Network Working Group R. Housley
Request for Comments: 2459 SPYRUS
Category: Standards Track W. Ford
VeriSign
W. Polk
NIST
D. Solo
Citicorp
January 1999
Network Working Group R. Housley
Request for Comments: 2459 SPYRUS
Category: Standards Track W. Ford
VeriSign
W. Polk
NIST
D. Solo
Citicorp
January 1999
Internet X.509 Public Key Infrastructure Certificate and CRL Profile
Internet X.509公钥基础设施证书和CRL配置文件
Status of this Memo
本备忘录的状况
This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited.
本文件规定了互联网社区的互联网标准跟踪协议，并要求进行讨论和提出改进建议。有关本协议的标准化状态和状态，请参考当前版本的“互联网官方协议标准”（STD 1）。本备忘录的分发不受限制。
Copyright Notice
版权公告
Copyright (C) The Internet Society (1999). All Rights Reserved.
版权所有（C）互联网协会（1999年）。版权所有。
Abstract
摘要
This memo profiles the X.509 v3 certificate and X.509 v2 CRL for use in the Internet. An overview of the approach and model are provided as an introduction. The X.509 v3 certificate format is described in detail, with additional information regarding the format and semantics of Internet name forms (e.g., IP addresses). Standard certificate extensions are described and one new Internet-specific extension is defined. A required set of certificate extensions is specified. The X.509 v2 CRL format is described and a required extension set is defined as well. An algorithm for X.509 certificate path validation is described. Supplemental information is provided describing the format of public keys and digital signatures in X.509 certificates for common Internet public key encryption algorithms (i.e., RSA, DSA, and Diffie-Hellman). ASN.1 modules and examples are provided in the appendices.
此备忘录概述了用于Internet的X.509 v3证书和X.509 v2 CRL。该方法和模型的概述作为引言提供。详细描述了X.509 v3证书格式，并提供了有关Internet名称格式和语义（例如IP地址）的附加信息。描述了标准证书扩展，并定义了一个新的特定于Internet的扩展。指定了所需的证书扩展集。描述了X.509 v2 CRL格式，并定义了所需的扩展集。描述了一种X.509证书路径验证算法。提供了补充信息，描述了通用Internet公钥加密算法（即RSA、DSA和Diffie-Hellman）的X.509证书中公钥和数字签名的格式。附录中提供了ASN.1模块和示例。
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.
本文件中的关键词“必须”、“不得”、“要求”、“应”、“不得”、“应”、“不应”、“建议”、“可”和“可选”应按照RFC 2119中的说明进行解释。
Please send comments on this document to the ietf-pkix@imc.org mail list.
请将对本文件的意见发送至ietf-pkix@imc.org邮件列表。
TTTTaaaabbbblllleeee ooooffff CCCCoooonnnntttteeeennnnttttssss
TTTTaaaabbbblllleeee ooooffff CCCCoooonnnntttteeeennnnttttssss
1 Introduction ................................................ 5
2 Requirements and Assumptions ................................ 6
2.1 Communication and Topology ................................ 6
2.2 Acceptability Criteria .................................... 7
2.3 User Expectations ......................................... 7
2.4 Administrator Expectations ................................ 7
3 Overview of Approach ........................................ 7
3.1 X.509 Version 3 Certificate ............................... 9
3.2 Certification Paths and Trust ............................. 10
3.3 Revocation ................................................ 12
3.4 Operational Protocols ..................................... 13
3.5 Management Protocols ...................................... 13
4 Certificate and Certificate Extensions Profile .............. 15
4.1 Basic Certificate Fields .................................. 15
4.1.1 Certificate Fields ...................................... 16
4.1.1.1 tbsCertificate ........................................ 16
4.1.1.2 signatureAlgorithm .................................... 16
4.1.1.3 signatureValue ........................................ 17
4.1.2 TBSCertificate .......................................... 17
4.1.2.1 Version ............................................... 17
4.1.2.2 Serial number ......................................... 18
4.1.2.3 Signature ............................................. 18
4.1.2.4 Issuer ................................................ 18
4.1.2.5 Validity .............................................. 21
4.1.2.5.1 UTCTime ............................................. 22
4.1.2.5.2 GeneralizedTime ..................................... 22
4.1.2.6 Subject ............................................... 22
4.1.2.7 Subject Public Key Info ............................... 23
4.1.2.8 Unique Identifiers .................................... 24
4.1.2.9 Extensions ............................................. 24
4.2 Certificate Extensions .................................... 24
4.2.1 Standard Extensions ..................................... 25
4.2.1.1 Authority Key Identifier .............................. 25
4.2.1.2 Subject Key Identifier ................................ 26
4.2.1.3 Key Usage ............................................. 27
4.2.1.4 Private Key Usage Period .............................. 29
4.2.1.5 Certificate Policies .................................. 29
