Appendix B. Defaults, Constraints, and Extensions for Certificates and CRLs
Appendix B. Defaults, Constraints, and Extensions for Certificates and CRLs This appendix explains both the standard certificate extensions defined by X.509 v3 and the extensions defined by Netscape that were used in versions of products released before X.509 v3 was finalized. It provides recommendations for extensions to use with specific kinds of certificates, including PKIX Part 1 recommendations. IMPORTANT This appendix is a reference for defaults, constraints, and certificate and CRL extensions that are used or are configurable in Red Hat Certificate System. For a complete reference and explanation of certificate and CRL extensions, see RFC 3280 . This appendix contains the following sections: Section B.1, "Defaults reference" Section B.2, "Constraints reference" Section B.3, "Standard X.509 v3 certificate extension reference" Section B.4, "CRL extensions" B.1. Defaults reference Defaults are used to define the contents of a certificate. This section lists and defines the predefined defaults. B.1.1. Authority Info Access extension default This default attaches the Authority Info Access extension. This extension specifies how an application validating a certificate can access information, such as online validation services and CA policy data, about the CA that has issued the certificate. This extension should not be used to point directly to the CRL location maintained by a CA; the CRL Distribution Points extension, Section B.1.7, "CRL Distribution Points extension default" , provides references to CRL locations. For general information about this extension, see Section B.3.1, "authorityInfoAccess" . The following constraints can be defined with this default: Extension Constraint; see Section B.2.4, "Extension constraint" . No Constraints; see Section B.2.8, "No Constraint" . This default can define up to five locations, with parameters for each location. The parameters are marked with an n in the table to show with which location the parameter is associated. Table B.1. Authority Info Access extension default configuration parameters Parameter Description Critical Select true to mark this extension critical; select false to mark the extension noncritical. Method _n Specifies the access method for retrieving additional information about the CA that has issued the certificate in which the extension appears. This is one of the following values: ocsp (1.3.6.1.5.5.7.48.1). caIssuers (1.3.6.1.5.5.7.48.2) renewal (2.16.840.1.113730.16.1) LocationType _n Specifies the general name type for the location that contains additional information about the CA that has issued the certificate. This is one of the following types: DirectoryName DNSName EDIPartyName IPAddress OID RFC822Name URIName Location _n Specifies the address or location to get additional information about the CA that has issued the certificate. For directoryName , the value must be a string form of X.500 name, similar to the subject name in a certificate. For example, cn=SubCA, ou=Research Dept, o=Example Corporation, c=US . For dNSName , the value must be a valid fully-qualified domain name. For example, testCA.example.com . For EDIPartyName , the value must be an IA5String. For example, Example Corporation . For iPAddress , the value must be a valid IP address. An IPv4 address must be in the format n.n.n.n or n.n.n.n,m.m.m.m . For example, 128.21.39.40 or 128.21.39.40,255.255.255.00 . An IPv6 address uses a 128-bit namespace, with the IPv6 address separated by colons and the netmask separated by periods. For example, 0:0:0:0:0:0:13.1.68.3 , FF01::43 , 0:0:0:0:0:0:13.1.68.3,FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:255.255.255.0 , and FF01::43,FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FF00:0000 . For OID , the value must be a unique, valid OID specified in dot-separated numeric component notation. For example, 1.2.3.4.55.6.5.99 . For RFC822Name , the value must be a valid Internet mail address. For URIName , the value must be a non-relative universal resource identifier (URI) following the URL syntax and encoding rules. The name must include both a scheme, such as http , and a fully-qualified domain name or IP address of the host. For example, http://ocspResponder.example.com:8000 . Certificate System allows both IPv4 and IPv6 IP addresses. Enable _n Specifies whether this location is enabled. Select true to mark this as set; select false to disable it. B.1.2. Authority Key Identifier extension default This default attaches the Authority Key Identifier extension to the certificate. The extension identifies the public key that corresponds to the private key used by a CA to sign certificates. This default has no parameters. If used, this extension is included in the certificate with the public key information. This default takes the following constraint: No Constraints; see Section B.2.8, "No Constraint" . For general information about this extension, see Section B.3.2, "authorityKeyIdentifier" . B.1.3. Authentication Token Subject Name default This profile default populates subject names based on the attribute values in the authentication token (AuthToken) object. This default plugin works with the directory-based authentication manager. The Directory-Based User Dual-Use Certificate Enrollment certificate profile has two input parameters, UID and password. The directory-based authentication manager checks if the given UID and password are correct. In addition, the directory-based authentication manager formulates the subject name of the issuing certificate. It forms the subject name by using the user's DN value from AuthToken . This default is responsible for reading the subject name from the AuthToken and placing it in the certificate request so that the final certificate contains the subject name. The following constraints can be defined with this default: No Constraints; see Section B.2.8, "No Constraint" . B.1.4. Basic Constraints extension default This default attaches the B*asic Constraint* extension to the certificate. The extension identifies whether the Certificate Manager is a CA. The extension is also used during the certificate chain verification process to identify CA certificates and to apply certificate chain-path length constraints. For general information about this extension, see Section B.3.3, "basicConstraints" . The following constraints can be defined with this default: Basic Constraints Extension Constraint; see Section B.2.1, "Basic Constraints extension constraint" . Extension Constraint; see Section B.2.4, "Extension constraint" . No Constraints; see Section B.2.8, "No Constraint" . Table B.2. Basic Constraints extension default configuration parameters Parameter Description Critical Select true to mark this extension critical; select false to mark the extension noncritical. IsCA Specifies whether the certificate subject is a CA. With true , the server checks the PathLen parameter and sets the specified path length in the certificate. With false , the server treats the certificate subject as a non-CA and ignores the value specified for the PathLen parameter. PathLen Specifies the path length, the maximum number of CA certificates that may be chained below (subordinate to) the subordinate CA certificate being issued. The path length affects the number of CA certificates to be used during certificate validation. The chain starts with the end-entity certificate being validated and moves up. The maxPathLen parameter has no effect if the extension is set in end-entity certificates. The permissible values are 0 or n . The value should be less than the path length specified in the Basic Constraints extension of the CA signing certificate. 0 specifies that no subordinate CA certificates are allowed below the subordinate CA certificate; only an end-entity certificate may follow in the path. n must be an integer greater than zero. It specifies the maximum number of subordinate CA certificates allowed below the subordinate CA certificate. If the field is blank, the path length defaults to a value that is determined by the path length set in the Basic Constraints extension in the issuer's certificate. If the issuer's path length is unlimited, the path length in the subordinate CA certificate will also be unlimited. If the issuer's path length is an integer greater than zero, the path length in the subordinate CA certificate will be set to a value that is one less than the issuer's path length; for example, if the issuer's path length is 4, the path length in the subordinate CA certificate will be set to 3. B.1.5. CA Validity default This default adds an option to a CA certificate enrollment or renewal profile to bypass the CA's signing certificate's expiration constraint. This means that the issued CA certificate can have an expiration date that is later than the issuing CA signing certificate expiration date. The following constraints can be defined with this default: Validity Constraint; see Section B.2.14, "Validity constraint" . No Constraints; see Section B.2.8, "No Constraint" . Table B.3. CA Validity default parameters Parameter Description bypassCAnotafterrange Sets the default value for whether a requesting CA can request a certificate whose validity period extends past the issuing CA's validity period. range Specifies the absolute validity period for this certificate, in the number of days. startTime Sets when the validity period begins, based on the current time. B.1.6. Certificate Policies extension default This default attaches the Certificate Policy Mappings extension into the certificate template. This extension defines one or more policies, indicating the policy under which the certificate has been issued and the purposes for which the certificate may be used. This default defines up to five policies, but this can be value can be changed. For general information about this extension, see Section B.3.4, "certificatePoliciesExt" Table B.4. Certificate Policies extension default configuration parameters Parameter Description Critical Select true to mark this extension critical; select false to mark the extension noncritical. numCertPolicies Specifies the number of policies that can be defined. The default is 5 . enable Select true to enable the policy; select false to disable the policy. policyId Specifies the OID identifier for the policy. cpsURI.enable The extension can include a URI to the issuer's Certificate Practice Statement. Select true to enable URI; select false to disable URI. CPSURI.value This value is a pointer to a Certification Practice Statement (CPS) published by the CA. The pointer is in the form of a URI. usernotice.enable The extension can include a URI to the issuer's Certificate Practice Statement or can embed issuer information, such as a user notice in text form. Select true to enable user notices; select false to disable the user notices. usernotice.noticeReference.noticeNumbers This optional user notice parameter is a sequence of numbers that points to messages stored elsewhere. usernotice.noticeReference.organization This optional user notice parameter specifies the name of the company. usernotice.explicitText.value This optional user notice parameter contains the message within the certificate. B.1.7. CRL Distribution Points extension default This default attaches the CRL Distribution Points extension to the certificate. This extension identifies locations from which an application that is validating the certificate can obtain the CRL information to verify the revocation status of the certificate. For general information about this extension, see Section B.3.5, "CRLDistributionPoints" . The following constraints can be defined with this default: Extension Constraint; see Section B.2.4, "Extension constraint" . No Constraints; see Section B.2.8, "No Constraint" . This default defines up to five locations, with parameters for each location. The parameters are marked with an n in the table to show with which location the parameter is associated. Table B.5. CRL Distribution Points extension configuration parameters Parameter Description Critical Select true to mark this extension critical; select false to mark the extension noncritical. Type _n Specifies the type of CRL distribution point. The permissible values are DirectoryName , URIName , or RelativeToIssuer . The type must correspond to the value in the Name field. Name _n Specifies the name of the CRL distribution point, the name can be in any of the following formats: An X.500 directory name in the RFC 2253 syntax. The name looks similar to the subject name in a certificate, like cn=CA Central, ou=Research Dept, o=Example Corporation, c=US . A URIName, such as http://testCA.example.com:80 . An RDN which specifies a location relative to the CRL issuer. In this case, the value of the Type attribute must be RelativeToIssuer . Reasons _n Specifies revocation reasons covered by the CRL maintained at the distribution point. Provide a comma-separated list of the following constants: unused keyCompromise cACompromise affiliationChanged superseded cessationOfOperation certificateHold IssuerType _n Specifies the naming type of the issuer that has signed the CRL maintained at the distribution point. The issuer name can be in any of the following formats: RFC822Name DirectoryName DNSName EDIPartyName URIName IPAddress OIDName OtherName IssuerName _n Specifies the name format of the CRL issuer that signed the CRL. The permissible values are as follows: For RFC822Name , the value must be a valid Internet mail address. For example, testCA@example.com . For DirectoryName , the value must be a string form of X.500 name, similar to the subject name in a certificate. For example, cn=SubCA, ou=Research Dept, o=Example Corporation, c=US . For DNSName , the value must be a valid fully-qualified domain name. For example, testCA.example.com . For EDIPartyName , the value must be an IA5String. For example, Example Corporation . For URIName , the value must be a non-relative URI following the URL syntax and encoding rules. The name must include both a scheme, such as http , and a fully qualified domain name or IP address of the host. For example, http://testCA.example.com . Certificate System supports both IPv4 and IPv6 addresses. For IPAddress , the value must be a valid IP address. An IPv4 address must be in the format n.n.n.n or n.n.n.n,m.m.m.m . For example, 128.21.39.40 or 128.21.39.40,255.255.255.00 . An IPv6 address uses a 128-bit namespace, with the IPv6 address separated by colons and the netmask separated by periods. For example, 0:0:0:0:0:0:13.1.68.3 , FF01::43 , 0:0:0:0:0:0:13.1.68.3,FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:255.255.255.0 , and FF01::43,FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FF00:0000 . For OIDName , the value must be a unique, valid OID specified in dot-separated numeric component notation. For example, 1.2.3.4.55.6.5.99 . OtherName is used for names with any other format; this supports PrintableString , IA5String , UTF8String , BMPString , Any , and KerberosName . KerberosName has the format Realm|NameType|NameStrings , such as realm1|0|userID1,userID2 . OtherName must have the format (type)oid,string . For example, (IA5String)1.2.3.4,MyExample . The value for this parameter must correspond to the value in the issuerName field. B.1.8. Extended Key Usage extension default This default attaches the Extended Key Usage extension to the certificate. For general information about this extension, see Section B.3.6, "extKeyUsage" . The extension identifies the purposes, in addition to the basic purposes indicated in the Key Usage extension, for which the certified public key may be used. For example, if the key usage extension identifies a signing key, the Extended Key Usage extension can narrow the usage of the key for only signing OCSP responses or