Appendix B Certificate Extensions

This appendix explains both the standard certificate extensions defined by X.509 v3 and the extensions defined by Netscape that were used in versions of products released before X.509 v3 was finalized. It also provides recommendations for extensions to use with specific kinds of certificates, including both PKIX Part 1 recommendations and Netscape extensions that must be supported for compatibility with early versions of Netscape products.

• Introduction to Certificate Extensions


• Recommendations for Extension Use


• Standard X.509 v3 Certificate Extensions


• Standard X.509 v3 CRL Extensions


• Netscape-Defined Certificate Extensions


• Adding Extensions in Certificate Management System


• CA Certificates and Extension Interactions

• Trust. The X.500 specification establishes trust by means of a strict directory hierarchy. By contrast, Internet and extranet deployments frequently involve distributed trust models that do not conform to the hierarchical X.500 approach.
• Certificate use. Some organizations may wish to restrict the use of certificates for policy reasons. For example, some certificates may be restricted to client authentication only.
• Multiple certificates. It's not uncommon for certificate users to possess multiple certificates with identical subject names but different key material. In this case, it's necessary to identify which key and certificate should be used for what purpose.
• Alternate names. For some purposes, it is useful to have alternative subject names that are also bound to the public key in the certificate.
• Additional attributes. Some organizations may find it convenient to store additional information in certificates, for example for situations in which it's not possible to look up information in a directory.
• Relationship with CA. When certificate chaining involves intermediate CAs, it is useful to have information about the relationships among CAs embedded in their certificates.
• CRL checking. Since it's not always possible to check a certificate's revocation status against a directory or with the original certificate authority, it is useful for certificates to include information about where to check CRLs.

• Using certificate extensions incorrectly can lead to severe deployment problems. Make sure you have thoroughly analyzed your deployment needs and completely understand the purpose of each extension you want to use before adding them to certificates.
• Unless otherwise noted in Table B.1, the extensions indicated should be included with certificates of each type to ensure compatibility with both PKIX Part 1 and with future Netscape or iPlanet products.
• Extensions marked "required" must be supported for some existing Netscape or Microsoft products or for other reasons explained in the extenstion descriptions that follow.

• authorityInfoAccess


• authorityKeyIdentifier


• basicConstraints


• certificatePolicies


• cRLDistributionPoints


• extKeyUsage


• issuerAltName


• keyUsage


• nameConstraints


• OCSPNocheck


• policyConstraints


• policyMappings


• privateKeyUsagePeriod


• subjectAltName


• subjectDirectoryAttributes


• subjectKeyIdentifier

OID

1.3.6.1.5.5.7.1.1

http://www.ietf.org/rfc/rfc2459.txt 4.2.2.1

This extension must be noncritical.

The Authority Information Access extension indicates how and where to access information about the issuer of the certificate. The extension contains an accessMethod and an accessLocation field. The accessMethod specifies (by an OID) the type and format of information about the issuer found at the accessLocation.

Refer to "Authority Information Access Extension Policy" in Chapter 18 of Netscape Certificate Management System Administrator's Guide.

• CMS 4.1: Not supported

• CMS 4.2: Supported

Netscape recommends that you add this extension with id-ad-ocsp and the URL for an OCSP responder to every certificate that can be verified using OCSP.

Microsoft products do not currently use on-line revocation checking.

OID

2.5.29.35

http://www.ietf.org/rfc/rfc2459.txt 4.2.1.1

This extension is always noncritical and is always evaluated.

The Authority Key Identifier extension identifies the public key corresponding to the private key used to sign a certificate. This extension is useful when an issuer has multiple signing keys (for example, due to CA certificate renewal).

• an explicit key identifier (keyIdentifier field)
• an issuer (authorityCertIssuer field) and serial number (authorityCertSerialNumber field) identifying a certificate

Refer to "Authority Key Identifier Extension Policy" in Chapter 18 of Netscape Certificate Management System Administrator's Guide.