4.2.1.6 Policy Mappings ....................................... 31
4.2.1.7 Subject Alternative Name .............................. 32
1 Introduction ................................................ 5
2 Requirements and Assumptions ................................ 6
2.1 Communication and Topology ................................ 6
2.2 Acceptability Criteria .................................... 7
2.3 User Expectations ......................................... 7
2.4 Administrator Expectations ................................ 7
3 Overview of Approach ........................................ 7
3.1 X.509 Version 3 Certificate ............................... 9
3.2 Certification Paths and Trust ............................. 10
3.3 Revocation ................................................ 12
3.4 Operational Protocols ..................................... 13
3.5 Management Protocols ...................................... 13
4 Certificate and Certificate Extensions Profile .............. 15
4.1 Basic Certificate Fields .................................. 15
4.1.1 Certificate Fields ...................................... 16
4.1.1.1 tbsCertificate ........................................ 16
4.1.1.2 signatureAlgorithm .................................... 16
4.1.1.3 signatureValue ........................................ 17
4.1.2 TBSCertificate .......................................... 17
4.1.2.1 Version ............................................... 17
4.1.2.2 Serial number ......................................... 18
4.1.2.3 Signature ............................................. 18
4.1.2.4 Issuer ................................................ 18
4.1.2.5 Validity .............................................. 21
4.1.2.5.1 UTCTime ............................................. 22
4.1.2.5.2 GeneralizedTime ..................................... 22
4.1.2.6 Subject ............................................... 22
4.1.2.7 Subject Public Key Info ............................... 23
4.1.2.8 Unique Identifiers .................................... 24
4.1.2.9 Extensions ............................................. 24
4.2 Certificate Extensions .................................... 24
4.2.1 Standard Extensions ..................................... 25
4.2.1.1 Authority Key Identifier .............................. 25
4.2.1.2 Subject Key Identifier ................................ 26
4.2.1.3 Key Usage ............................................. 27
4.2.1.4 Private Key Usage Period .............................. 29
4.2.1.5 Certificate Policies .................................. 29
4.2.1.6 Policy Mappings ....................................... 31
4.2.1.7 Subject Alternative Name .............................. 32
4.2.1.8 Issuer Alternative Name ............................... 34
4.2.1.9 Subject Directory Attributes .......................... 34
4.2.1.10 Basic Constraints .................................... 35
4.2.1.11 Name Constraints ..................................... 35
4.2.1.12 Policy Constraints ................................... 37
4.2.1.13 Extended key usage field ............................. 38
4.2.1.14 CRL Distribution Points .............................. 39
4.2.2 Private Internet Extensions ............................. 40
4.2.2.1 Authority Information Access .......................... 41
5 CRL and CRL Extensions Profile .............................. 42
5.1 CRL Fields ................................................ 43
5.1.1 CertificateList Fields .................................. 43
5.1.1.1 tbsCertList ........................................... 44
5.1.1.2 signatureAlgorithm .................................... 44
5.1.1.3 signatureValue ........................................ 44
5.1.2 Certificate List "To Be Signed" ......................... 44
5.1.2.1 Version ............................................... 45
5.1.2.2 Signature ............................................. 45
5.1.2.3 Issuer Name ........................................... 45
5.1.2.4 This Update ........................................... 45
5.1.2.5 Next Update ........................................... 45
5.1.2.6 Revoked Certificates .................................. 46
5.1.2.7 Extensions ............................................ 46
5.2 CRL Extensions ............................................ 46
5.2.1 Authority Key Identifier ................................ 47
5.2.2 Issuer Alternative Name ................................. 47
5.2.3 CRL Number .............................................. 47
5.2.4 Delta CRL Indicator ..................................... 48
5.2.5 Issuing Distribution Point .............................. 48
5.3 CRL Entry Extensions ...................................... 49