only #JavaTM applets. Table B.6. PKIX usage definitions for the Extended Key Usage extension Usage OID Server authentication 1.3.6.1.5.5.7.3.1 Client authentication 1.3.6.1.5.5.7.3.2 Code signing 1.3.6.1.5.5.7.3.3 Email 1.3.6.1.5.5.7.3.4 IPsec end system 1.3.6.1.5.5.7.3.5 IPsec tunnel 1.3.6.1.5.5.7.3.6 IPsec user 1.3.6.1.5.5.7.3.7 Timestamping 1.3.6.1.5.5.7.3.8 Windows 2000 can encrypt files on the hard disk, a feature known as encrypted file system (EFS), using certificates that contain the Extended Key Usage extension with the following two OIDs: 1.3.6.1.4.1.311.10.3.4 (EFS certificate) 1.3.6.1.4.1.311.10.3.4.1 (EFS recovery certificate) The EFS recovery certificate is used by a recovery agent when a user loses the private key and the data encrypted with that key needs to be used. Certificate System supports these two OIDs and allows certificates to be issued containing the Extended Key Usage extension with these OIDs. Normal user certificates should be created with only the EFS OID, not the recovery OID. The following constraints can be defined with this default: Extended Key Usage Constraint; see Section B.2.3, "Extended Key Usage extension constraint" . Extension Constraint; see Section B.2.4, "Extension constraint" . No Constraints; see Section B.2.8, "No Constraint" . Table B.7. Extended Key Usage extension default configuration parameters Parameter Description Critical Select true to mark this extension critical; select false to mark the extension noncritical. OIDs Specifies the OID that identifies a key-usage purpose. The permissible values are a unique, valid OID specified in the dot-separated numeric component notation. For example, 2.16.840.1.113730.1.99 . Depending on the key-usage purposes, the OIDs can be designated by PKIX (listed in Table B.6, "PKIX usage definitions for the Extended Key Usage extension" ) or custom OIDs. Custom OIDs must be in the registered subtree of IDs reserved for the company's use. Although it is possible to use custom OIDs for evaluating and testing the Certificate System, in a production environment, comply with the ISO rules for defining OIDs and for registering subtrees of IDs. B.1.9. Freshest CRL extension default This default attaches the Freshest CRL extension to the certificate. The following constraints can be defined with this default: Extension Constraint; see Section B.2.4, "Extension constraint" . No Constraints; see Section B.2.8, "No Constraint" . This default defines five locations with parameters for each location. The parameters are marked with an n in the table to show with which location the parameter is associated. Table B.8. Freshest CRL extension default configuration parameters Parameter Description Critical Select true to mark this extension critical; select false to mark the extension noncritical. PointEnable _n Select true to enable this point; select false to disable this point. PointType _n Specifies the type of issuing point, either DirectoryName or URIName . PointName _n If pointType is set to directoryName , the value must be an X.500 name, similar to the subject name in a certificate. For example, cn=CACentral,ou=Research Dept,o=Example Corporation,c=US . If pointType is set to URIName , the name must be a URI, an absolute pathname that specifies the host. For example, http://testCA.example.com/get/crls/here/ . PointIssuerName _n Specifies the name of the issuer that has signed the CRL. The name can be in any of the following formats: For RFC822Name , the value must be a valid Internet mail address. For example, testCA@example.com . For DirectoryName , the value must be a string form of X.500 name, similar to the subject name in a certificate. For example, cn=SubCA, ou=Research Dept, o=Example Corporation, c=US . For DNSName , the value must be a valid fully-qualified domain name. For example, testCA.example.com . For EDIPartyName , the value must be an IA5String. For example, Example Corporation . For URIName , the value must be a non-relative URI following the URL syntax and encoding rules. The name must include both a scheme, such as http , and a fully qualified domain name or IP address of the host. For example, http://testCA.example.com . Certificate System supports both IPv4 and IPv6 addresses. For IPAddress , the value must be a valid IP address. An IPv4 address must be in the format n.n.n.n or n.n.n.n,m.m.m.m . For example, 128.21.39.40 or 128.21.39.40,255.255.255.00 . An IPv6 address uses a 128-bit namespace, with the IPv6 address separated by colons and the netmask separated by periods. For example, 0:0:0:0:0:0:13.1.68.3 , FF01::43 , 0:0:0:0:0:0:13.1.68.3,FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:255.255.255.0 , and FF01::43,FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FF00:0000 . For OIDName , the value must be a unique, valid OID specified in dot-separated numeric component notation. For example, 1.2.3.4.55.6.5.99 . OtherName is used for names with any other format; this supports PrintableString , IA5String , UTF8String , BMPString , Any , and KerberosName . KerberosName has the format Realm|NameType|NameStrings , such as realm1|0|userID1,userID2 . OtherName must have the format (type)oid,string . For example, (IA5String)1.2.3.4,MyExample . The name value must comply with the format specified in PointType_ . PointType _n Specifies the general name type of the CRL issuer that signed the CRL. The permissible values are as follows: RFC822Name DirectoryName DNSName EDIPartyName URIName IPAddress OIDName OtherName The value for this parameter must correspond to the value in the PointIssuerName field. B.1.10. Generic extension default This extension allows for the creation of a generic extension with user determined data. The default ensures the generic extension is populated correctly. Table B.9. Generic extension default configuration parameters Parameter Description Critical Select true to mark this extension critical; select false to mark the extension noncritical. genericExtOID Specifies the extensions OID identifier. genericExtData The binary data contained within the extension. B.1.11. Inhibit Any-Policy extension default The inhibit any-policy extension can be used for certificates issued to CAs. The inhibit any-policy indicates that the special anyPolicy OID, with the value { 2 5 29 32 0 }, is not considered an explicit match for other certificate policies. Table B.10. Inhibit Any-Policy extension default configuration parameters Parameter Description Critical This policy must be marked as critical. Select true to mark this extension critical; select false to mark the extension noncritical. SkipCerts This parameter indicate the number of additional certificates that may appear in the path before any-policy is no longer allowed. A value of 1 indicates that any-policy may be processed in certificates issued by the subject of this certificate, but not in additional certificates in the path. B.1.12. Issuer Alternative Name extension default This default attaches the Issuer Alternative Name extension to the certificate. The Issuer Alternative Name extension is used to associate Internet-style identities with the certificate issuer. The following constraints can be defined with this default: Extension Constraint; see Section B.2.4, "Extension constraint" . No Constraints; see Section B.2.8, "No Constraint" . This default defines five locations with parameters for each location. The parameters are marked with an n in the table to show with which location the parameter is associated. Table B.11. Issuer Alternative Name extension default configuration parameters Parameter Description Critical Select true to mark this extension critical; select false to mark the extension noncritical. issuerAltExtType This sets the type of name extension to be used, which can be one of the following: RFC822Name DirectoryName DNSName EDIPartyName URIName IPAddress OIDName issuerAltExtPattern Specifies the request attribute value to include in the extension. The attribute value must conform to any of the supported general name types. The permissible value is a request attribute included in the certificate request. If the server finds the attribute in the request, it sets the attribute value in the extension and adds the extension to certificates. If multiple attributes are specified and none of the attributes are present in the request, the server does not add the Issuer Alternative Name extension to certificates. If no suitable attributes can be used from the request to form the issuerAlternativeName, then literal string can be used without any token expression. For example, Certificate Authority . B.1.13. Key Usage extension default This default attaches the Key Usage extension to the certificate. The extension specifies the purposes for which the key contained in a certificate should be used, such as data signing, key encryption, or data encryption, which restricts the usage of a key pair to predetermined purposes. For general information about this extension, see Section B.3.8, "keyUsage" . The following constraints can be defined with this default: Key Usage Constraint; see Section B.2.6, "Key Usage extension constraint" . Extension Constraint; see Section B.2.4, "Extension constraint" . No Constraints; see Section B.2.8, "No Constraint" . Table B.12. Key Usage extension default configuration parameters Parameter Description Critical Select true to mark this extension critical; select false to mark the extension noncritical. digitalSignature Specifies whether to allow signing SSL client certificates and S/MIME signing certificates. Select true to set. nonRepudiation Specifies whether to use for S/MIME signing certificates. Select true to set. .WARNING [WARNING] ==== Using this bit is controversial. Carefully consider the legal consequences of its use before setting it for any certificate. ==== keyEncipherment Specifies whether the public key in the subject is used to encipher private or secret keys. This is set for SSL server certificates and S/MIME encryption certificates. Select true to set. dataEncipherment Specifies whether to set the extension when the subject's public key is used to encipher user data as opposed to key material. Select true to set. keyAgreement Specifies whether to set the extension whenever the subject's public key is used for key agreement. Select true to set. keyCertsign Specifies whether the public key is used to verify the signature of other certificates. This setting is used for CA certificates. Select true to set the option. cRLSign Specifies whether to set the extension for CA signing certificates that sign CRLs. Select true to set. encipherOnly Specifies whether to set the extension if the public key is only for encrypting data while performing key agreement. If this bit is set, keyAgreement should also be set. Select true to set. decipherOnly Specifies whether to set the extension if the public key is only for decrypting data while performing key agreement. If this bit is set, keyAgreement should also be set. Select true to set. B.1.14. Name Constraints extension default This default attaches a Name Constraints extension to the certificate. The extension is used in CA certificates to indicate a name space within which the subject names or subject alternative names in subsequent certificates in a certificate chain should be located. For general information about this extension, see Section B.3.9, "nameConstraints" . The following constraints can be defined with this default: Extension Constraint; see Section B.2.4, "Extension constraint" . No Constraints; see Section B.2.8, "No Constraint" . This default defines up to five locations for both the permitted subtree and the excluded subtree and sets parameters for each location. The parameters are marked with an n in the table to show with which location the parameter is associated. Table B.13. Name Constraints extension default configuration parameters Parameter Description Critical Select true to mark this extension critical; select false to mark the extension noncritical. PermittedSubtrees n .min Specifies the minimum number of permitted subtrees. -1 specifies that the field should not be set in the extension. 0 specifies that the minimum number of subtrees is zero. n must be an integer that is greater than zero. It sets the minimum required number of subtrees. PermittedSubtreesmax _n Specifies the maximum number of permitted subtrees. -1 specifies that the field should not be set in the extension. 0 specifies that the maximum number of subtrees is zero. n must be an integer that is greater than zero. It sets the maximum number of subtrees allowed. PermittedSubtreeNameChoice _n Specifies the general name type for the permitted subtree to include in the extension. The permissible values are as follows: RFC822Name DirectoryName DNSName EDIPartyName URIName IPAddress OIDName OtherName PermittedSubtreeNameValue _n Specifies the general name value for the permitted subtree to include in the extension. For RFC822Name , the value must be a valid Internet mail address. For example, testCA@example.com . For DirectoryName , the value must be a string form of X.500 name, similar to the subject name in a certificate. For example, cn=SubCA, ou=Research Dept, o=Example Corporation, c=US . For DNSName , the value must be a valid fully-qualified domain name. For example, testCA.example.com . For EDIPartyName , the value must be an IA5String. For example, Example Corporation . For URIName , the value must be a non-relative URI following the URL syntax and encoding rules. The name must include both a scheme, such as http , and a fully qualified domain name or IP address of the host. For example, http://testCA.example.com . Certificate System supports both IPv4 and IPv6 addresses. For IPAddress , the value must be a valid IP address conforming to Classless Inter-Domain Routing (CIDR) notation. An IPv4 address must be in the n.n.n.n format, or n.n.n.n/m with a netmask - for example, 10.34.3.133 or 110.34.3.133/24 . IPv6 addresses must also conform to CIDR notation; examples with netmasks include 2620:52:0:2203:527b:9dff:fe56:4495/64 or 2001:db8::/64 . For OIDName , the value must be a unique, valid OID specified in dot-separated numeric component notation. For example, 1.2.3.4.55.6.5.99 . OtherName is used for names with any other format; this supports PrintableString , IA5String , UTF8String , BMPString , Any , and KerberosName . KerberosName has the format Realm|NameType|NameStrings , such as realm1|0|userID1,userID2 . OtherName must have the format (type)oid,string . For example, (IA5String)1.2.3.4,MyExample . PermittedSubtreeEnable _n Select true to enable this permitted subtree entry. ExcludedSubtrees n .min Specifies the minimum number of excluded subtrees. -1 specifies that the field should not be set in the extension. 0 specifies that the minimum number of subtrees is zero. n must be an integer that is greater than zero. This sets the minimum number of required subtrees. ExcludedSubtreeMax _n Specifies the maximum number of excluded subtrees. -1 specifies that the field should not be set in the extension. 