• CMS 4.1: Supported

• CMS 4.2: Supported

Netscape recommends that this extension be present in all certificates and that the authorityCertIssuer and authorityCertSerialNumber fields be specified. This extension is not supported by Navigator 3.x, but its presence in a certificate won't interfere with Navigator 3.x.

Microsoft recommends that this extension be present in all certificates and that the authorityCertIssuer and authorityCertSerialNumber fields be specified.

OID

2.5.29.19

http://www.ietf.org/rfc/rfc2459.txt 4.2.1.10

PKIX Part 1 requires that this extension be marked critical. This extension is evaluated regardless of its criticality.

This extension is used during the certificate chain verification process to identify CA certificates and to apply certificate chain path length constraints. The cA component should be set to true for all CA certificates. PKIX recommends that this extension should not appear in end-entity certificates.

Refer to "Basic Constraints Extension Policy" in Chapter 18 of Netscape Certificate Management System Administrator's Guide.

• CMS 4.1: Supported

• CMS 4.2: Supported

Netscape requires this extension for all CA certificates.

Microsoft recommends this extension for all certificates.

OID

2.5.29.32

http://www.ietf.org/rfc/rfc2459.txt 4.2.1.5

This extension may be critical or noncritical.

The Certificate Policies extension defines one or more policies, each of which consists of an OID and optional qualifiers. The extension can include a URI to the issuer's Certificate Practice Statement or can embed issuer policy information, such as a user notice in text form. This information can be used by certificate-enabled applications.

Refer to "Certificate Policies Extension Policy" in Chapter 18 of Netscape Certificate Management System Administrator's Guide.

• CMS 4.1: Not supported

• CMS 4.2: Supported

Netscape recommends that this extension be included at the discretion of the certificate issuer.

Microsoft recommends that this extension be included in all certificates.

OID

2.5.29.31

http://www.ietf.org/rfc/rfc2459.txt 4.2.1.14

PKIX recommends that this extension be marked noncritical and that it be supported for all certificates.

This extension defines how CRL information for this certificate is to be obtained. It should be used if the system is configured to use CRL issuing points.

Refer to "CRL Distribution Points Extension Policy" in Chapter 18 of Netscape Certificate Management System Administrator's Guide.

• CMS 4.1: Supported

• CMS 4.2: Supported

Netscape recommends that this extension be supported for all certificates, with the exception of self-signed root CA certificates.

Microsoft recommends that this extension be supported.

OID

2.5.29.37

http://www.ietf.org/rfc/rfc2459.txt 4.2.1.13

If this extension is marked critical, the certificate must be used for one of the indicated purposes only. If it is not marked critical, it is treated as an advisory field that may be used to identify keys but does not restrict the use of the certificate to the indicated purposes.

The Extended Key Usage extension indicates one or more purposes for which the certified public key may be used. These purposes may be in addition to or in place of the basic purposes indicated in the key usage extension.

Refer to "Extended Key Usage Extension Policy" in Chapter 18 of Netscape Certificate Management System Administrator's Guide.

• CMS 4.1: Not supported

• CMS 4.2: Supported

Netscape recommends that this extension be supported for all certificates, and requires it for all certificates that support step-up, or Server Gated Crypto (SGC). OCSP Signing should be included in all certificates issued to OCSP responders.

Microsoft products interpret this extension as follows. If the extension is not present, the certificate is considered to be valid for any usage (to support backward compatibility with certificates that did not use this extension). Otherwise, interpretation depends on usage, as follows:

• Authenticode requires that Code Signing be the unique usage specified.
• SGC operation requires that the SGC usage be specified.
• Timestamping requires that timestamping usage be specified.

OID

2.5.29.18

http://www.ietf.org/rfc/rfc2459.txt 4.2.1.8

PKIX Part 1 recommends that this extension be marked noncritical.

The Issuer Alternative Name extension is used to associate Internet-style identities with the certificate issuer. Names must use the forms defined for subjectAltName.

Refer to "Issuer Alternative Name Extension Policy" in Chapter 18 of Netscape Certificate Management System Administrator's Guide.