5.3.1 Reason Code ............................................. 50
5.3.2 Hold Instruction Code ................................... 50
5.3.3 Invalidity Date ......................................... 51
5.3.4 Certificate Issuer ...................................... 51
6 Certificate Path Validation ................................. 52
6.1 Basic Path Validation ..................................... 52
6.2 Extending Path Validation ................................. 56
7 Algorithm Support ........................................... 57
7.1 One-way Hash Functions .................................... 57
7.1.1 MD2 One-way Hash Function ............................... 57
7.1.2 MD5 One-way Hash Function ............................... 58
7.1.3 SHA-1 One-way Hash Function ............................. 58
7.2 Signature Algorithms ...................................... 58
7.2.1 RSA Signature Algorithm ................................. 59
7.2.2 DSA Signature Algorithm ................................. 60
7.3 Subject Public Key Algorithms ............................. 60
7.3.1 RSA Keys ................................................ 61
7.3.2 Diffie-Hellman Key Exchange Key ......................... 61
4.2.1.8 Issuer Alternative Name ............................... 34
4.2.1.9 Subject Directory Attributes .......................... 34
4.2.1.10 Basic Constraints .................................... 35
4.2.1.11 Name Constraints ..................................... 35
4.2.1.12 Policy Constraints ................................... 37
4.2.1.13 Extended key usage field ............................. 38
4.2.1.14 CRL Distribution Points .............................. 39
4.2.2 Private Internet Extensions ............................. 40
4.2.2.1 Authority Information Access .......................... 41
5 CRL and CRL Extensions Profile .............................. 42
5.1 CRL Fields ................................................ 43
5.1.1 CertificateList Fields .................................. 43
5.1.1.1 tbsCertList ........................................... 44
5.1.1.2 signatureAlgorithm .................................... 44
5.1.1.3 signatureValue ........................................ 44
5.1.2 Certificate List "To Be Signed" ......................... 44
5.1.2.1 Version ............................................... 45
5.1.2.2 Signature ............................................. 45
5.1.2.3 Issuer Name ........................................... 45
5.1.2.4 This Update ........................................... 45
5.1.2.5 Next Update ........................................... 45
5.1.2.6 Revoked Certificates .................................. 46
5.1.2.7 Extensions ............................................ 46
5.2 CRL Extensions ............................................ 46
5.2.1 Authority Key Identifier ................................ 47
5.2.2 Issuer Alternative Name ................................. 47
5.2.3 CRL Number .............................................. 47
5.2.4 Delta CRL Indicator ..................................... 48
5.2.5 Issuing Distribution Point .............................. 48
5.3 CRL Entry Extensions ...................................... 49
5.3.1 Reason Code ............................................. 50
5.3.2 Hold Instruction Code ................................... 50
5.3.3 Invalidity Date ......................................... 51
5.3.4 Certificate Issuer ...................................... 51
6 Certificate Path Validation ................................. 52
6.1 Basic Path Validation ..................................... 52
6.2 Extending Path Validation ................................. 56
7 Algorithm Support ........................................... 57
7.1 One-way Hash Functions .................................... 57
7.1.1 MD2 One-way Hash Function ............................... 57
7.1.2 MD5 One-way Hash Function ............................... 58
7.1.3 SHA-1 One-way Hash Function ............................. 58
7.2 Signature Algorithms ...................................... 58
7.2.1 RSA Signature Algorithm ................................. 59
7.2.2 DSA Signature Algorithm ................................. 60
7.3 Subject Public Key Algorithms ............................. 60
7.3.1 RSA Keys ................................................ 61
7.3.2 Diffie-Hellman Key Exchange Key ......................... 61
7.3.3 DSA Signature Keys ...................................... 63
8 References .................................................. 64
9 Intellectual Property Rights ................................ 66
10 Security Considerations .................................... 67
Appendix A. ASN.1 Structures and OIDs ......................... 70