0 specifies that the maximum number of subtrees is zero. n must be an integer that is greater than zero. This sets the maximum number of allowed subtrees. ExcludedSubtreeNameChoice _n Specifies the general name type for the excluded subtree to include in the extension. The permissible values are as follows: RFC822Name DirectoryName DNSName EDIPartyName URIName IPAddress OIDName OtherName ExcludedSubtreeNameValue _n Specifies the general name value for the permitted subtree to include in the extension. For RFC822Name , the value must be a valid Internet mail address. For example, testCA@example.com . For DirectoryName , the value must be an X.500 name, similar to the subject name in a certificate. For example, cn=SubCA, ou=Research Dept, o=Example Corporation, c=US . For DNSName , the value must be a valid fully-qualified domain name. For example, testCA.example.com . For EDIPartyName , the value must be an IA5String. For example, Example Corporation . For URIName , the value must be a non-relative URI following the URL syntax and encoding rules. The name must include both a scheme, such as http , and a fully qualified domain name or IP address of the host. For example, http://testCA.example.com . Certificate System supports both IPv4 and IPv6 addresses. For IPAddress , the value must be a valid IP address conforming to Classless Inter-Domain Routing (CIDR) notation. An IPv4 address must be in the n.n.n.n format, or n.n.n.n/m with a netmask - for example, 10.34.3.133 or 110.34.3.133/24 . IPv6 addresses must also conform to CIDR notation; examples with netmasks include 2620:52:0:2203:527b:9dff:fe56:4495/64 or 2001:db8::/64 . For OIDName , the value must be a unique, valid OID specified in dot-separated numeric component notation. For example, 1.2.3.4.55.6.5.99 . For OtherName , the values are names with any other format. This supports PrintableString , IA5String , UTF8String , BMPString , Any , and KerberosName . KerberosName has the format Realm|NameType|NameStrings , such as realm1|0|userID1,userID2 . OtherName must have the format (type)oid,string . For example, (IA5String)1.2.3.4,MyExample . ExcludedSubtreeEnable _n Select true to enable this excluded subtree entry. B.1.15. Netscape Certificate Type extension default WARNING This extension is obsolete. Use the Key Usage or Extended Key Usage certificate extensions instead. This default attaches a Netscape Certificate Type extension to the certificate. The extension identifies the certificate type, such as CA certificate, server SSL certificate, client SSL certificate, or S/MIME certificate. This restricts the usage of a certificate to predetermined purposes. B.1.16. Netscape Comment extension default WARNING This extension is obsolete. This default attaches a Netscape Comment extension to the certificate. The extension can be used to include textual comments in certificates. Applications that are capable of interpreting the comment display it when the certificate is used or viewed. For general information about this extension, see Section B.4.3.1.1, "netscape-comment" . The following constraints can be defined with this default: Extension Constraint; see Section B.2.4, "Extension constraint" . No Constraints; see Section B.2.8, "No Constraint" . Table B.14. Netscape Comment Extension configuration parameters Parameter Description Critical Select true to mark this extension critical; select false to mark the extension noncritical. CommentContent Specifies the content of the comment to appear in the certificate. B.1.17. No Default Extension This default can be used to set constraints when no defaults are being used. This default has no settings and sets no defaults but does allow all of the constraints available to be set. B.1.18. OCSP No Check extension default This default attaches an OCSP No Check extension to the certificate. The extension, which should be used in OCSP responder certificates only, indicates how OCSP-compliant applications can verify the revocation status of the certificate an authorized OCSP responder uses to sign OCSP responses. For general information about this extension, see Section B.3.10, "OCSPNocheck" . The following constraints can be defined with this default: Extension Constraint; see Section B.2.4, "Extension constraint" . No Constraints; see Section B.2.8, "No Constraint" . Table B.15. OCSP No Check extension default configuration parameters Parameter Description Critical Select true to mark this extension critical; select false to mark the extension noncritical. B.1.19. Policy Constraints extension default This default attaches a Policy Constraints extension to the certificate. The extension, which can be used in CA certificates only, constrains path validation in two ways: either to prohibit policy mapping or to require that each certificate in a path contain an acceptable policy identifier. The default can specify both ReqExplicitPolicy and InhibitPolicyMapping . PKIX standard requires that, if present in the certificate, the extension must never consist of a null sequence. At least one of the two specified fields must be present. For general information about this extension, see Section B.3.11, "policyConstraints" . The following constraints can be defined with this default: Extension Constraint; see Section B.2.4, "Extension constraint" . No Constraints; see Section B.2.8, "No Constraint" . Table B.16. Policy Constraints extension default configuration parameters Parameter Description Critical Select true to mark this extension critical; select false to mark the extension noncritical. reqExplicitPolicy Specifies the total number of certificates permitted in the path before an explicit policy is required. This is the number of CA certificates that can be chained below the subordinate CA certificate before an acceptable policy is required. -1 specifies that the field should not be set in the extension. 0 specifies that no subordinate CA certificates are permitted in the path before an explicit policy is required. n must be an integer that is greater than zero. It specifies the maximum number of subordinate CA certificates allowed in the path before an explicit policy is required. This number affects the number of CA certificates to be used during certificate validation. The chain starts with the end-entity certificate being validated and moving up the chain. The parameter has no effect if the extension is set in end-entity certificates. inhibitPolicyMapping Specifies the total number of certificates permitted in the path before policy mapping is no longer permitted. -1 specifies that the field should not be set in the extension. 0 specifies that no subordinate CA certificates are permitted in the path before policy mapping is no longer permitted. n must be an integer that is greater than zero. It specifies at the maximum number of subordinate CA certificates allowed in the path before policy mapping is no longer permitted. For example, a value of 1 indicates that policy mapping may be processed in certificates issued by the subject of this certificate, but not in additional certificates in the path. B.1.20. Policy Mappers extension default This default attaches a Policy Mappings extension to the certificate. The extension lists pairs of OIDs, each pair identifying two policy statements of two CAs. The pairing indicates that the corresponding policies of one CA are equivalent to policies of another CA. The extension may be useful in the context of cross-certification. If supported, the extension is included in CA certificates only. The default maps policy statements of one CA to that of another by pairing the OIDs assigned to their policy statements Each pair is defined by two parameters, issuerDomainPolicy and subjectDomainPolicy . The pairing indicates that the issuing CA considers the issuerDomainPolicy equivalent to the subjectDomainPolicy of the subject CA. The issuing CA's users may accept an issuerDomainPolicy for certain applications. The policy mapping tells these users which policies associated with the subject CA are equivalent to the policy they accept. For general information about this extension, see Section B.3.12, "policyMappings" . The following constraints can be defined with this default: Extension Constraint; see Section B.2.4, "Extension constraint" . No Constraints; see Section B.2.8, "No Constraint" . Table B.17. Policy Mappings extension default configuration parameters Parameter Description Critical Select true to mark this extension critical; select false to mark the extension noncritical. IssuerDomainPolicy _n Specifies the OID assigned to the policy statement of the issuing CA to map with the policy statement of another CA. For example, 1.2.3.4.5 . SubjectDomainPolicy _n Specifies the OID assigned to the policy statement of the subject CA that corresponds to the policy statement of the issuing CA. For example, 6.7.8.9.10 . B.1.21. Private Key Usage Period extension default The Private Key Usage Period extension allows the certificate issuer to specify a different validity period for the private key than for the certificate itself. This extension is intended for use with digital signature keys. Table B.18. Private key Usage Period configuration parameters Parameter Description Critical This extension should always be non-critical. puStartTime This parameters sets the start time. The default value is 0 , which starts the validity period from the time the extension is activated. puDurationDays This parameters sets the duration of the usage period. The default value is 365 , which sets the validity period to 365 days from the time the extension is activated. B.1.22. Signing Algorithm Default This default attaches a signing algorithm in the certificate request. This default presents an agent with the possible algorithms that can be used for signing the certificate. The following constraints can be defined with this default: Signing Algorithm Constraint; see Section B.2.10, "Signing Algorithm constraint" . No Constraints; see Section B.2.8, "No Constraint" . Table B.19. Signing Algorithm Default configuration parameters Parameter Description signingAlg Specify the default signing algorithm to be used to create this certificate. An agent can override this value by specifying one of the values contained in the signingAlgsAllowed parameter. signingAlgsAllowed Specify the signing algorithms that can be used for signing this certificate. The algorithms can be any or all of the following: MD2withRSA MD5withRSA SHA256withRSA SHA512withRSA B.1.23. Subject Alternative Name extension default This default attaches a Subject Alternative Name extension to the certificate. The extension binds additional identities, such as an email address, a DNS name, an IP address (both IPv4 and IPv6), or a URI, to the subject of the certificate. The standard requires that if the certificate subject field contains an empty sequence, then the Subject Alternative name extension must contain the subject's alternative name and that the extension be marked critical. For any of the directory-based authentication methods, the Certificate System can retrieve values for any string and byte attributes and set them in the certificate request. These attributes are set by entering them in the ldapStringAttributes and ldapByteAttributes fields defined in the automated enrollment modules. If authenticated attributes - meaning attributes stored in an LDAP database - need to be part of this extension, use values from the USDrequest.XUSD token. There is an additional attribute to insert a universally unique identifier (UUID) into the subject alt name. This option generates a random number for version 4 UUID; the pattern is defined by referencing the server which will generate the number in an additional subjAltExtSource parameter. A basic Subject Alternative Name extension default is configured in the example. Example B.1. Default Subject Alternative Name extension configuration The Subject Alternative Name extension default checks the certificate request for the profile attributes. If the request contains an attribute, the profile reads its value and sets it in the extension. It is also possible for the Subject Alternative Name extension default to insert attribute values from an LDAP directory, if LDAP-based authentication is configured. The extension added to the certificates contain all the configured attributes. The variables that can be used with the Subject Alternative Name extension default are listed in the below table. Table B.20. Variables to insert values in the subject alternative name Policy Set Token Description USDrequest.auth_token.cnUSD The LDAP common name ( cn ) attribute of the user who requested the certificate. USDrequest.auth_token.mailUSD The value of the LDAP email ( mail ) attribute of the user who requested the certificate. USDrequest.auth_token.tokenCertSubjectUSD The certificate subject name. USDrequest.auth_token.uidUSD The LDAP user ID ( uid ) attribute of the user who requested the certificate. USDrequest.auth_token.userUSD USDrequest.auth_token.userDNUSD The user DN of the user who requested the certificate. USDrequest.auth_token.useridUSD The value of the user ID attribute for the user who requested the certificate. USDrequest.uidUSD The value of the user ID attribute for the user who requested the certificate. USDrequest.profileRemoteAddrUSD The IP address of the user making the request. This can be an IPv4 or an IPv6 address, depending on the client. An IPv4 address must be in the format n.n.n.n or n.n.n.n,m.m.m.m . For example, 128.21.39.40 or 128.21.39.40,255.255.255.00 . An IPv6 address uses a 128-bit namespace, with the IPv6 address separated by colons and the netmask separated by periods. For example, 0:0:0:0:0:0:13.1.68.3 , FF01::43 , 0:0:0:0:0:0:13.1.68.3,FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:255.255.255.0 , and FF01::43,FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FF00:0000 . USDrequest.profileRemoteHostUSD The hostname or IP address of the user's machine. The hostname can be the fully-qualified domain name and the protocol, such as http://server.example.com . An IPv4 address must be in the format n.n.n.n or n.n.n.n,m.m.m.m . For example, 128.21.39.40 or 128.21.39.40,255.255.255.00 . An IPv6 address uses a 128-bit namespace, with the IPv6 address separated by colons and the netmask separated by periods. For example, 0:0:0:0:0:0:13.1.68.3 , FF01::43 , 0:0:0:0:0:0:13.1.68.3,FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:255.255.255.0 , and FF01::43,FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FF00:0000 . USDrequest.requestor_emailUSD The email address of the person who submitted the request. USDrequest.requestownerUSD The person who submitted the request. USDrequest.subjectUSD The subject name DN of the entity to which the certificate is issued. For example, uid=jsmith, e= jsmith@example.com . USDrequest.tokencuidUSD The card unique ID (CUID) of the smart card token used for requesting the enrollment. USDrequest.upnUSD The Microsoft UPN. This has the format (UTF8String)1.3.6.1.4.1.311.20.2.3,USDrequest.upnUSD . USDserver.sourceUSD Instructs the server to generate a version 4 UUID (random number) component in the subject name. This always has the format (IA5String)1.2.3.4,USDserver.sourceUSD . You can set multiple attributes for a single extension. The subjAltNameNumGNs parameter controls how many of the listed attributes are required to be added to the certificate. This parameter must be added to custom profiles and may need to be modified in the default profiles to include as many attributes as required. In the Example B.1, "Default Subject Alternative Name extension configuration" table, the subjAltNameNumGNs is set to 5 to insert the RFC822Name , DNSName , URIName , OtherName , and RFC822Name names (generic names \_0 , \_1 , \_2 \_3 and \_4 ). The following constraints can be defined with this default: Extension Constraint; see Section B.2.4, "Extension constraint" . No Constraints; see Section B.2.8, "No Constraint" . Table B.21. Subject Alternative Name extension default configuration parameters Parameter Description Critical Select true to mark this extension critical; select false to mark the extension noncritical. Pattern Specifies the request attribute value to include in the extension. The attribute value must conform to any of the supported general name types. If the server finds the attribute in the request, it sets the attribute value in the extension and adds the extension to certificates. If multiple attributes are specified and none of the attributes are present in the request, the server does not add the Subject Alternative Name extension to certificates. The