• CMS 4.1: Not supported

• CMS 4.2: Supported

Netscape products do not examine this extension.

Microsoft products do not examine this extension. Microsoft recommends that authorityKeyIdentifier be used rather than issuerAltName or the certificate's issuer name for the purposes of building certificate chains.

OID

2.5.29.15

http://www.ietf.org/rfc/rfc2459.txt 4.2.1.3

This extension may be critical or noncritical. PKIX Part 1 recommends that it should be marked critical if it is used.

The Key Usage extension defines the purpose of the key contained in the certificate. The Key Usage, Extended Key Usage, Basic Constraints, and Netscape Certificate Type extensions act together to specify the purposes for which a certificate can be used. For more information on interactions between these extensions in CA certificates, see CA Certificates and Extension Interactions.

• digitalSignature (0) for SSL client certificates, S/MIME signing certificates, and object-signing certificates.
• nonRepudiation (1) for some S/MIME signing certificates and object-signing certificates. Note, however, that the use of this bit is controversial. You should carefully consider the legal consequences of its use before setting it for any certificate.
• keyEncipherment (2) for SSL server certificates and S/MIME encryption certificates.
• dataEncipherment (3) when the subjects's public key is used to encipher user data (as opposed to key material).
• keyAgreement (4) whenever the subject's public key is used for key agreement.
• keyCertSign (5) for all CA signing certificates
• cRLSign (6) for CA signing certificates that are used to sign CRLs
• encipherOnly (7) if the public key is to be used only for enciphering data. If this bit is set, keyAgreement should also be set.
• decipherOnly (8) if the public key is to be used only for deciphering data. If this bit is set, keyAgreement should also be set.

Refer to "Key Usage Extension Policy" in Chapter 18 of Netscape Certificate Management System Administrator's Guide.

• CMS 4.1: Supported

• CMS 4.2: Supported

Netscape recommends this extension for all certificates if their intended purpose or purposes are known. Netscape requires this extension for all dual-key signing certificates.

Microsoft recommends this extension for all certificates if their intended purpose or purposes are known. If the extension is absent, Microsoft products will assume the certificate is valid for all usages. If the extension is present, Microsoft products will interpret the extension in the same way whether marked critical or not. If the extension is present, the actual usage must conform to the specified usage.

OID

2.5.29.30

http://www.ietf.org/rfc/rfc2459.txt 4.2.1.11

PKIX Part 1 requires that this extension be marked critical.

This extension, which can used in CA certificates only, defines a name space within which all subject names in subsequent certificates in a certification path must be located.

Refer to "Name Constraints Extension Policy" in Chapter 18 of Netscape Certificate Management System Administrator's Guide.

• CMS 4.1: Not supported

• CMS 4.2: Supported

Netscape products do not currently examine this extension.

Microsoft products do not currently examine this extension.

OID

1.3.6.1.5.5.7.48.4

http://www.ietf.org/rfc/rfc2560.txt 4.2.2.2.1

This extension should be noncritical.

The extension is meant to be included in an OCSP responder's signing certificate. The extension tells an OCSP client that the signing certificate can be trusted without querying the OCSP responder (since the reply would again be signed by the OCSP responder, and the client would again request the validity status of the signing certificate). This extension is null-valued: its meaning is determined by its presence or absence.

Refer to "OCSPNocheck Extension Policy" in Chapter 18 of Netscape Certificate Management System Administrator's Guide.

• CMS 4.1: Not supported

• CMS 4.2: Supported

Netscape recommends using this extension in OCSP responder signing certificates. The validity period should be short enough to minimize the potential impact of a compromised OCSP responder signing key to your organization.

Microsoft products do not currently use online status checking.

OID

2.5.29.36

http://www.ietf.org/rfc/rfc2459.txt 4.2.1.12

This extension may be critical or noncritical.

This extension, which is for CA certificates only, constrains path validation in two ways. It can be used to prohibit policy mapping or to require that each certificate in a path contain an acceptable policy identifier.