A.1 Explicitly Tagged Module, 1988 Syntax ...................... 70
A.2 Implicitly Tagged Module, 1988 Syntax ...................... 84
Appendix B. 1993 ASN.1 Structures and OIDs .................... 91
B.1 Explicitly Tagged Module, 1993 Syntax ...................... 91
B.2 Implicitly Tagged Module, 1993 Syntax ...................... 108
Appendix C. ASN.1 Notes ....................................... 116
Appendix D. Examples .......................................... 117
D.1 Certificate ............................................... 117
D.2 Certificate ............................................... 120
D.3 End-Entity Certificate Using RSA .......................... 123
D.4 Certificate Revocation List ............................... 126
Appendix E. Authors' Addresses ................................ 128
Appendix F. Full Copyright Statement .......................... 129
7.3.3 DSA Signature Keys ...................................... 63
8 References .................................................. 64
9 Intellectual Property Rights ................................ 66
10 Security Considerations .................................... 67
Appendix A. ASN.1 Structures and OIDs ......................... 70
A.1 Explicitly Tagged Module, 1988 Syntax ...................... 70
A.2 Implicitly Tagged Module, 1988 Syntax ...................... 84
Appendix B. 1993 ASN.1 Structures and OIDs .................... 91
B.1 Explicitly Tagged Module, 1993 Syntax ...................... 91
B.2 Implicitly Tagged Module, 1993 Syntax ...................... 108
Appendix C. ASN.1 Notes ....................................... 116
Appendix D. Examples .......................................... 117
D.1 Certificate ............................................... 117
D.2 Certificate ............................................... 120
D.3 End-Entity Certificate Using RSA .......................... 123
D.4 Certificate Revocation List ............................... 126
Appendix E. Authors' Addresses ................................ 128
Appendix F. Full Copyright Statement .......................... 129
1 Introduction
1导言
This specification is one part of a family of standards for the X.509 Public Key Infrastructure (PKI) for the Internet. This specification is a standalone document; implementations of this standard may proceed independent from the other parts.
本规范是互联网X.509公钥基础设施（PKI）标准系列的一部分。本规范为独立文件；本标准的实施可独立于其他部分进行。
This specification profiles the format and semantics of certificates and certificate revocation lists for the Internet PKI. Procedures are described for processing of certification paths in the Internet environment. Encoding rules are provided for popular cryptographic algorithms. Finally, ASN.1 modules are provided in the appendices for all data structures defined or referenced.
本规范概述了Internet PKI证书和证书撤销列表的格式和语义。描述了在Internet环境中处理认证路径的过程。为流行的加密算法提供了编码规则。最后，附录中为所有定义或引用的数据结构提供了ASN.1模块。
The specification describes the requirements which inspire the creation of this document and the assumptions which affect its scope in Section 2. Section 3 presents an architectural model and describes its relationship to previous IETF and ISO/IEC/ITU standards. In particular, this document's relationship with the IETF PEM specifications and the ISO/IEC/ITU X.509 documents are described.
本规范描述了激发本文件创建的要求以及影响第2节范围的假设。第3节介绍了体系结构模型，并描述了其与以前的IETF和ISO/IEC/ITU标准的关系。特别是，本文件与IETF PEM规范和ISO/IEC/ITU X.509文件的关系进行了说明。
The specification profiles the X.509 version 3 certificate in Section 4, and the X.509 version 2 certificate revocation list (CRL) in Section 5. The profiles include the identification of ISO/IEC/ITU and ANSI extensions which may be useful in the Internet PKI. The profiles are presented in the 1988 Abstract Syntax Notation One (ASN.1) rather than the 1994 syntax used in the ISO/IEC/ITU standards.
该规范在第4节中概述了X.509版本3证书，在第5节中概述了X.509版本2证书撤销列表（CRL）。这些概要文件包括ISO/IEC/ITU和ANSI扩展的标识，这些扩展可能在Internet PKI中有用。这些概要文件在1988年抽象语法符号1（ASN.1）中给出，而不是ISO/IEC/ITU标准中使用的1994年语法。
This specification also includes path validation procedures in Section 6. These procedures are based upon the ISO/IEC/ITU definition, but the presentation assumes one or more self-signed trusted CA certificates. Implementations are required to derive the same results but are not required to use the specified procedures.
本规范还包括第6节中的路径验证程序。这些过程基于ISO/IEC/ITU定义，但演示文稿假定有一个或多个自签名的可信CA证书。实现需要派生相同的结果，但不需要使用指定的过程。
Section 7 of the specification describes procedures for identification and encoding of public key materials and digital signatures. Implementations are not required to use any particular cryptographic algorithms. However, conforming implementations which use the identified algorithms are required to identify and encode the public key materials and digital signatures as described.