permissible value is a request attribute included in the certificate request. For example, USDrequest.requestor_emailUSD . Type Specifies the general name type for the request attribute. Select RFC822Name if the request-attribute value is an email address in the local-part@domain format. For example, jdoe@example.com Select DirectoryName if the request-attribute value is an X.500 directory name, similar to the subject name in a certificate. For example, cn=Jane Doe, ou=Sales Dept, o=Example Corporation, c=US . Select DNSName if the request-attribute value is a DNS name. For example, corpDirectory.example.com . Select EDIPartyName if the request-attribute value is an EDI party name. For example, Example Corporation . Select URIName if the request-attribute value is a non-relative URI that includes both a scheme, such as http , and a fully qualified domain name or IP address of the host. For example, http://hr.example.com . Certificate System supports both IPv4 and IPv6 addresses. Select IPAddress if the request-attribute value is a valid IP address specified in dot-separated numeric component notation. For example, 128.21.39.40 . An IPv4 address must be in the format n.n.n.n or n.n.n.n,m.m.m.m . For example, 128.21.39.40 or 128.21.39.40,255.255.255.00 . An IPv6 address uses a 128-bit namespace, with the IPv6 address separated by colons and the netmask separated by periods. For example, 0:0:0:0:0:0:13.1.68.3 , FF01::43 , 0:0:0:0:0:0:13.1.68.3,FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:255.255.255.0 , and FF01::43,FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FF00:0000 . Select OIDName if the request-attribute value is a unique, valid OID specified in the dot-separated numeric component notation. For example, 1.2.3.4.55.6.5.99 . Select OtherName for names with any other format. This supports PrintableString , IA5String , UTF8String , BMPString , Any , and KerberosName . KerberosName has the format Realm|NameType|NameStrings , such as realm1|0|userID1,userID2 . OtherName must have the format (type)oid,string . For example, (IA5String)1.2.3.4,MyExample . Source Specifies an identification source or protocol to use to generate an ID. The only supported source is UUID4, which generates a random number to create the UUID. Number of Components (NumGNs) Specifies the number of name components that must be included in the subject alternative name. B.1.24. Subject Directory Attributes extension default This default attaches a Subject Directory Attributes extension to the certificate. The Subject Directory Attributes extension conveys any desired directory attribute values for the subject of the certificate. The following constraints can be defined with this default: Extension Constraint; see Section B.2.4, "Extension constraint" . No Constraints; see Section B.2.8, "No Constraint" . Table B.22. Subject Directory Attributes extension default configuration parameters Parameter Description Critical Select true to mark this extension critical; select false to mark the extension noncritical. Name The attribute name; this can be any LDAP directory attribute, such as cn or mail . Pattern Specifies the request attribute value to include in the extension. The attribute value must conform to the allowed values of the attribute. If the server finds the attribute, it sets the attribute value in the extension and adds the extension to certificates. If multiple attributes are specified and none of the attributes are present in the request, the server does not add the Subject Directory Attributes extension to certificates. For example, USDrequest.requestor_emailUSD . Enable Sets whether that attribute is able to be added to the certificate. Select true to enable the attribute. B.1.25. Subject Info Access extension default Implements an enrollment default policy that populates a Subject Information Access extension in the certificate template. This extension indicates how to access information and services for the subject of the certificate in which the extension appears. Parameter Description Critical This extension is supposed to be non-critical. subjInfoAccessNumADs The number of information access sections included with the certificate. subjInfoAccessADMethod_n OID of the access method. subjInfoAccessADMethod_n Type of access method. URIName Directory name DNS Name EID Party Name IP Address OID Name RFC822Name subjInfoAccessADLocation_n Location based on the type subjInfoAccessADMethod_n i.e., a URL for URI Name. subjInfoAccessADEnable_n Select true to enable this extension; select false to disable this extension. B.1.26. Subject Key Identifier extension default This default attaches a Subject Key Identifier extension to the certificate. The extension identifies certificates that contain a particular public key, which identifies a certificate from among several that have the same subject name. For general information about this extension, see Section B.3.16, "subjectKeyIdentifier" . If enabled, the profile adds a Subject Key Identifier Extension to an enrollment request if the extension does not already exist. If the extension exists in the request, such as a CRMF request, the default replaces the extension. After an agent approves the manual enrollment request, the profile accepts any Subject Key Identifier Extension that is already there. This default has no parameters. If used, this extension is included in the certificate with the public key information. The following constraints can be defined with this default: Extension Constraint; see Section B.2.4, "Extension constraint" . No Constraints; see Section B.2.8, "No Constraint" . B.1.27. Subject Name default This default attaches a server-side configurable subject name to the certificate request. A static subject name is used as the subject name in the certificate. The following constraints can be defined with this default: Subject Name Constraint; see Section B.2.11, "Subject Name constraint" . Unique Subject Name Constraint; see Section B.2.13, "Unique Subject Name constraint" . No Constraints; see Section B.2.8, "No Constraint" . Table B.23. Subject Name default configuration parameters Parameter Description Name Specify the subject name for this certificate. If you need to get a certificate subject name that uses the DNPATTERN value from the UidPwdDirAuth plugin, then configure the profile to use the Subject Name Default plugin and substitute the Name parameter with the "Subject Name" from the AuthToken as shown below. B.1.28. User Key default The User Key default attaches a user-supplied key into the certificate request. This is a required default. Keys are part of the enrollment request. The following constraints can be defined with this default: Key Constraint; see Section B.2.5, "Key constraint" . No Constraints; see Section B.2.8, "No Constraint" . B.1.29. User Signing Algorithm default The User Signing Algorithm default implements an enrollment default profile that populates a user-supplied signing algorithm in the certificate request. If included in the certificate profile, this allows a user to choose a signing algorithm for the certificate, subject to the constraint set. No inputs are provided to add signing algorithm choices to the enrollment form, but it is possible to submit a request that contains this information. The following constraints can be defined with this default: Signing Algorithm Constraint; see Section B.2.10, "Signing Algorithm constraint" . No Constraints; see Section B.2.8, "No Constraint" . B.1.30. User Subject Name default This default attaches a user-supplied subject name to the certificate request. If included in the certificate profile, it allows a user to supply a subject name for the certificate, subject to the constraints set. This extension preserves the subject name that is specified in the original certificate request when the certificate is issued. The following constraints can be defined with this default: Subject Name Constraint; see Section B.2.11, "Subject Name constraint" . Unique Subject Name Constraint; see Section B.2.13, "Unique Subject Name constraint" . No Constraints; see Section B.2.8, "No Constraint" . B.1.31. User Validity default This default attaches a user-supplied validity to the certificate request. If included in the certificate profile, it allows a user to supply the validity period, subject to the constraints set. This default profile preserves that user-defined validity period in the original certificate request when the certificate is issued. No inputs are provided to add user-supplied validity date to the enrollment form, but it is possible to submit a request that contains this information. The following constraints can be defined with this default: Validity Constraint; see Section B.2.14, "Validity constraint" . No Constraints; see Section B.2.8, "No Constraint" . B.1.32. User Supplied extension default The User Supplied extension default class populates a certificate with any certificate extension defined by the user in the certificate request. This requires users to submit certificate requests which meet certain standards or give certain information because the profile can require specific extensions before enrolling a certificate. WARNING Be exceptionally cautious about setting this extension default, since it allows users to specify an extension in the certificate request. If this default is used, then Red Hat strongly recommends using a constraint corresponding to the extension to minimize any possible abuse of the User Supplied extension default. The user-defined extension is validated against whatever constraint is set, so it is possible to restrict the kind of extension (through the Extension Constraint) or to set rules for the key and other basic constraints, such as whether this is a CA certificate. NOTE If this extension is set on a profile with a corresponding OID (Extension Constraint), then any certificate request processed through that profile must carry the specified extension or the request is rejected. If a certificate profile was enabled with the User Supplied extension default before the errata RHSA 2008:0500, then this profile must be edited to support user supplied extensions in certificate requests. Apply the userExtensionDefaultImpl default, as shown in the example. The given OID is for the Basic Constraints Extension Constraint. The CA handles an enrollment with the User Supplied extension default in one of three ways: If the OID of the extension is specified in both the certificate request and the default, then the extension is validated by the constraints and applied to the certificate. If an OID of an extension is given in the request but is not specified in the User Supplied extension default in the profile, then the user-specified extension is ignored, and the certificate is successfully enrolled without that extension. If this extension is set on a profile with a corresponding OID (Extension Constraint), then any certificate request processed through that profile must carry the specified extension or the request is rejected. A certificate request that contains the user-defined extensions must be submitted to the profile. The certificate enrollment forms, however, do not have any input fields for users to add user-supplied extensions. Submitting a certificate request without supplying the extension fails. The following example adds the User Supplied extension default to a profile with the Extended Key Usage Constraint. The OID specified in the userExtOID parameter is for the Extended Key Usage Extension. Example B.2. User Supplied extension default for the Extended Key Usage extension In this example, although the User Supplied extension default allows a user to specify the Extended Key Usage Extension (2.5.29.37), the constraint limits the user request to only the SSL client authentication (1.3.6.1.5.5.7.3.2) and email protection (1.3.6.1.5.5.7.3.4) uses. Editing profiles is described in Section 3.2, "Setting up certificate profiles" . Example B.3. Multiple user supplied extensions in CSR The RHCS enrollment profile framework allows to define multiple User Supplied Extensions in the same profile. For example, a combination of the following can be specified. For Extended Key Usage Extension: For Key Usage Extension: By using the following format, you can apply a policy in which the parameter of the extension: Must exist in the CSR: value = "true" Must not exist in the CSR: value = "false" Is optional : value = "-" For example: Note For an example on how to create a CSR with user-defined extensions attributes, see Section 5.2.1.2, "Using certutil to create a CSR with user-defined extensions" . B.1.32.1. Validity Default The Validity default attaches a server-side configurable validity period into the certificate request. The following constraints can be defined with this default: Validity Constraint; see Section B.2.14, "Validity constraint" . No Constraints; see Section B.2.8, "No Constraint" . Table B.24. Validity default configuration parameters Parameter Description range Specifies the validity period for this certificate. startTime Sets when the validity period begins, based on the current time. B.2. Constraints reference Constraints are used to define the allowable contents of a certificate and the values associated with that content. This section lists the predefined constraints with complete definitions of each. B.2.1. Basic Constraints extension constraint The Basic Constraints extension constraint checks if the basic constraint in the certificate request satisfies the criteria set in this constraint. Table B.25. Basic Constraints extension constraint configuration parameters Parameter Description basicConstraintsCritical Specifies whether the extension can be marked critical or noncritical. Select true to mark this extension critical; select false to prevent this extension from being marked critical. Selecting a hyphen - , implies no criticality preference. basicConstraintsIsCA Specifies whether the certificate subject is a CA. Select true to require a value of true for this parameter (is a CA); select false to disallow a value of true for this parameter; select a hyphen, - , to indicate no constraints are placed for this parameter. basicConstraintsMinPathLen Specifies the minimum allowable path length, the maximum number of CA certificates that may be chained below (subordinate to) the subordinate CA certificate being issued. The path length affects the number of CA certificates used during certificate validation. The chain starts with the end-entity certificate being validated and moves up. This parameter has no effect if the extension is set in end-entity certificates. The permissible values are 0 or n . The value must be less than the path length specified in the Basic Constraints extension of the CA signing certificate. 0 specifies that no subordinate CA certificates are allowed below the subordinate CA certificate being issued; only an end-entity certificate may follow in the path. n must be an integer greater than zero. This is the minimun number of subordinate CA certificates allowed below the subordinate CA certificate being used. basicConstraintsMaxPathLen Specifies the maximum allowable path length, the maximum number of CA certificates that may be chained below (subordinate to) the subordinate CA certificate being issued. The path length affects the number of CA certificates used during certificate validation. The chain starts with the end-entity certificate being validated and moves up. This parameter has no effect if the extension is set in end-entity certificates. The permissible values are 0 or n . The value must be greater than the path length specified in the Basic Constraints extension of the CA signing certificate. 