Table of Contents
Advertisement
Introduction to Certificate Extensions
Structure of Certificate Extensions
In RFC 2459, an X.509 certificate extension is defined as follows:
Extension
extnID OBJECT IDENTIFIER,
critical BOOLEAN DEFAULT FALSE,
extnValue OCTET STRING
Which means, a certificate extension consists of the following:
•
The object identifier (OID) for the extension; see Appendix B, "Object
Identifiers."
This identifier uniquely identifies the extension. It also determines the ASN.1
type of value in the value field and how the value is interpreted. That is, when
an extension appears in a certificate, the OID appears as the extension ID field
(
of the octet string (
Extensions" on page 331.
•
A flag or boolean field called
The value, which can be either true or false, assigned to this field indicates
whether the extension is critical or noncritical to the certificate.
•
An octet string containing the DER encoding of the value of the extension.
Typically, the application receiving the certificate checks the extension ID to
determine if it can recognize the ID. If it can, it uses the extension ID to
determine the type of value used.
Examples of standard extensions defined in the X.509 v3 standard include the
following:
•
Authority Key Identifier Extension—an extension for identifying the certificate
authority's public key (the key used to sign the certificate).
•
Subject Key Identifier Extension—an extension for identifying the subject's
public key (the key being certified).
330
Netscape Certificate Management System Plug-Ins Guide • May 2002
::=
SEQUENCE
) and the corresponding ASN.1 encoded structure appears as the value
extnID
extnValue
If the extension is critical and the certificate is sent to an application that
does not understand the extension (based on the extension's ID), the
application must reject the certificate.
If the extension is not critical and the certificate is sent to an application
that does not understand the extension (based on the extension's ID), the
application can ignore the extension and accept the certificate.
{
}
); see the examples in "Sample Certificate
.
critical
Advertisement
Table of Contents