本规范第7节描述了公钥材料和数字签名的识别和编码程序。实现不需要使用任何特定的加密算法。然而，需要使用所识别算法的一致性实现来识别和编码所描述的公钥材料和数字签名。
Finally, four appendices are provided to aid implementers. Appendix A contains all ASN.1 structures defined or referenced within this specification. As above, the material is presented in the 1988 Abstract Syntax Notation One (ASN.1) rather than the 1994 syntax. Appendix B contains the same information in the 1994 ASN.1 notation as a service to implementers using updated toolsets. However, Appendix A takes precedence in case of conflict. Appendix C contains
最后，提供了四个附录以帮助实施者。附录A包含本规范中定义或引用的所有ASN.1结构。如上所述，该材料采用1988年的抽象语法符号1（ASN.1），而不是1994年的语法。附录B包含1994年ASN.1符号中的相同信息，作为使用更新工具集的实施者的服务。但是，如果发生冲突，以附录A为准。附录C包含
notes on less familiar features of the ASN.1 notation used within this specification. Appendix D contains examples of a conforming certificate and a conforming CRL.
关于本规范中使用的ASN.1符号不太熟悉的特性的注释。附录D包含合格证书和合格CRL的示例。
2 Requirements and Assumptions
2要求和假设
The goal of this specification is to develop a profile to facilitate the use of X.509 certificates within Internet applications for those communities wishing to make use of X.509 technology. Such applications may include WWW, electronic mail, user authentication, and IPsec. In order to relieve some of the obstacles to using X.509 certificates, this document defines a profile to promote the development of certificate management systems; development of application tools; and interoperability determined by policy.
本规范的目标是为希望使用X.509技术的社区开发一个配置文件，以促进在互联网应用程序中使用X.509证书。此类应用程序可以包括WWW、电子邮件、用户身份验证和IPsec。为了消除使用X.509证书的一些障碍，本文件定义了一个概要文件，以促进证书管理系统的开发；开发应用工具；互操作性由策略决定。
Some communities will need to supplement, or possibly replace, this profile in order to meet the requirements of specialized application domains or environments with additional authorization, assurance, or operational requirements. However, for basic applications, common representations of frequently used attributes are defined so that application developers can obtain necessary information without regard to the issuer of a particular certificate or certificate revocation list (CRL).
一些社区将需要补充或可能替换此配置文件，以满足具有额外授权、保证或操作要求的专用应用程序域或环境的要求。但是，对于基本应用程序，定义了常用属性的通用表示，以便应用程序开发人员可以获得必要的信息，而不必考虑特定证书或证书吊销列表（CRL）的颁发者。
A certificate user should review the certificate policy generated by the certification authority (CA) before relying on the authentication or non-repudiation services associated with the public key in a particular certificate. To this end, this standard does not prescribe legally binding rules or duties.
在依赖与特定证书中的公钥相关联的身份验证或不可否认服务之前，证书用户应查看由证书颁发机构（CA）生成的证书策略。为此，本标准未规定具有法律约束力的规则或职责。
As supplemental authorization and attribute management tools emerge, such as attribute certificates, it may be appropriate to limit the authenticated attributes that are included in a certificate. These other management tools may provide more appropriate methods of conveying many authenticated attributes.
随着补充授权和属性管理工具（如属性证书）的出现，限制证书中包含的经过身份验证的属性可能是合适的。这些其他管理工具可以提供更合适的方法来传递许多经过身份验证的属性。
The users of certificates will operate in a wide range of environments with respect to their communication topology, especially users of secure electronic mail. This profile supports users without high bandwidth, real-time IP connectivity, or high connection availability. In addition, the profile allows for the presence of firewall or other filtered communication.
证书用户将在其通信拓扑结构方面的各种环境中操作，特别是安全电子邮件用户。此配置文件支持没有高带宽、实时IP连接或高连接可用性的用户。此外，配置文件允许存在防火墙或其他过滤通信。
This profile does not assume the deployment of an X.500 Directory system. The profile does not prohibit the use of an X.500 Directory, but other means of distributing certificates and certificate revocation lists (CRLs) may be used.