0 specifies that no subordinate CA certificates are allowed below the subordinate CA certificate being issued; only an end-entity certificate may follow in the path. n must be an integer greater than zero. This is the maximum number of subordinate CA certificates allowed below the subordinate CA certificate being used. If the field is blank, the path length defaults to a value determined by the path length set on the Basic Constraints extension in the issuer's certificate. If the issuer's path length is unlimited, the path length in the subordinate CA certificate is also unlimited. If the issuer's path length is an integer greater than zero, the path length in the subordinate CA certificate is set to a value one less than the issuer's path length; for example, if the issuer's path length is 4, the path length in the subordinate CA certificate is set to 3. B.2.2. CA Validity constraint The CA Validity constraint checks if the validity period in the certificate template is within the CA's validity period. If the validity period of the certificate is out outside the CA certificate's validity period, the constraint is rejected. B.2.3. Extended Key Usage extension constraint The Extended Key Usage extension constraint checks if the Extended Key Usage extension on the certificate satisfies the criteria set in this constraint. Table B.26. Extended Key Usage extension constraint configuration parameters Parameter Description exKeyUsageCritical When set to true , the extension can be marked as critical. When set to false , the extension can be marked noncritical. exKeyUsageOIDs Specifies the allowable OIDs that identifies a key-usage purpose. Multiple OIDs can be added in a comma-separated list. B.2.4. Extension constraint This constraint implements the general extension constraint. It checks if the extension is present. Table B.27. Extension constraint Parameter Description extCritical Specifies whether the extension can be marked critical or noncritical. Select true to mark the extension critical; select false to mark it noncritical. Select - to enforce no preference. extOID The OID of an extension that must be present in the cert to pass the constraint. B.2.5. Key constraint This constraint checks the size of the key for RSA keys, and the name of the elliptic curve for EC keys. When used with RSA keys the KeyParameters parameter contains a comma-separated list of legal key sizes, and with EC Keys the KeyParameters parameter contains a comma-separated list of available ECC curves. Table B.28. Key constraint configuration parameters Parameter Description keyType Gives a key type; this is set to - by default and uses an RSA key system. The choices are rsa and ec. If the key type is specified and not identified by the system, the constraint will be rejected. KeyParameters Defines the specific key parameters. The parameters which are set for the key differe, depending on the value of the keyType parameter (meaning, depending on the key type). * With RSA keys, the KeyParameters parameter contains a comma-separated list of legal key sizes. * With ECC keys, the KeyParameters parameter contains a comma-separated list of available ECC curves. B.2.6. Key Usage extension constraint The Key Usage extension constraint checks if the key usage constraint in the certificate request satisfies the criteria set in this constraint. Table B.29. Key Usage extension constraint configuration parameters Parameter Description keyUsageCritical Select true to mark this extension critical; select false to mark it noncritical. Select - for no preference. keyUsageDigitalSignature Specifies whether to sign SSL client certificates and S/MIME signing certificates. Select true to mark this as set; select false to keep this from being set; select a hyphen, - , to indicate no constraints are placed for this parameter. kleyUsageNonRepudiation Specifies whether to set S/MIME signing certificates. Select true to mark this as set; select false to keep this from being set; select a hyphen, - , to indicate no constraints are placed for this parameter. .WARNING [WARNING] ==== Using this bit is controversial. Carefully consider the legal consequences of its use before setting it for any certificate. ==== keyEncipherment Specifies whether to set the extension for SSL server certificates and S/MIME encryption certificates. Select true to mark this as set; select false to keep this from being set; select a hyphen, - , to indicate no constraints are placed for this parameter. keyUsageDataEncipherment Specifies whether to set the extension when the subject's public key is used to encrypt user data, instead of key material. Select true to mark this as set; select false to keep this from being set; select a hyphen, - , to indicate no constraints are placed for this parameter. keyUsageKeyAgreement Specifies whether to set the extension whenever the subject's public key is used for key agreement. Select true to mark this as set; select false to keep this from being set; select a hyphen, - , to indicate no constraints are placed for this parameter. keyUsageCertsign Specifies whether the extension applies for all CA signing certificates. Select true to mark this as set; select false to keep this from being set; select a hyphen, - , to indicate no constraints are placed for this parameter. keyUsageCRLSign Specifies whether to set the extension for CA signing certificates that are used to sign CRLs. Select true to mark this as set; select false to keep this from being set; select a hyphen, - , to indicate no constraints are placed for this parameter. keyUsageEncipherOnly Specifies whether to set the extension if the public key is to be used only for encrypting data. If this bit is set, keyUsageKeyAgreement should also be set. Select true to mark this as set; select false to keep this from being set; select a hyphen, - , to indicate no constraints are placed for this parameter. keyUsageDecipherOnly Specifies whether to set the extension if the public key is to be used only for deciphering data. If this bit is set, keyUsageKeyAgreement should also be set. Select true to mark this as set; select false to keep this from being set; select a hyphen, - , to indicate no constraints are placed for this parameter. B.2.7. Netscape Certificate Type extension constraint WARNING This constraint is obsolete. Instead of using the Netscape Certificate Type extension constraint, use the Key Usage extension or Extended Key Usage extension. The Netscape Certificate Type extension constraint checks if the Netscape Certificate Type extension in the certificate request satisfies the criteria set in this constraint. B.2.8. No Constraint This constraint implements no constraint. When chosen along with a default, there are not constraints placed on that default. B.2.9. Renewal Grace Period constraint The Renewal Grace Period Constraint sets rules on when a user can renew a certificate based on its expiration date. For example, users cannot renew a certificate until a certain time before it expires or if it goes past a certain time after its expiration date. One important thing to remember when using this constraint is that this constraint is set on the original enrollment profile , not the renewal profile. The rules for the renewal grace period are part of the original certificate and are carried over and applied for any subsequent renewals. This constraint is only available with the No Default extension. Table B.30. Renewal Grace Period constraint configuration parameters Parameter Description renewal.graceAfter Sets the period, in days, after the certificate expires that it can be submitted for renewal. If the certificate has been expired longer that that time, then the renewal request is rejected. If no value is given, there is no limit. renewal.graceBefore Sets the period, in days, before the certificate expires that it can be submitted for renewal. If the certificate is not that close to its expiration date, then the renewal request is rejected. If no value is given, there is no limit. B.2.10. Signing Algorithm constraint The Signing Algorithm constraint checks if the signing algorithm in the certificate request satisfies the criteria set in this constraint. Table B.31. Signing Algorithms constraint configuration parameters Parameter Description signingAlgsAllowed Sets the signing algorithms that can be specified to sign the certificate. The algorithms can be any or all of the following: MD2withRSA MD5withRSA SHA256withRSA SHA512withRSA SHA256withEC SHA384withEC SHA512withEC B.2.11. Subject Name constraint The Subject Name constraint checks if the subject name in the certificate request satisfies the criteria. Table B.32. Subject Name constraint configuration parameters Parameter Description Pattern Specifies a regular expression or other string to build the subject DN. Subject names and regular expressions The regular expression for the Subject Name Constraint is matched by the Java facility for matching regular expressions. The format for these regular expressions are listed in https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/util/regex/Pattern . This allows wildcards such as asterisks ( \ *) to search for any number of the characters and periods ( . ) to search for any type character. For example, if the pattern of the subject name constraint is set to uid=. , the certificate profile framework checks if the subject name in the certificate request matches the pattern. A subject name like uid=user, o=Example, c=US satisfies the pattern uid=. . The subject name cn=user, o=example,c=US does not satisfy the pattern. uid=. * means the subject name must begin with the uid attribute; the period-asterisk ( . *) wildcards allow any type and number of characters to follow uid . It is possible to require internal patterns, such as . ou=Engineering. , which requires the ou=Engineering attribute with any kind of string before and after it. This matches cn=jdoe,ou=internal,ou=west coast,ou=engineering,o="Example Corp",st=NC as well as uid=bjensen,ou=engineering,dc=example,dc=com . Lastly, it is also possible to allow requests that are either one string or another by setting a pipe sign ( | ) between the options. For example, to permit subject names that contain either ou=engineering,ou=people or ou=engineering,o="Example Corp" , the pattern is . ou=engineering,ou=people. | . ou=engineering,o="Example Corp". . NOTE For constructing a pattern which uses a special character, such as a period ( . ), escape the character with a back slash ( \ ). For example, to search for the string o="Example Inc." , set the pattern to o="Example Inc\." . Subject names and the UID or CN in the certificate request The pattern that is used to build the subject DN can also be based on the CN or UID of the person requesting the certificate. The Subject Name Constraint sets the pattern of the CN (or UID) to recognize in the DN of the certificate request, and then the Subject Name Default builds on that CN to create the subject DN of the certificate, using a predefined directory tree. For example, to use the CN of the certificate request: B.2.12. Unique Key constraint This constraint checks that the public key is unique. Table B.33. Unique Key constraint parameters Parameter Description allowSameKeyRenewal A request is considered a renewal and is accepted if this parameter is set to true , if a public key is not unique, and if the subject DN matches an existing certificate. However, if the public key is a duplicate and does not match an existing Subject DN, the request is rejected. When the parameter is set to false , a duplicate public key request will be rejected. B.2.13. Unique Subject Name constraint The Unique Subject Name constraint restricts the server from issuing multiple certificates with the same subject names. When a certificate request is submitted, the server automatically checks the nickname against other issued certificate nicknames. This constraint can be applied to certificate enrollment and renewal through the end-entities' page. Certificates cannot have the same subject name unless one certificate is expired or revoked (and not on hold). So, active certificates cannot share a subject name, with one exception: if certificates have different key usage bits, then they can share the same subject name, because they have different uses. Table B.34. Unique Subject Name constraint configuration parameters Parameter Description enableKeyUsageExtensionChecking Optional setting which allows certificates to have the same subject name as long as their key usage settings are different. This is either true or false . The default is true , which allows duplicate subject names. B.2.14. Validity constraint The Validity constraint checks if the validity period in the certificate request satisfies the criteria. The parameters provided must be sensible values. For instance, a notBefore parameter that provides a time which has already passed will not be accepted, and a notAfter parameter that provides a time earlier than the notBefore time will not be accepted. Table B.35. Validity constraint configuration parameters Parameter Description range The range of the validity period. This is an integer which sets the number of days. The difference (in days) between the notBefore time and the notAfter time must be less than the range value, or this constraint will be rejected. notBeforeCheck Verifies that the range is not within the grace period. When the NotBeforeCheck Boolean parameter is set to true, the system will check the notBefore time is not greater than the current time plus the notBeforeGracePeriod value. If the notBeforeTime is not between the current time and the notBeforeGracePeriod value, this constraint will be rejected. notBeforeGracePeriod The grace period (in seconds) after the notBefore time. If the notBeforeTime is not between the current time and the notBeforeGracePeriod value, this constraint will be rejected. This constraint is only checked if the notBeforeCheck parameter has been set to true. notAfterCheck Verfies whether the given time is not after the expiration period. When the notAfterCheck Boolean parameter is set to true, the system will check the notAfter time is not greater than the current time. If the current time exceeds the notAfter time, this constraint will be rejected. B.3. Standard X.509 v3 certificate extension reference An X.509 v3 certificate contains an extension field that permits any number of additional fields to be added to the certificate. Certificate extensions provide a way of adding information such as alternative subject names and usage restrictions to certificates. Older Netscape servers, such as Red Hat Directory Server and Red Hat Certificate System, that were developed before PKIX part 1 standards were defined require Netscape-specific extensions. The following is an example of the section of a certificate containing X.509 v3 extensions. The Certificate System can display certificates in readable pretty-print format, as shown here. As in this example, certificate extensions appear in sequence and only one instance of a particular extension may appear per certificate; for example, a certificate may contain only one subject key identifier extension. Certificates that support these extensions have the version 0x2 (which corresponds to version 3). Example B.4. Sample pretty-print certificate extensions An object identifier (OID) is a string of numbers identifying a unique object, such as a certificate extension or a company's certificate practice statement. The Certificate System comes with a set of extension-specific profile plugin modules which enable X.509 certificate extensions to be added to the certificates the server issues. Some of the extensions contain fields for specifying OIDs. The PKIX standard recommends that all objects, such as extensions and statements, that are used in certificates be included in the form of an OID. This promotes interoperability between organizations on a shared network. If certificates will be issued that will