Sample Crl And Crl Entry Extensions - Netscape MANAGEMENT SYSTEM 4.5 - PLUG-IN Manual

Introduction to CRL Extensions
• A flag or boolean field called
The
is critical (true) or noncritical (false) to the CRL.
• An octet string containing the DER encoding of the value of the extension.
Typically, the application receiving the CRL checks the extension ID to
determine if it can recognize the ID. If it can, it uses the extension ID to
determine the type of value used.

Sample CRL and CRL Entry Extensions

The following is an example of the section of a CRL containing X.509 v2 extensions.
(Certificate Management System can display CRLs in human-readable format, as
shown here.) As shown in the example, CRL extensions appear in sequence and
only one instance of a particular extension may appear in a particular CRL; for
example, a CRL may contain only one authority key identifier extension. However,
CRL-entry extensions appear in appropriate entries in the CRL.
Certificate Revocation List:
Data:
...
Extensions:
Identifier: Authority Key Identifier
Extensions:
Identifier: Revocation Reason - 2.5.29.21
360 Netscape Certificate Management System Plug-ins Guide • October 2001
or value assigned to this field indicates whether the extension
true false
If the extension is critical and the CRL is sent to an application that does
not understand the extension (based on the extension's ID), the application
must reject the CRL.
If the extension is not critical and the CRL is sent to an application that
does not understand the extension (based on the extension's ID), the
application can ignore the extension and accept the CRL.
Version: v2
Critical: no
Key Identifier:
2c:22:c6:ae:4e:4b:91:c7:fb:4c:cc:ae:84:e8:aa:5b:46:6a:a0:ad
Critical: no
Reason: Key_Compromise
Serial Number: 0x12
Revocation Date: Tuesday, December 15, 1998 5:20:42 AM
.
critical