此配置文件不假定部署X.500目录系统。配置文件不禁止使用X.500目录，但可以使用其他分发证书和证书吊销列表（CRL）的方法。
The goal of the Internet Public Key Infrastructure (PKI) is to meet the needs of deterministic, automated identification, authentication, access control, and authorization functions. Support for these services determines the attributes contained in the certificate as well as the ancillary control information in the certificate such as policy data and certification path constraints.
Internet公钥基础设施（PKI）的目标是满足确定性、自动识别、身份验证、访问控制和授权功能的需求。对这些服务的支持决定了证书中包含的属性以及证书中的辅助控制信息，如策略数据和证书路径约束。
Users of the Internet PKI are people and processes who use client software and are the subjects named in certificates. These uses include readers and writers of electronic mail, the clients for WWW browsers, WWW servers, and the key manager for IPsec within a router. This profile recognizes the limitations of the platforms these users employ and the limitations in sophistication and attentiveness of the users themselves. This manifests itself in minimal user configuration responsibility (e.g., trusted CA keys, rules), explicit platform usage constraints within the certificate, certification path constraints which shield the user from many malicious actions, and applications which sensibly automate validation functions.
Internet PKI的用户是使用客户端软件的人员和进程，是证书中指定的主体。这些用途包括电子邮件的读写器、WWW浏览器的客户端、WWW服务器以及路由器中IPsec的密钥管理器。此配置文件认识到这些用户使用的平台的局限性，以及用户自身的复杂性和关注度的局限性。这表现在最小的用户配置责任（例如，受信任的CA密钥、规则）、证书中的显式平台使用约束、保护用户免受许多恶意操作的认证路径约束，以及明智地自动化验证功能的应用程序。
As with user expectations, the Internet PKI profile is structured to support the individuals who generally operate CAs. Providing administrators with unbounded choices increases the chances that a subtle CA administrator mistake will result in broad compromise. Also, unbounded choices greatly complicate the software that shall process and validate the certificates created by the CA.
与用户期望一样，Internet PKI配置文件的结构是为了支持通常操作CAs的个人。为管理员提供无限的选择会增加CA管理员犯下的细微错误导致广泛妥协的可能性。此外，无界选择会使处理和验证CA创建的证书的软件变得非常复杂。
3 Overview of Approach
3方法概述
Following is a simplified view of the architectural model assumed by the PKIX specifications.
以下是PKIX规范假定的体系结构模型的简化视图。
+---+
| C | +------------+
| e | <-------------------->| End entity |
| r | Operational +------------+
| t | transactions ^
| | and management | Management
| / | transactions | transactions
| | | PKI users
| C | v
| R | -------------------+--+-----------+----------------
| L | ^ ^
| | | | PKI management
| | v | entities
| R | +------+ |
| e | <---------------------| RA | <---+ |
| p | Publish certificate +------+ | |
| o | | |
| s | | |
| I | v v
| t | +------------+
| o | <------------------------------| CA |
| r | Publish certificate +------------+
| y | Publish CRL ^
| | |
+---+ Management |
transactions |
v
+------+
| CA |
+------+
+---+
| C | +------------+
| e | <-------------------->| End entity |
| r | Operational +------------+
| t | transactions ^
| | and management | Management
| / | transactions | transactions
| | | PKI users
| C | v
| R | -------------------+--+-----------+----------------
| L | ^ ^
| | | | PKI management
| | v | entities
| R | +------+ |
| e | <---------------------| RA | <---+ |
| p | Publish certificate +------+ | |
| o | | |
| s | | |
| I | v v
| t | +------------+
| o | <------------------------------| CA |
| r | Publish certificate +------------+
| y | Publish CRL ^
| | |
+---+ Management |
transactions |
v
+------+
| CA |
+------+
Figure 1 - PKI Entities
图1-PKI实体
The components in this model are:
该模型中的组件包括：
end entity: user of PKI certificates and/or end user system that
is the subject of a certificate;
CA: certification authority;
RA: registration authority, i.e., an optional system to
which a CA delegates certain management functions;
repository: a system or collection of distributed systems that
store certificates and CRLs and serves as a means of
distributing these certificates and CRLs to end
entities.
end entity: user of PKI certificates and/or end user system that
is the subject of a certificate;
CA: certification authority;
RA: registration authority, i.e., an optional system to
which a CA delegates certain management functions;
repository: a system or collection of distributed systems that
store certificates and CRLs and serves as a means of
distributing these certificates and CRLs to end
entities.