be used on shared networks, register the OID prefixes with the appropriate registration authority. OIDs are controlled by the International Standards Organization (ISO) registration authority. In some cases, this authority is delegated by ISO to regional registration authorities. In the United States, the American National Standards Institute (ANSI) manages this registration. Using an OID registered to another organization or failing to register an OID may carry legal consequences, depending the situation. Registration may be subject to fees. For more information, contact the appropriate registration authority. To define or assign OIDs for custom objects, know the company's arc , an OID for a private enterprise. If the company does not have an arc, it needs to get one. The http://www.alvestrand.no/objectid/ has more information on registering and using OIDs. For example, the Netscape-defined OID for an extension named Netscape Certificate Comment is 2.16.840.1.113730.1.13. The OID assigned to this extension is hierarchical and includes the former Netscape company arc, 2.16.840.1 . The OID definition entry is http://www.alvestrand.no/objectid/2.16.840.1.113730.1.13.html . If an OID extension exists in a certificate and is marked critical, the application validating the certificate must be able to interpret the extension, including any optional qualifiers, or it must reject the certificate. Since it is unlikely that all applications will be able to interpret a company's custom extensions embedded in the form of OIDs, the PKIX standard recommends that the extension be always marked noncritical. This section summarizes the extension types defined as part of the Internet X.509 version 3 standard and indicates which types are recommended by the PKIX working group. This reference summarizes important information about each certificate. For complete details, see both the X.509 v3 standard, available from the ITU, and Internet X.509 Public Key Infrastructure - Certificate and CRL Profile (RFC 3280) , available at RFC 3280 . The descriptions of extensions reference the RFC and section number of the standard draft that discusses the extension; the object identifier (OID) for each extension is also provided. Each extension in a certificate can be designated as critical or noncritical. A certificate-using system, such as a web browser, must reject the certificate if it encounters a critical extension it does not recognize; however, a noncritical extension can be ignored if it is not recognized. B.3.1. authorityInfoAccess The Authority Information Access extension indicates how and where to access information about the issuer of the certificate. The extension contains an accessMethod and an accessLocation field. accessMethod specifies by OID the type and format of information about the issuer named in accessLocation . PKIX Part 1 defines one accessMethod ( id-ad-caIssuers ) to get a list of CAs that have issued certificates higher in the CA chain than the issuer of the certificate using the extension. The accessLocation field then typically contains a URL indicating the location and protocol (LDAP, HTTP, or FTP) used to retrieve the list. The Online Certificate Status Protocol (RFC 2560), available at RFC 2560 , defines an accessMethod ( id-ad-ocsp ) for using OCSP to verify certificates. The accessLocation field then contains a URL indicating the location and protocol used to access an OCSP responder that can validate the certificate. OID 1.3.6.1.5.5.7.1.1 Criticality This extension must be noncritical. B.3.2. authorityKeyIdentifier The Authority Key Identifier extension identifies the public key corresponding to the private key used to sign a certificate. This extension is useful when an issuer has multiple signing keys, such as when a CA certificate is renewed. The extension consists of one or both of the following: An explicit key identifier, set in the keyIdentifier field An issuer, set in the authorityCertIssuer field, and serial number, set in the authorityCertSerialNumber field, identifying a certificate If the keyIdentifier field exists, it is used to select the certificate with a matching subjectKeyIdentifier extension. If the authorityCertIssuer and authorityCertSerialNumber fields are present, then they are used to identify the correct certificate by issuer and serialNumber . If this extension is not present, then the issuer name alone is used to identify the issuer certificate. PKIX Part 1 requires this extension for all certificates except self-signed root CA certificates. Where a key identifier has not been established, PKIX recommends that the authorityCertIssuer and authorityCertSerialNumber fields be specified. These fields permit construction of a complete certificate chain by matching the SubjectName and CertificateSerialNumber fields in the issuer's certificate against the authortiyCertIssuer and authorityCertSerialNumber in the Authority Key Identifier extension of the subject certificate. OID 2.5.29.35 Criticality This extension is always noncritical and is always evaluated. B.3.3. basicConstraints This extension is used during the certificate chain verification process to identify CA certificates and to apply certificate chain path length constraints. The cA component should be set to true for all CA certificates. PKIX recommends that this extension should not appear in end-entity certificates. If the pathLenConstraint component is present, its value must be greater than the number of CA certificates that have been processed so far, starting with the end-entity certificate and moving up the chain. If pathLenConstraint is omitted, then all of the higher level CA certificates in the chain must not include this component when the extension is present. OID 2.5.29.19 Criticality PKIX Part 1 requires that this extension be marked critical. This extension is evaluated regardless of its criticality. B.3.4. certificatePoliciesExt The Certificate Policies extension defines one or more policies, each of which consists of an OID and optional qualifiers. The extension can include a URI to the issuer's Certificate Practice Statement or can embed issuer information, such as a user notice in text form. This information can be used by certificate-enabled applications. If this extension is present, PKIX Part 1 recommends that policies be identified with an OID only, or, if necessary, only certain recommended qualifiers. OID 2.5.29.32 Criticality This extension may be critical or noncritical. B.3.5. CRLDistributionPoints This extension defines how CRL information is obtained. It should be used if the system is configured to use CRL issuing points. If the extension contains a DistributionPointName with a type set to URI, the URI is assumed to be a pointer to the current CRL for the specified revocation reasons and will be issued by the named cRLIssuer . The expected values for the URI are those defined for the Subject Alternative Name extension. If the distributionPoint omits reasons, the CRL must include revocations for all reasons. If the distributionPoint omits cRLIssuer , the CRL must be issued by the CA that issued the certificate. PKIX recommends that this extension be supported by CAs and applications. OID 2.5.29.31 Criticality PKIX recommends that this extension be marked noncritical and that it be supported for all certificates. B.3.6. extKeyUsage The Extended Key Usage extension indicates the purposes for which the certified public key may be used. These purposes may be in addition to or in place of the basic purposes indicated in the Key Usage extension. The Extended Key Usage extension must include OCSP Signing in an OCSP responder's certificate unless the CA signing key that signed the certificates validated by the responder is also the OCSP signing key. The OCSP responder's certificate must be issued directly by the CA that signs certificates the responder will validate. The Key Usage, Extended Key Usage, and Basic Constraints extensions act together to define the purposes for which the certificate is intended to be used. Applications can use these extensions to disallow the use of a certificate in inappropriate contexts. The following tables list respectively the uses defined by PKIX for this extension, and the uses privately defined by Netscape. OID 2.5.29.37 Criticality If this extension is marked critical, the certificate must be used for one of the indicated purposes only. If it is not marked critical, it is treated as an advisory field that may be used to identify keys but does not restrict the use of the certificate to the indicated purposes. Table B.36. PKIX Extended Key Usage extension uses Use OID Server authentication 1.3.6.1.5.5.7.3.1 Client authentication 1.3.6.1.5.5.7.3.2 Code signing 1.3.6.1.5.5.7.3.3 Email 1.3.6.1.5.5.7.3.4 Timestamping 1.3.6.1.5.5.7.3.8 OCSP Signing 1.3.6.1.5.5.7.3.9 [a] [a] OCSP Signing is not defined in PKIX Part 1, but in RFC 2560, X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP. Table B.37. Private Extended Key Usage extension uses Use OID Certificate trust list signing 1.3.6.1.4.1.311.10.3.1 Microsoft Server Gated Crypto (SGC) 1.3.6.1.4.1.311.10.3.3 Microsoft Encrypted File System 1.3.6.1.4.1.311.10.3.4 Netscape SGC 2.16.840.1.113730.4.1 B.3.7. issuerAltName extension The Issuer Alternative Name extension is used to associate Internet-style identities with the certificate issuer. Names must use the forms defined for the Subject Alternative Name extension. OID 2.5.29.18 Criticality PKIX Part 1 recommends that this extension be marked noncritical. B.3.8. keyUsage The Key Usage extension defines the purpose of the key contained in the certificate. The Key Usage, Extended Key Usage, and Basic Constraints extensions act together to specify the purposes for which a certificate can be used. If this extension is included at all, set the bits as follows: digitalSignature ( 0 ) for SSL client certificates, S/MIME signing certificates, and object-signing certificates. nonRepudiation ( 1 ) for some S/MIME signing certificates and object-signing certificates. WARNING Use of this bit is controversial. Carefully consider the legal consequences of its use before setting it for any certificate. keyEncipherment ( 2 ) for SSL server certificates and S/MIME encryption certificates. dataEncipherment ( 3 ) when the subject's public key is used to encrypt user data instead of key material. keyAgreement ( 4 ) when the subject's public key is used for key agreement. keyCertSign ( 5 ) for all CA signing certificates. cRLSign ( 6 ) for CA signing certificates that are used to sign CRLs. encipherOnly ( 7 ) if the public key is used only for enciphering data. If this bit is set, keyAgreement should also be set. decipherOnly ( 8 ) if the public key is used only for deciphering data. If this bit is set, keyAgreement should also be set. Table B.38, "Certificate uses and corresponding key usage bits" summarizes the guidelines for typical certificate uses. If the keyUsage extension is present and marked critical, then it is used to enforce the usage of the certificate and key. The extension is used to limit the usage of a key; if the extension is not present or not critical, all types of usage are allowed. If the keyUsage extension is present, critical or not, it is used to select from multiple certificates for a given operation. For example, it is used to distinguish separate signing and encryption certificates for users who have separate certificates and key pairs for operations. OID 2.5.29.15 Criticality This extension may be critical or noncritical. PKIX Part 1 recommends that it should be marked critical if it is used. Table B.38. Certificate uses and corresponding key usage bits Purpose of Certificate Required Key Usage Bit CA Signing keyCertSign cRLSign SSL Client digitalSignature SSL Server keyEncipherment S/MIME Signing digitalSignature S/MIME Encryption keyEncipherment Certificate Signing keyCertSign Object Signing digitalSignature B.3.9. nameConstraints This extension, which can used in CA certificates only, defines a name space within which all subject names in subsequent certificates in a certification path must be located. OID 2.5.29.30 Criticality PKIX Part 1 requires that this extension be marked critical. B.3.10. OCSPNocheck The extension is meant to be included in an OCSP signing certificate. The extension tells an OCSP client that the signing certificate can be trusted without querying the OCSP responder (since the reply would again be signed by the OCSP responder, and the client would again request the validity status of the signing certificate). This extension is null-valued; its meaning is determined by its presence or absence. Since the presence of this extension in a certificate will cause OCSP clients to trust responses signed with that certificate, use of this extension should be managed carefully. If the OCSP signing key is compromised, the entire process of validating certificates in the PKI will be compromised for the duration of the validity period of the certificate. Therefore, certificates using OCSPNocheck should be issued with short lifetimes and be renewed frequently. OID 1.3.6.1.5.5.7.48.4 Criticality This extension should be noncritical. B.3.11. policyConstraints This extension, which is for CA certificates only, constrains path validation in two ways. It can be used to prohibit policy mapping or to require that each certificate in a path contain an acceptable policy identifier. PKIX requires that, if present, this extension must never consist of a null sequence. At least one of the two available fields must be present. OID 2.5.29.36 Criticality This extension may be critical or noncritical. B.3.12. policyMappings The Policy Mappings extension is used in CA certificates only. It lists one or more pairs of OIDs used to indicate that the corresponding policies of one CA are equivalent to policies of another CA. It may be useful in the context of cross-pair certificates. This extension may be supported by CAs and applications. OID 2.5.29.33 Criticality This extension must be noncritical. B.3.13. privateKeyUsagePeriod The Private Key Usage Period extension allows the certificate issuer to specify a different validity period for the private key than for the certificate itself. This extension is intended for use with digital signature keys. NOTE PKIX Part 1 recommends against the use of this extension. CAs conforming to PKIX Part 1 must not generate certificates with this extension. OID 2.5.29.16 B.3.14. subjectAltName The Subject Alternative Name extension includes one or more alternative (non-X.500) names for the identity bound by the CA to the certified public key. It may be used in addition to the certificate's subject name or as a replacement for it. Defined name forms include Internet electronic mail address (SMTP, as defined in RFC-822), DNS name, IP address (both IPv4 and IPv6), and uniform resource identifier (URI). PKIX requires this extension for entities identified by name forms other than the X.500 distinguished name (DN) used in the subject field. PKIX Part 1 describes additional rules for the relationship between this extension and the subject field. Email addresses may be provided in the Subject Alternative Name extension, the certificate subject name field, or both. If the email address is part of the subject name, it must be in the form of the EmailAddress attribute defined by PKCS #9. Software that supports S/MIME must be able to read an email address from either the Subject Alternative Name extension or from the subject name field. OID 2.5.29.17 Criticality If the certificate's subject field is empty, this extension must be marked critical. B.3.15. subjectDirectoryAttributes The Subject Directory Attributes extension conveys any desired directory attribute values for the subject of the certificate. It is not recommended as an essential part of the proposed PKIX standard