Structure Of Crl Extensions - Netscape MANAGEMENT SYSTEM 6.2 - ADMINISTRATOR Administrator's Manual

The standard also suggests that you can define your own extensions and include
them in CRLs you issue. These extensions are called private, proprietary, or custom
CRL extensions and they carry information unique to your organization or
business. Keep in mind that applications may not able to validate CRLs that
contain private, critical extensions, thus preventing the use of these CRLs in a
general context.
Some explanations in this chapter make reference to Abstract
NOTE
Syntax Notation One (ASN.1) and Distinguished Encoding Rules
(DER). These are specified in the CCITT Recommendations X.208
and X.209. For a quick summary of ASN.1 and DER, see A Layman's
Guide to a Subset of ASN.1, BER, and DER, which is available at RSA
Laboratories' web site (

Structure of CRL Extensions

A CRL extension consists of the following:
• The object identifier (OID) for the extension; see Appendix H, "Object
Identifiers."
This identifier uniquely identifies the extension. It also determines the ASN.1
type of value in the value field and how the value is interpreted. That is, when
an extension appears in a CRL, the OID appears as the extension ID field
( ) and the corresponding ASN.1 encoded structure appears as the value
extnID
of the octet string (
Extensions" on page 755.
• A flag or boolean field called
The or
true false
is critical (true) or noncritical (false) to the CRL.
If the extension is critical and the CRL is sent to an application that does
not understand the extension (based on the extension's ID), the application
must reject the CRL.
If the extension is not critical and the CRL is sent to an application that
does not understand the extension (based on the extension's ID), the
application can ignore the extension and accept the CRL.
• An octet string containing the DER encoding of the value of the extension.
http://www.rsa.com
); see the examples in "Sample Certificate
extnValue
.
critical
value assigned to this field indicates whether the extension
Introduction to CRL Extensions
).
Appendix G Certificate and CRL Extensions 769