Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile

en · official · sha256:72b8f41dd99ea4827a79b21639cad7a897251d2344cfce2b3a30a71e26ed6aff

Cooper, et al. Standards Track [Page 21]  RFC 5280 PKIX Certificate and CRL Profile May 2008 convert such names into DNS names. The syntax and associated OID for this attribute type are provided in the ASN.1 modules in Appendix A. Rules for encoding internationalized domain names for use with the domainComponent attribute type are specified in Section 7.3. Certificate users MUST be prepared to process the issuer distinguished name and subject distinguished name (Section 4.1.2.6) fields to perform name chaining for certification path validation (Section 6). Name chaining is performed by matching the issuer distinguished name in one certificate with the subject name in a CA certificate. Rules for comparing distinguished names are specified in Section 7.1. If the names in the issuer and subject field in a certificate match according to the rules specified in Section 7.1, then the certificate is self-issued. 4.1.2.5. Validity The certificate validity period is the time interval during which the CA warrants that it will maintain information about the status of the certificate. The field is represented as a SEQUENCE of two dates: the date on which the certificate validity period begins (notBefore) and the date on which the certificate validity period ends (notAfter). Both notBefore and notAfter may be encoded as UTCTime or GeneralizedTime. CAs conforming to this profile MUST always encode certificate validity dates through the year 2049 as UTCTime; certificate validity

Referencing norms: NotAfterClosesValidityInclusive, NotBeforeOpensValidity

en · official · sha256:110ecd07127189a5a0c2d32b5b62cd87123ff8a77f56c8b58f54a36d737f8ebb

nameAssigner [0] DirectoryString OPTIONAL, partyName [1] DirectoryString } 4.2.1.7. Issuer Alternative Name As with Section 4.2.1.6, this extension is used to associate Internet style identities with the certificate issuer. Issuer alternative name MUST be encoded as in 4.2.1.6. Issuer alternative names are not processed as part of the certification path validation algorithm in Section 6. (That is, issuer alternative names are not used in name chaining and name constraints are not enforced.) Where present, conforming CAs SHOULD mark this extension as non- critical. id-ce-issuerAltName OBJECT IDENTIFIER ::= { id-ce 18 } IssuerAltName ::= GeneralNames Cooper, et al. Standards Track [Page 38]  RFC 5280 PKIX Certificate and CRL Profile May 2008 4.2.1.8. Subject Directory Attributes The subject directory attributes extension is used to convey identification attributes (e.g., nationality) of the subject. The extension is defined as a sequence of one or more attributes. Conforming CAs MUST mark this extension as non-critical. id-ce-subjectDirectoryAttributes OBJECT IDENTIFIER ::= { id-ce 9 } SubjectDirectoryAttributes ::= SEQUENCE SIZE (1..MAX) OF Attribute 4.2.1.9. Basic Constraints

Referencing norms: CaCertificateIsForCertificationOnly, CaFlagPermitsCertification, PathLenConstraintLimitsDepth, PermittedActIsCovered

en · official · sha256:401ecfeb3eda3cb36df29230313694a15d5dce5cf79ec54de7b2c52972151460

certificate in the path requires a non-NULL valid_policy_tree, a later certificate cannot remove this requirement. If initial-explicit-policy is set, then the initial value is 0, otherwise the initial value is n+1. Cooper, et al. Standards Track [Page 78]  RFC 5280 PKIX Certificate and CRL Profile May 2008 (e) inhibit_anyPolicy: an integer that indicates whether the anyPolicy policy identifier is considered a match. The integer indicates the number of non-self-issued certificates to be processed before the anyPolicy OID, if asserted in a certificate other than an intermediate self-issued certificate, is ignored. Once set, this variable may be decreased, but may not be increased. That is, if a certificate in the path inhibits processing of anyPolicy, a later certificate cannot permit it. If initial-any-policy- inhibit is set, then the initial value is 0, otherwise the

Referencing norms: CertificateIsAuthorityFromIssuerToSubject, RevocationEndsAuthority, TrustAnchorIsRootAuthority

en · official · sha256:d301cc70046c534ebb67de455e45c3fbf1e0f65844d65bbc5054ff0e5c95f1b4

(c) Assign the certificate subject name to working_issuer_name. (d) Assign the certificate subjectPublicKey to working_public_key. (e) If the subjectPublicKeyInfo field of the certificate contains an algorithm field with non-null parameters, assign the parameters to the working_public_key_parameters variable. If the subjectPublicKeyInfo field of the certificate contains an algorithm field with null parameters or parameters are omitted, compare the certificate subjectPublicKey algorithm to the working_public_key_algorithm. If the certificate subjectPublicKey algorithm and the working_public_key_algorithm are different, set the working_public_key_parameters to null.

Referencing norms: IssuerCoversWhatItCertifies, NextCertificateIsSubdelegation