Refer to "Policy Constraints Extension Policy" in Chapter 18 of Netscape Certificate Management System Administrator's Guide.

• CMS 4.1: Not supported

• CMS 4.2: Supported

Netscape products do not currently examine this extension.

Microsoft products do not currently examine this extension.

OID

2.5.29.33

http://www.ietf.org/rfc/rfc2459.txt 4.2.1.6

This extension must be noncritical.

The Policy Mappings extension is used in CA certificates only. It lists one or more pairs of OIDs used to indicate that the corresponding policies of one CA are equivalent to policies of another CA. It may be useful in the context of cross-certification.

Refer to "Policy Mappings Extension Policy" in Chapter 18 of Netscape Certificate Management System Administrator's Guide.

• CMS 4.1: Not supported

• CMS 4.2: Supported

Netscape products do not currently examine this extension.

Microsoft products do not currently examine this extension.

OID

2.5.29.16

http://www.ietf.org/rfc/rfc2459.txt 4.2.1.4

The Private Key Usage Period extension allows the certificate issuer to specify a different validity period for the private key than for the certificate itself. This extension is intended for use with digital signature keys.

Refer to "Private Key Usage Period Extension Policy" in Chapter 18 of Netscape Certificate Management System Administrator's Guide.

• CMS 4.1: Not supported

• CMS 4.2: Supported

Netscape recommends against the use of this extension.

Microsoft recommends against the use of this extension.

OID

2.5.29.17

http://www.ietf.org/rfc/rfc2459.txt 4.2.1.7

If the certificate's subject field is empty, this extension must be marked critical.

The Subject Alternative Name extension includes one or more alternative (non-X.500) names for the identity bound by the CA to the certified public key. It may be used in addition to the certificate's subject name or as a replacement for it. Defined name forms include Internet electronic mail address (SMTP, as defined in RFC-822), DNS name, IP address, and uniform resource identifier (URI).

Refer to "Subject Alternative Name Extension Policy" in Chapter 18 of Netscape Certificate Management System Administrator's Guide.

• CMS 4.1: Supported

• CMS 4.2: Supported

Netscape recommends the use of this extension with all certificates issued by a CA (except for SSL client certificates).

Microsoft recommends the use of this extension whenever X.500 guidelines are insufficient for naming purposes. Currently, no Microsoft products require the use of Subject Alternative Name. All Microsoft products that support S/MIME are capable of reading email names from this extension or from the subject name. Future versions of Microsoft Exchange Server will issue certificates with X.500 names that do not contain the Email Address attribute, and will place the SMTP address in the Subject Alternative Name extension.

OID

2.5.29.9

http://www.ietf.org/rfc/rfc2459.txt 4.2.1.9

PKIX Part 1 requires that this extension be marked noncritical.

The Subject Directory Attributes extension conveys any desired directory attribute values for the subject of the certificate. It is not recommended as an essential part of the proposed PKIX standard, but may be used in local environments.

Refer to "Subject Directory Attributes Extension Policy" in Chapter 18 of Netscape Certificate Management System Administrator's Guide.

• CMS 4.1: Not supported

• CMS 4.2: Supported

Netscape products do not examine this extension.

Microsoft products do not examine this extension.

OID

2.5.29.14

http://www.ietf.org/rfc/rfc2459.txt 4.2.1.2

This extension is always noncritical.

The Subject Key Identifier extension identifies the public key certified by this certificate. This extension provides a way of distinguishing public keys if more than one is available for a given subject name, for example after the certificate has been renewed with a new key.

Refer to "Subject Key Identifier Extension Policy" in Chapter 18 of Netscape Certificate Management System Administrator's Guide.

• CMS 4.1: Supported

• CMS 4.2: Supported

Netscape recommends this extension for all certificates.

Microsoft recommends this extension for all certificates.

• Extensions for CRLs


• CRL Entry Extensions

The sections that follow describe the CRL extension types that are defined as part of the Internet X.509 v3 Public Key Infrastructure proposed standard, as of September 1998.

