OCSP Signing in an OCSP responder's certificate
unless the CA signing key that signed the certificates validated by the responder is also the OCSP
signing key. The OCSP responder's certificate must be issued directly by the CA that signs certificates
the responder will validate.
The Key Usage, Extended Key Usage, and Basic Constraints extensions act together to define the
purposes for which the certificate is intended to be used. Applications can use these extensions to
disallow the use of a certificate in inappropriate contexts.
466