Users of a public key shall be confident that the associated private key is owned by the correct remote subject (person or system) with which an encryption or digital signature mechanism will be used. This confidence is obtained through the use of public key certificates, which are data structures that bind public key values to subjects. The binding is asserted by having a trusted CA digitally sign each certificate. The CA may base this assertion upon technical means (a.k.a., proof of posession through a challenge-response protocol), presentation of the private key, or on an assertion by the subject. A certificate has a limited valid lifetime which is indicated in its signed contents. Because a certificate's signature and timeliness can be independently checked by a certificate-using client, certificates can be distributed via untrusted communications and server systems, and can be cached in unsecured storage in certificate-using systems.
公钥用户应确信相关私钥属于将使用加密或数字签名机制的正确远程主体（个人或系统）。这种信心是通过使用公钥证书获得的，公钥证书是将公钥值绑定到主题的数据结构。通过让受信任的CA对每个证书进行数字签名来断言绑定。CA可以基于技术手段（也称为通过质询-响应协议证明存在）、私钥的呈现或主体的断言来做出此断言。证书具有有限的有效生存期，这在其签名的内容中指明。由于证书的签名和及时性可以由证书使用客户端独立检查，因此证书可以通过不受信任的通信和服务器系统分发，并且可以缓存在证书使用系统中的不安全存储中。
ITU-T X.509 (formerly CCITT X.509) or ISO/IEC/ITU 9594-8, which was first published in 1988 as part of the X.500 Directory recommendations, defines a standard certificate format [X.509]. The certificate format in the 1988 standard is called the version 1 (v1) format. When X.500 was revised in 1993, two more fields were added, resulting in the version 2 (v2) format. These two fields may be used to support directory access control.
ITU-T X.509（前身为CCITT X.509）或ISO/IEC/ITU 9594-8（于1988年首次作为X.500目录建议的一部分发布）定义了标准证书格式[X.509]。1988年标准中的证书格式称为版本1（v1）格式。当X.500在1993年修订时，又增加了两个字段，从而形成了版本2（v2）格式。这两个字段可用于支持目录访问控制。
The Internet Privacy Enhanced Mail (PEM) RFCs, published in 1993, include specifications for a public key infrastructure based on X.509 v1 certificates [RFC 1422]. The experience gained in attempts to deploy RFC 1422 made it clear that the v1 and v2 certificate formats are deficient in several respects. Most importantly, more fields were needed to carry information which PEM design and implementation experience has proven necessary. In response to these new requirements, ISO/IEC/ITU and ANSI X9 developed the X.509 version 3 (v3) certificate format. The v3 format extends the v2 format by adding provision for additional extension fields. Particular extension field types may be specified in standards or may be defined and registered by any organization or community. In June 1996, standardization of the basic v3 format was completed [X.509].
1993年发布的Internet隐私增强邮件（PEM）RFC包括基于X.509 v1证书的公钥基础设施规范[RFC 1422]。在尝试部署RFC 1422时获得的经验表明，v1和v2证书格式在几个方面存在缺陷。最重要的是，需要更多的字段来承载PEM设计和实施经验证明必要的信息。为了响应这些新要求，ISO/IEC/ITU和ANSI X9开发了X.509版本3（v3）证书格式。v3格式通过添加额外扩展字段的规定来扩展v2格式。特定的扩展字段类型可以在标准中指定，也可以由任何组织或社区定义和注册。1996年6月，基本v3格式的标准化工作完成[X.509]。
ISO/IEC/ITU and ANSI X9 have also developed standard extensions for use in the v3 extensions field [X.509][X9.55]. These extensions can convey such data as additional subject identification information, key attribute information, policy information, and certification path constraints.
ISO/IEC/ITU和ANSI X9还开发了用于v3扩展字段[X.509][X9.55]的标准扩展。这些扩展可以传递诸如附加主题标识信息、关键属性信息、策略信息和认证路径约束之类的数据。
However, the ISO/IEC/ITU and ANSI X9 standard extensions are very broad in their applicability. In order to develop interoperable implementations of X.509 v3 systems for Internet use, it is necessary to specify a profile for use of the X.509 v3 extensions tailored for the Internet. It is one goal of this document to specify a profile for Internet WWW, electronic mail, and IPsec applications. Environments with additional requirements may build on this profile or may replace it.