• authorityKeyIdentifier


• CRLNumber


• deltaCRLIndicator


• issuerAltName


• issuingDistributionPoint

OID

2.5.29.35

http://www.ietf.org/rfc/rfc2459.txt 5.2.1

The Authority Key Identifier extension for a CRL identifies the public key corresponding to the private key used to sign the CRL. For details, see the discussion under certificate extensions at authorityKeyIdentifier.

OID

2.5.29.20

http://www.ietf.org/rfc/rfc2459.txt 5.2.3

This extension must not be critical.

The CRL Number extension specifies a sequential number for each CRL issued by a CA. It allows users to easily determine when a particular CRL supersedes another CRL.

OID

2.5.29.27

http://www.ietf.org/rfc/rfc2459.txt 5.2.4

PKIX requires that this extension be critical if it exists.

The Delta CRL Indicator extension identifies a delta-CRL. The use of delta-CRLs allows changes to be added to the local database while ignoring unchanged information that is already in the local database. This can significantly improve processing time for applications that store revocation information in a format other than the CRL structure.

OID

2.5.29.18

http://www.ietf.org/rfc/rfc2459.txt 5.2.2

The Issuer Alternative Name extension allows additional identities to be associated with the issuer of the CRL. For details, see the discussion under certificate extensions at issuerAltName.

OID

2.5.29.28

http://www.ietf.org/rfc/rfc2459.txt 5.2.5

PKIX requires that this extension be critical if it exists.

The Issuing Distribution Point CRL extension identifies the CRL distribution point for a particular CRL and indicates what kinds of revocation it covers.

The sections that follow lists the CRL entry extension types that are defined as part of the Internet X.509 v3 Public Key Infrastructure proposed standard, as of September 1998. All of these extensions are noncritical.

• certificateIssuer


• holdInstructionCode


• invalidityDate


• reasonCode

OID

2.5.29.29

http://www.ietf.org/rfc/rfc2459.txt 5.3.4

The Certificate Issuer extension identifies the certificate issuer associated with an entry in an indirect CRL.

OID

2.5.29.23

http://www.ietf.org/rfc/rfc2459.txt 5.3.2

The Hold Instruction Code extension indicates the action to be taken after encountering a certificate that has been placed on hold.

OID

2.5.29.24

http://www.ietf.org/rfc/rfc2459.txt 5.3.3

The Invalidity Date extension provides the date on which the private key was compromised or that the certificate otherwise became invalid.

OID

2.5.29.21

http://www.ietf.org/rfc/rfc2459.txt 5.3.1

The Reason Code extension identifies the reason for certificate revocation.

OID

2.16.840.1.113730.1

The Netscape Certificate Type extension can be used to limit the purposes for which a certificate can be used. It has been replaced by the X.509 v3 extensions extKeyUsage and basicConstraints, but must still be supported in deployments that include Navigator 3.x clients.

• bit 0: SSL Client certificate


• bit 1: SSL Server certificate


• bit 2: S/MIME certificate


• bit 3: Object-signing certificate


• bit 4: Reserved for future use


• bit 5: SSL CA certificate


• bit 6: S/MIME CA certificate


• bit 7: Object-signing CA certificate

OID

2.16.840.1.113730.13

The value of this extension is an IA5String. It is a comment that can be displayed to the user when the certificate is viewed.

• CA certificates must have either the basicConstraints extension, the netscape-cert-type extension with one or more CA bits set, or both, as described above.
• If CAs issue multiple certificates for the same identity, for example for separate signing and encryption keys, they must include the keyUsage extension in the subject certificates.
• If CAs ever intend to generate new keys for their CA, they must add the authorityKeyIdentifier extension to all subject certificates. If the key ID is anything other than the SHA-1 hash of the CA certificates subjectPublicKeyInfo field, then the CA certificate should contain the subjectKeyIdentifier extension. This will allow for a smooth transition when the new issuing certificate becomes active.