but may be used in local environments. OID 2.5.29.9 Criticality PKIX Part 1 requires that this extension be marked noncritical. B.3.16. subjectKeyIdentifier The Subject Key Identifier extension identifies the public key certified by this certificate. This extension provides a way of distinguishing public keys if more than one is available for a given subject name. The value of this extension should be calculated by performing a SHA-1 hash of the certificate's DER-encoded subjectPublicKey , as recommended by PKIX. The Subject Key Identifier extension is used in conjunction with the Authority Key Identifier extension for CA certificates. If the CA certificate has a Subject Key Identifier extension, the key identifier in the Authority Key Identifier extension of the certificate being verified should match the key identifier of the CA's Subject Key Identifier extension. It is not necessary for the verifier to recompute the key identifier in this case. PKIX Part 1 requires this extension for all CA certificates and recommends it for all other certificates. OID 2.5.29.14 Criticality This extension is always non-critical. B.4. CRL extensions B.4.1. About CRL extensions Since its initial publication, the X.509 standard for CRL formats has been amended to include additional information within a CRL. This information is added through CRL extensions. The extensions defined by ANSI X9 and ISO/IEC/ITU for X.509 CRLs [X.509] [X9.55] allow additional attributes to be associated with CRLs. The Internet X.509 Public Key Infrastructure Certificate and CRL Profile , available at RFC 5280 , recommends a set of extensions to be used in CRLs. These extensions are called standard CRL extensions . The standard also allows custom extensions to be created and included in CRLs. These extensions are called private , proprietary , or custom CRL extensions and carry information unique to an organization or business. Applications may not able to validate CRLs that contain private critical extensions, so it is not recommended that custom extensions be used in a general context. NOTE Abstract Syntax Notation One (ASN.1) and Distinguished Encoding Rules (DER) standards are specified in the CCITT Recommendations X.208 and X.209. For a quick summary of ASN.1 and DER, see A Layman's Guide to a Subset of ASN.1, BER, and DER , which is available at RSA Laboratories' web site, http://www.rsa.com . B.4.1.1. Structure of CRL extensions A CRL extension consists of the following parts: The object identifier (OID) for the extension. This identifier uniquely identifies the extension. It also determines the ASN.1 type of value in the value field and how the value is interpreted. When an extension appears in a CRL, the OID appears as the extension ID field ( extnID ) and the corresponding ASN.1 encoded structure appears as the value of the octet string ( extnValue ); examples are shown in Example B.4, "Sample pretty-print certificate extensions" . A flag or Boolean field called critical . The true or false value assigned to this field indicates whether the extension is critical or noncritical to the CRL. If the extension is critical and the CRL is sent to an application that does not understand the extension based on the extension's ID, the application must reject the CRL. If the extension is not critical and the CRL is sent to an application that does not understand the extension based on the extension's ID, the application can ignore the extension and accept the CRL. An octet string containing the DER encoding of the value of the extension. The application receiving the CRL checks the extension ID to determine if it can recognize the ID. If it can, it uses the extension ID to determine the type of value used. B.4.1.2. Sample CRL and CRL Entry extensions The following is an example of an X.509 CRL version 2 extension. The Certificate System can display CRLs in readable pretty-print format, as shown here. As shown in the example, CRL extensions appear in sequence and only one instance of a particular extension may appear per CRL; for example, a CRL may contain only one Authority Key Identifier extension. However, CRL-entry extensions appear in appropriate entries in the CRL. A delta CRL is a subset of the CRL which contains only the changes since the last CRL was published. Any CRL which contains the delta CRL indicator extension is a delta CRL. B.4.2. Standard X.509 v3 CRL extensions reference In addition to certificate extensions, the X.509 proposed standard defines extensions to CRLs, which provide methods for associating additional attributes with Internet CRLs. These are one of two kinds: extensions to the CRL itself and extensions to individual certificate entries in the CRL. Section B.4.2.1, "Extensions for CRLs" Section B.4.2.2, "CRL Entry extensions" B.4.2.1. Extensions for CRLs The following CRL descriptions are defined as part of the Internet X.509 v3 Public Key Infrastructure proposed standard. Section B.4.2.1.1, "authorityInfoAccess" Section B.4.2.1.2, "authorityKeyIdentifier" Section B.4.2.1.3, "CRLNumber" Section B.4.2.1.4, "deltaCRLIndicator" Section B.4.2.1.5, "FreshestCRL" Section B.4.2.1.6, "issuerAltName" Section B.4.2.1.7, "issuingDistributionPoint" Section B.4.2.1.5, "FreshestCRL" B.4.2.1.1. authorityInfoAccess The Authority Information Access extension identifies how delta CRL information is obtained. The freshestCRL extension is placed in the full CRL to indicate where to find the latest delta CRL. OID 1.3.6.1.5.5.7.1.1 Criticality PKIX requires that this extension must not be critical. Table B.39. Authority Infomation Access configuration parameters Parameter Description enable Specifies whether the rule is enabled or disabled. The default is to have this extension disabled. critical Sets whether the extension is marked as critical; the default is noncritical. numberOfAccessDescriptions Indicates the number of access descriptions, from 0 to any positive integer; the default is 0. When setting this parameter to an integer other than 0, set the number, and then click OK to close the window. Re-open the edit window for the rule, and the fields to set the points will be present. accessMethod n The only accepted value for this parameter is caIssuers. The caIssuers method is used when the information available lists certificates that can be used to verify the signature on the CRL. No other method should be used when the AIA extension is included in a CRL. accessLocationType n Specifies the type of access location for the n access description. The options are either DirectoryName or URI . accessLocation n If accessLocationType is set to DirectoryName , the value must be a string in the form of an X.500 name, similar to the subject name in a certificate. For example, CN=CACentral,OU=Research Dept,O=Example Corporation,C=US . If accessLocationType is set to URI , the name must be a URI; the URI must be an absolute pathname and must specify the host. For example, http://testCA.example.com/get/crls/here/ . B.4.2.1.2. authorityKeyIdentifier The Authority Key Identifier extension for a CRL identifies the public key corresponding to the private key used to sign the CRL. For details, see the discussion under certificate extensions at Section B.3.2, "authorityKeyIdentifier" . The PKIX standard recommends that the CA must include this extension in all CRLs it issues because a CA's public key can change, for example, when the key gets updated, or the CA may have multiple signing keys because of multiple concurrent key pairs or key changeover. In these cases, the CA ends up with more than one key pair. When verifying a signature on a certificate, other applications need to know which key was used in the signature. OID 2.5.29.35 Table B.40. AuthorityKeyIdentifierExt configuration parameters Parameter Description enable Specifies whether the rule is enabled or disabled. The default is to have this extension disabled. critical Sets whether the extension is marked as critical; the default is noncritical. B.4.2.1.3. CRLNumber The CRLNumber extension specifies a sequential number for each CRL issued by a CA. It allows users to easily determine when a particular CRL supersedes another CRL. PKIX requires that all CRLs have this extension. OID 2.5.29.20 Criticality This extension must not be critical. Table B.41. CRLNumber configuration parameters Parameter Description enable Specifies whether the rule is enabled, which is the default. critical Sets whether the extension is marked as critical; the default is noncritical. B.4.2.1.4. deltaCRLIndicator The deltaCRLIndicator extension generates a delta CRL, a list only of certificates that have been revoked since the last CRL; it also includes a reference to the base CRL. This updates the local database while ignoring unchanged information already in the local database. This can significantly improve processing time for applications that store revocation information in a format other than the CRL structure. OID 2.5.29.27 Criticality PKIX requires that this extension be critical if it exists. Table B.42. DeltaCRL configuration parameters Parameter Description enable Sets whether the rule is enabled. By default, it is disabled. critical Sets whether the extension is critical or noncritical. By default, this is critical. B.4.2.1.5. FreshestCRL The freshestCRL extension identifies how delta CRL information is obtained. The freshestCRL extension is placed in the full CRL to indicate where to find the latest delta CRL. OID 2.5.29.46 Criticality PKIX requires that this extension must be noncritical. Table B.43. FreshestCRL configuration parameters Parameter Description enable Sets whether the extension rule is enabled. By default, this is disabled. critical Marks the extension as critical or noncritical. The default is noncritical. numPoints Indicates the number of issuing points for the delta CRL, from 0 to any positive integer; the default is 0 . When setting this to an integer other than 0, set the number, and then click OK to close the window. Re-open the edit window for the rule, and the fields to set these points will be present. pointType n Specifies the type of issuing point for the n issuing point. For each number specified in numPoints , there is an equal number of pointType parameters. The options are either DirectoryName or URIName . pointName n If pointType is set to directoryName , the value must be a string in the form of an X.500 name, similar to the subject name in a certificate. For example, CN=CACentral,OU=Research Dept,O=Example Corporation,C=US . If pointType is set to URIName , the name must be a URI; the URI must be an absolute pathname and must specify the host. For example, http://testCA.example.com/get/crls/here/ . B.4.2.1.6. issuerAltName The Issuer Alternative Name extension allows additional identities to be associated with the issuer of the CRL, like binding attributes such as a mail address, a DNS name, an IP address (both IPv4 and IPv6), and a uniform resource indicator (URI), with the issuer of the CRL. For details, see the discussion under certificate extensions at Section B.3.7, "issuerAltName extension" . OID 2.5.29.18 Table B.44. IssuerAlternativeName configuration parameters Parameter Description enable Sets whether the extension rule is enabled; by default, this is disabled. critical Sets whether the extension is critical; by default, this is noncritical. numNames Sets the total number of alternative names or identities permitted in the extension. Each name has a set of configuration parameters, nameType and name , which must have appropriate values or the rule returns an error. Change the total number of identities by changing the value specified in this field; there is no limit on the total number of identities that can be included in the extension. Each set of configuration parameters is distinguished by an integer derived from the value of this field. For example, if the numNames parameter is set to 2 , the derived integers are 0 and 1 . nameType n Specifies the general-name type; this can be any of the following: rfc822Name if the name is an Internet mail address. directoryName if the name is an X.500 directory name. dNSName if the name is a DNS name. ediPartyName if the name is a EDI party name. URL if the name is a URI (default). iPAddress if the name is an IP address. An IPv4 address must be in the format n.n.n.n or n.n.n.n,m.m.m.m . For example, 128.21.39.40 or 128.21.39.40,255.255.255.00 . An IPv6 address uses a 128-bit namespace, with the IPv6 address separated by colons and the netmask separated by periods. For example, 0:0:0:0:0:0:13.1.68.3 , FF01::43 , 0:0:0:0:0:0:13.1.68.3,FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:255.255.255.0 , and FF01::43,FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FF00:0000 . OID if the name is an object identifier. otherName if the name is in any other name form; this supports PrintableString , IA5String , UTF8String , BMPString , Any , and KerberosName . name n Specifies the general-name value; the allowed values depend on the name type specified in the nameType field. For rfc822Name , the value must be a valid Internet mail address in the local-part@domain format. For directoryName , the value must be a string X.500 name, similar to the subject name in a certificate. For example, CN=CACentral,OU=Research Dept,O=Example Corporation,C=US . For dNSName , the value must be a valid domain name in the DNS format. For example, testCA.example.com . For ediPartyName , the name must be an IA5String. For example, Example Corporation . For URL , the value must be a non-relative URI. For example, http://testCA.example.com . For iPAddress , the value must be a valid IP address specified in dot-separated numeric component notation. It can be the IP address or the IP address including the netmask. An IPv4 address must be in the format n.n.n.n or n.n.n.n,m.m.m.m . For example, 128.21.39.40 or 128.21.39.40,255.255.255.00 . An IPv6 address uses a 128-bit namespace, with the IPv6 address separated by colons and the netmask separated by periods. For example, 0:0:0:0:0:0:13.1.68.3 , FF01::43 , 0:0:0:0:0:0:13.1.68.3,FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:255.255.255.0 , and FF01::43,FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FF00:0000 . For OID , the value must be a unique, valid OID specified in the dot-separated numeric component notation. For example, 1.2.3.4.55.6.5.99 . Although custom OIDs can be used to evaluate and test the server, in a production environment, comply with the ISO rules for defining OIDs and for registering subtrees of IDs. For otherName , the names can be any other format; this supports PrintableString , IA5String , UTF8String , BMPString , Any , and KerberosName . PrintableString , IA5String , UTF8String , BMPString , and Any set a string to a base-64 encoded file specifying the subtree, such as /var/lib/pki/pki-tomcat/ca/othername.txt . KerberosName has the format Realm|NameType|NameStrings , such as realm1|0|userID1,userID2 . The name must be the absolute path to the file that contains the general name in its base-64 encoded format. For example, /var/lib/pki/pki-tomcat/ca/extn/ian/othername.txt . B.4.2.1.7. issuingDistributionPoint The Issuing Distribution Point CRL extension identifies the CRL distribution point for a particular CRL and indicates what kinds of revocation it covers, such as revocation of end-entity certificates only, CA certificates only, or revoked certificates that have a limited set of reason codes. PKIX Part I does not require this extension. OID 2.5.29.28 Criticality PKIX requires that this extension be critical if it exists. Table B.45. IssuingDistributionPoint configuration parameters Parameter Description enable Sets whether the extension is enabled; the default is disabled. critical Marks the extension as critical, the default, or noncritical. pointType Specifies the type of the issuing distribution point from the following: directoryName specifies that the type is an X.500 directory name. URI specifies that the type is a uniform resource indicator. RelativeToIssuer specifies that the type is a relative distinguished name (RDN), which represents a single node of a DN, such as ou=Engineering . pointName Gives the name of the issuing distribution point. The name of the distribution point depends on the value specified for the pointType parameter. For directoryName , the name must be an X.500 name. For example, cn=CRLCentral,ou=Research Dept,o=Example Corporation,c=US . For URIName , the name must be a URI that is an absolute pathname and specifies the host. For example, http://testCA.example.com/get/crls/here/ . NOTE The CRL may be stored in the directory entry corresponding to the CRL issuing point, which may be different than the directory entry of the CA. onlySomeReasons Specifies the reason codes associated with the distribution point. Permissible values are a combination of reason codes ( unspecified , keyCompromise , cACompromise , affiliationChanged , superseded , cessationOfOperation , certificateHold , and removeFromCRL ) separated by commas. Leave the field blank if the distribution point contains revoked certificates with all reason codes (default). onlyContainsCACerts Specifies that the distribution point contains user certificates only if set. By default, this is not set, which means the distribution point contains all types of certificates. indirectCRL Specifies that the distribution point contains an indirect CRL; by default, this is not selected. B.4.2.2. CRL Entry extensions The sections that follow lists the CRL entry extension types that are defined as part of the Internet X.509 v3 Public Key Infrastructure proposed standard. All of these extensions are noncritical. B.4.2.2.1. certificateIssuer The Certificate Issuer extension identifies the certificate issuer associated with an entry in an indirect CRL. This extension is used only with indirect CRLs, which are not supported by the Certificate System. OID 2.5.29.29 B.4.2.2.2. invalidityDate The Invalidity Date extension provides the date on which the private key was compromised or that the certificate otherwise became invalid. OID 2.5.29.24 Table B.46. InvalidityDate configuration parameters Parameter Description enable Sets whether the extension rule is enabled or disabled. By default, this is enabled. critical Marks the extension as critical or noncritical; by default, this is noncritical. B.4.2.2.3. CRLReason The Reason Code extension identifies the reason for certificate revocation. OID 2.5.29.21 Table B.47. CRLReason configuration parameters Parameter Description enable Sets whether the extension rule is enabled or disabled. By default, this is enabled. critical Marks the extension as critical or noncritical. By default, this is noncritical. B.4.3. Netscape-defined certificate extensions reference Netscape defined certain certificate extensions for its products. Some of the extensions are now obsolete, and others have been superseded by the extensions defined in the X.509 proposed standard. All Netscape extensions should be tagged as noncritical, so that their presence in a certificate does not make that certificate incompatible with other clients. B.4.3.1. netscape-cert-type The Netscape Certificate Type extension can be used to limit the purposes for which a certificate can be used. It has been replaced by the X.509 v3 extensions Section B.3.6, "extKeyUsage" and Section B.3.3, "basicConstraints" . If the extension exists in a certificate, it limits the certificate to the uses specified in it. If the extension is not present, the certificate can be used for all applications, except for object signing. The value is a bit-string, where the individual bit positions, when set, certify the certificate for particular uses as follows: bit 0: SSL Client certificate bit 1: SSL Server certificate bit 2: S/MIME certificate bit 3: Object Signing certificate bit 4: reserved bit 5: SSL CA certificate bit 6: S/MIME CA certificate bit 7: Object Signing CA certificate OID 2.16.840.1.113730.1.1 B.4.3.1.1. netscape-comment The value of this extension is an IA5String. It is a comment that can be displayed to the user when the certificate is viewed. OID 2.16.840.1.113730.13
policyset.serverCertSet.9.constraint.name=No Constraint policyset.serverCertSet.9.default.class_id=subjectAltNameExtDefaultImpl policyset.serverCertSet.9.default.name=Subject Alternative Name extension default policyset.serverCertSet.9.default.params.subjAltExtGNEnable_0=true policyset.serverCertSet.9.default.params.subjAltExtPattern_0=USDrequest.requestor_emailUSD policyset.serverCertSet.9.default.params.subjAltExtType_0=RFC822Name policyset.serverCertSet.9.default.params.subjAltExtGNEnable_1=true policyset.serverCertSet.9.default.params.subjAltExtPattern_1=USDrequest.SAN1USD policyset.serverCertSet.9.default.params.subjAltExtType_1=DNSName policyset.serverCertSet.9.default.params.subjAltExtGNEnable_2=true policyset.serverCertSet.9.default.params.subjAltExtPattern_2=http://www.server.example.com policyset.serverCertSet.9.default.params.subjAltExtType_2=URIName policyset.serverCertSet.9.default.params.subjAltExtType_3=OtherName policyset.serverCertSet.9.default.params.subjAltExtPattern_3=(IA5String)1.2.3.4,USDserver.sourceUSD policyset.serverCertSet.9.default.params.subjAltExtSource_3=UUID4 policyset.serverCertSet.9.default.params.subjAltExtGNEnable_3=true policyset.serverCertSet.9.default.params.subjAltExtType_4=RFC822Name policyset.serverCertSet.9.default.params.subjAltExtGNEnable_4=false policyset.serverCertSet.9.default.params.subjAltExtPattern_4= policyset.serverCertSet.9.default.params.subjAltNameExtCritical=false policyset.serverCertSet.9.default.params.subjAltNameNumGNs=5 policyset.userCertSet.1.default.class_id=subjectNameDefaultImpl policyset.userCertSet.1.default.name=Subject Name Default policyset.userCertSet.1.default.params.name=USDrequest.auth_token.tokenCertSubjectUSD policyset.set1.p6.default.class_id=userExtensionDefaultImpl policyset.set1.p6.default.name=User Supplied extension default policyset.set1.p6.default.params.userExtOID=2.5.29.19 policyset.set1.2.constraint.class_id=extendedKeyUsageExtConstraintImpl policyset.set1.2.constraint.name=Extended Key Usage Extension policyset.set1.2.constraint.params.exKeyUsageCritical=false policyset.set1.2.constraint.params.exKeyUsageOIDs=1.3.6.1.5.5.7.3.2,1.3.6.1.5.5.7.3.4 policyset.set1.2.default.class_id=userExtensionDefaultImpl policyset.set1.2.default.name=User Supplied extension default policyset.set1.2.default.params.userExtOID=2.5.29.37 policyset.serverCertSet.2.constraint.class_id=extendedKeyUsageExtConstraintImpl policyset.serverCertSet.2.constraint.name=Extended Key Usage Extension policyset.serverCertSet.2.constraint.params.exKeyUsageCritical=false policyset.serverCertSet.2.constraint.params.exKeyUsageOIDs=1.3.6.1.5.5.7.3.2,1.3.6.1.5.5.7.3.4 policyset.serverCertSet.2.default.class_id=userExtensionDefaultImpl policyset.serverCertSet.2.default.name=User Supplied extension default policyset.serverCertSet.2.default.params.userExtOID=2.5.29.37 policyset.serverCertSet.13.constraint.class_id=keyUsageExtConstraintImpl policyset.serverCertSet.13.constraint.name=Key Usage Extension Constraint policyset.serverCertSet.13.constraint.params.keyUsageCritical=- policyset.serverCertSet.13.constraint.params.keyUsageCrlSign=false policyset.serverCertSet.13.constraint.params.keyUsageDataEncipherment=- policyset.serverCertSet.13.constraint.params.keyUsageDecipherOnly=- policyset.serverCertSet.13.constraint.params.keyUsageDigitalSignature=- policyset.serverCertSet.13.constraint.params.keyUsageEncipherOnly=- policyset.serverCertSet.13.constraint.params.keyUsageKeyAgreement=true policyset.serverCertSet.13.constraint.params.keyUsageKeyCertSign=- policyset.serverCertSet.13.constraint.params.keyUsageKeyEncipherment=- policyset.serverCertSet.13.constraint.params.keyUsageNonRepudiation=- policyset.serverCertSet.13.default.class_id=userExtensionDefaultImpl policyset.serverCertSet.13.default.name=User Supplied Key Usage Extension policyset.serverCertSet.13.default.params.userExtOID=2.5.29.15 policyset.serverCertSet.1.constraint.class_id=subjectNameConstraintImpl policyset.serverCertSet.1.constraint.name=Subject Name Constraint policyset.serverCertSet.1.constraint.params.pattern=CN=[^,]+,.+ policyset.serverCertSet.1.constraint.params.accept=true policyset.serverCertSet.1.default.class_id=subjectNameDefaultImpl policyset.serverCertSet.1.default.name=Subject Name Default policyset.serverCertSet.1.default.params.name=CN=USDrequest.req_subject_name.cnUSD,DC=example, DC=com Data: Version: v3 Serial Number: 0x1 Signature Algorithm: SHA1withRSA - 1.2.840.113549.1.1.5 Issuer: CN=Certificate Manager,OU=netscape,O=ExampleCorp,L=MV,ST=CA,C=US Validity: Not Before: Friday, February 21, 2005 12:00:00 AM PST America/Los_Angeles Not After: Monday, February 21, 2007 12:00:00 AM PST America/Los_Angeles Subject: CN=Certificate Manager,OU=netscape,O=ExampleCorp,L=MV,ST=CA,C=US Subject Public Key Info: Algorithm: RSA - 1.2.840.113549.1.1.1 Public Key: Exponent: 65537 Public Key Modulus: (2048 bits) : E4:71:2A:CE:E4:24:DC:C4:AB:DF:A3:2E:80:42:0B:D9: CF:90:BE:88:4A:5C:C5:B3:73:BF:49:4D:77:31:8A:88: 15:A7:56:5F:E4:93:68:83:00:BB:4F:C0:47:03:67:F1: 30:79:43:08:1C:28:A8:97:70:40:CA:64:FA:9E:42:DF: 35:3D:0E:75:C6:B9:F2:47:0B:D5:CE:24:DD:0A:F7:84: 4E:FA:16:29:3B:91:D3:EE:24:E9:AF:F6:A1:49:E1:96: 70:DE:6F:B2:BE:3A:07:1A:0B:FD:FE:2F:75:FD:F9:FC: 63:69:36:B6:5B:09:C6:84:92:17:9C:3E:64:C3:C4:C9 Extensions: Identifier: Netscape Certificate Type - 2.16.840.1.113730.1.1 Critical: no Certificate Usage: SSL CA Secure Email CA ObjectSigning CA Identifier: Basic Constraints - 2.5.29.19 Critical: yes Is CA: yes Path Length Constraint: UNLIMITED Identifier: Subject Key Identifier - 2.5.29.14 Critical: no Key Identifier: 3B:46:83:85:27:BC:F5:9D:8E:63:E3:BE:79:EF:AF:79: 9C:37:85:84 Identifier: Authority Key Identifier - 2.5.29.35 Critical: no Key Identifier: 3B:46:83:85:27:BC:F5:9D:8E:63:E3:BE:79:EF:AF:79: 9C:37:85:84 Identifier: Key Usage: - 2.5.29.15 Critical: yes Key Usage: Digital Signature Key CertSign Crl Sign Signature: Algorithm: SHA1withRSA - 1.2.840.113549.1.1.5 Signature: AA:96:65:3D:10:FA:C7:0B:74:38:2D:93:54:32:C0:5B: 2F:18:93:E9:7C:32:E6:A4:4F:4E:38:93:61:83:3A:6A: A2:11:91:C2:D2:A3:48:07:6C:07:54:A8:B8:42:0E:B4: E4:AE:42:B4:B5:36:24:46:4F:83:61:64:13:69:03:DF: 41:88:0B:CB:39:57:8C:6B:9F:52:7E:26:F9:24:5E:E7: BC:FB:FD:93:13:AF:24:3A:8F:DB:E3:DC:C9:F9:1F:67: A8:BD:0B:95:84:9D:EB:FC:02:95:A0:49:2C:05:D4:B0: 35:EA:A6:80:30:20:FF:B1:85:C8:4B:74:D9:DC:BB:50 Certificate Revocation List: Data: Version: v2 Signature Algorithm: SHA1withRSA - 1.2.840.113549.1.1.5 Issuer: CN=Certificate Authority,O=Example Domain This Update: Wednesday, July 29, 2009 8:59:48 AM GMT-08:00 Next Update: Friday, July 31, 2009 8:59:48 AM GMT-08:00 Revoked Certificates: 1-3 of 3 Serial Number: 0x11 Revocation Date: Thursday, July 23, 2009 10:07:15 AM GMT-08:00 Extensions: Identifier: Revocation Reason - 2.5.29.21 Critical: no Reason: Privilege_Withdrawn Serial Number: 0x1A Revocation Date: Wednesday, July 29, 2009 8:50:11 AM GMT-08:00 Extensions: Identifier: Revocation Reason - 2.5.29.21 Critical: no Reason: Certificate_Hold Identifier: Invalidity Date - 2.5.29.24 Critical: no Invalidity Date: Sun Jul 26 23:00:00 GMT-08:00 2009 Serial Number: 0x19 Revocation Date: Wednesday, July 29, 2009 8:50:49 AM GMT-08:00 Extensions: Identifier: Revocation Reason - 2.5.29.21 Critical: no Reason: Key_Compromise Identifier: Invalidity Date - 2.5.29.24 Critical: no Invalidity Date: Fri Jul 24 23:00:00 GMT-08:00 2009 Extensions: Identifier: Authority Info Access: - 1.3.6.1.5.5.7.1.1 Critical: no Access Description: Method #0: ocsp Location #0: URIName: http://example.com:9180/ca/ocsp Identifier: Issuer Alternative Name - 2.5.29.18 Critical: no Issuer Names: DNSName: example.com Identifier: Authority Key Identifier - 2.5.29.35 Critical: no Key Identifier: 50:52:0C:AA:22:AC:8A:71:E3:91:0C:C5:77:21:46:9C: 0F:F8:30:60 Identifier: Freshest CRL - 2.5.29.46 Critical: no Number of Points: 1 Point 0 Distribution Point: [URIName: http://server.example.com:8443/ca/ee/ca/getCRL?op=getDeltaCRL&crlIssuingPoint=MasterCRL] Identifier: CRL Number - 2.5.29.20 Critical: no Number: 39 Identifier: Issuing Distribution Point - 2.5.29.28 Critical: yes Distribution Point: Full Name: URIName: http://example.com:9180/ca/ee/ca/getCRL?op=getCRL&crlIssuingPoint=MasterCRL Only Contains User Certificates: no Only Contains CA Certificates: no Indirect CRL: no Signature: Algorithm: SHA1withRSA - 1.2.840.113549.1.1.5 Signature: 47:D2:CD:C9:E5:F5:9D:56:0A:97:31:F5:D5:F2:51:EB: 1F:CF:FA:9E:63:D4:80:13:85:E5:D8:27:F0:69:67:B5: 89:4F:59:5E:69:E4:39:93:61:F2:E3:83:51:0B:68:26: CD:99:C4:A2:6C:2B:06:43:35:36:38:07:34:E4:93:80: 99:2F:79:FB:76:E8:3D:4C:15:5A:79:4E:E5:3F:7E:FC: D8:78:0D:1D:59:A0:4C:14:42:B7:22:92:89:38:3A:4C: 4A:3A:06:DE:13:74:0E:E9:63:74:D0:2F:46:A1:03:37: 92:F0:93:D9:AA:F8:13:C5:06:25:02:B0:FD:3B:41:E7: 62:6F:67:A3:9F:F5:FA:03:41:DA:8D:FD:EA:2F:E3:2B: 3E:F8:E9:CC:3B:9F:E4:ED:73:F2:9E:B9:54:14:C1:34: 68:A7:33:8F:AF:38:85:82:40:A2:06:97:3C:B4:88:43: 7B:AF:5D:87:C4:47:63:4A:11:65:E3:75:55:4D:98:97: C2:2E:62:08:A4:04:35:5A:FE:0A:5A:6E:F1:DE:8E:15: 27:1E:0F:87:33:14:16:2E:57:F7:DC:77:BE:D2:75:AB: A9:7C:42:1F:84:6D:40:EC:E7:ED:84:F8:14:16:28:33: FD:11:CD:C5:FC:49:B7:7B:39:57:B3:E6:36:E5:CD:B6 Certificate Revocation List: Data: Version: v2 Signature Algorithm: SHA1withRSA - 1.2.840.113549.1.1.5 Issuer: CN=Certificate Authority,O=SjcRedhat Domain This Update: Wednesday, July 29, 2009 9:02:28 AM GMT-08:00 Next Update: Thursday, July 30, 2009 9:02:28 AM GMT-08:00 Revoked Certificates: Serial Number: 0x1A Revocation Date: Wednesday, July 29, 2009 9:00:48 AM GMT-08:00 Extensions: Identifier: Revocation Reason - 2.5.29.21 Critical: no Reason: Remove_from_CRL Serial Number: 0x17 Revocation Date: Wednesday, July 29, 2009 9:02:16 AM GMT-08:00 Extensions: Identifier: Revocation Reason - 2.5.29.21 Critical: no Reason: Certificate_Hold Identifier: Invalidity Date - 2.5.29.24 Critical: no Invalidity Date: Mon Jul 27 23:00:00 GMT-08:00 2009 Extensions: Identifier: Authority Info Access: - 1.3.6.1.5.5.7.1.1 Critical: no Access Description: Method #0: ocsp Location #0: URIName: http://server.example.com:8443/ca/ocsp Identifier: Delta CRL Indicator - 2.5.29.27 Critical: yes Base CRL Number: 39 Identifier: Issuer Alternative Name - 2.5.29.18 Critical: no Issuer Names: DNSName: a-f8.sjc.redhat.com Identifier: Authority Key Identifier - 2.5.29.35 Critical: no Key Identifier: 50:52:0C:AA:22:AC:8A:71:E3:91:0C:C5:77:21:46:9C: 0F:F8:30:60 Identifier: CRL Number - 2.5.29.20 Critical: no Number: 41 Identifier: Issuing Distribution Point - 2.5.29.28 Critical: yes Distribution Point: Full Name: URIName: http://server.example.com:8443/ca/ee/ca/getCRL?op=getCRL&crlIssuingPoint=MasterCRL Only Contains User Certificates: no Only Contains CA Certificates: no Indirect CRL: no Signature: Algorithm: SHA1withRSA - 1.2.840.113549.1.1.5 Signature: 68:28:DA:90:D5:39:CB:6D:BE:42:04:77:C9:E4:09:60: C1:97:A6:99:AB:A0:5B:A2:F3:8B:5E:4E:D6:05:70:B0: 87:1F:D7:0E:4B:C6:B2:DE:8B:92:D8:7C:3B:36:1C:79: 96:2A:64:E6:7A:25:1D:E7:40:62:48:7A:24:C9:9D:11: A6:7F:BB:6B:03:A0:9C:1D:BC:1C:EE:9A:4B:A6:48:2C: 3B:5E:2B:B1:70:3C:C3:42:96:28:26:AB:82:18:F2:E9: F2:55:48:A8:7E:7F:FE:D4:3D:0B:EA:A2:2F:4E:E6:C3: C3:C1:6A:E5:C6:85:5B:42:B1:70:2A:C6:E1:D9:0C:AF: DA:01:22:FF:80:6E:2E:A7:E5:34:DC:AF:E6:C2:B5:B3: 1B:FC:28:36:8A:91:4A:22:E7:03:A5:ED:4E:62:0C:D9: 7F:81:BB:80:99:B8:61:2A:02:C6:9C:41:2E:01:82:21: 80:82:69:52:BD:B2:AA:DB:0F:80:0A:7E:2A:F3:15:32: 69:D2:40:0D:39:59:93:75:A2:ED:24:70:FB:EE:19:C0: BE:A2:14:36:D0:AC:E8:E2:EE:23:83:DD:BC:DF:38:1A: 9E:37:AF:E3:50:D9:47:9D:22:7C:36:35:BF:13:2C:16: A2:79:CF:05:41:88:8E:B6:A2:4E:B3:48:6D:69:C6:38