然而，ISO/IEC/ITU和ANSI X9标准扩展的适用性非常广泛。为了开发用于Internet的X.509 v3系统的可互操作实现，有必要指定一个配置文件，以使用为Internet定制的X.509 v3扩展。本文档的目标之一是指定Internet WWW、电子邮件和IPsec应用程序的配置文件。具有附加要求的环境可以基于此配置文件构建，也可以替换此配置文件。
A user of a security service requiring knowledge of a public key generally needs to obtain and validate a certificate containing the required public key. If the public-key user does not already hold an assured copy of the public key of the CA that signed the certificate, the CA's name, and related information (such as the validity period or name constraints), then it might need an additional certificate to obtain that public key. In general, a chain of multiple certificates may be needed, comprising a certificate of the public key owner (the end entity) signed by one CA, and zero or more additional certificates of CAs signed by other CAs. Such chains, called certification paths, are required because a public key user is only initialized with a limited number of assured CA public keys.
需要了解公钥的安全服务的用户通常需要获取并验证包含所需公钥的证书。如果公钥用户尚未持有签署证书的CA的公钥、CA的名称和相关信息（如有效期或名称限制）的保证副本，则可能需要额外的证书来获取该公钥。通常，可能需要多个证书链，包括由一个CA签名的公钥所有者（最终实体）的证书，以及由其他CA签名的CA的零个或多个附加证书。这种称为认证路径的链是必需的，因为公钥用户仅使用有限数量的保证CA公钥进行初始化。
There are different ways in which CAs might be configured in order for public key users to be able to find certification paths. For PEM, RFC 1422 defined a rigid hierarchical structure of CAs. There are three types of PEM certification authority:
为了让公钥用户能够找到证书路径，可以通过不同的方式配置CA。对于PEM，RFC1422定义了CAs的刚性层次结构。PEM认证机构有三种类型：
(a) Internet Policy Registration Authority (IPRA): This authority, operated under the auspices of the Internet Society, acts as the root of the PEM certification hierarchy at level 1. It issues certificates only for the next level of authorities, PCAs. All certification paths start with the IPRA.
(a) 互联网政策注册管理局（IPRA）：该管理局在互联网协会的支持下运作，作为PEM认证体系的一级基础。它只为下一级机构PCAs颁发证书。所有认证路径都以IPRA开始。
(b) Policy Certification Authorities (PCAs): PCAs are at level 2 of the hierarchy, each PCA being certified by the IPRA. A PCA shall establish and publish a statement of its policy with respect to certifying users or subordinate certification authorities. Distinct PCAs aim to satisfy different user needs. For example, one PCA (an organizational PCA) might support the general electronic mail needs of commercial organizations, and another PCA (a high-assurance PCA) might have a more stringent policy designed for satisfying legally binding digital signature requirements.
(b) 政策认证机构（PCA）：PCA处于层次结构的第2级，每个PCA都由IPRA认证。认证机构应制定并公布其关于认证用户或下级认证机构的政策声明。不同的PCA旨在满足不同的用户需求。例如，一个PCA（组织PCA）可能支持商业组织的一般电子邮件需求，而另一个PCA（高保证PCA）可能有更严格的政策，旨在满足具有法律约束力的数字签名要求。
(c) Certification Authorities (CAs): CAs are at level 3 of the hierarchy and can also be at lower levels. Those at level 3 are certified by PCAs. CAs represent, for example, particular organizations, particular organizational units (e.g., departments, groups, sections), or particular geographical areas.
(c) 证书颁发机构（CA）：CA处于层次结构的第3级，也可以处于较低级别。3级人员由PCAs认证。CA代表，例如，特定组织、特定组织单位（例如，部门、团体、部门）或特定地理区域。
RFC 1422 furthermore has a name subordination rule which requires that a CA can only issue certificates for entities whose names are subordinate (in the X.500 naming tree) to the name of the CA itself. The trust associated with a PEM certification path is implied by the PCA name. The name subordination rule ensures that CAs below the PCA are sensibly constrained as to the set of subordinate entities they can certify (e.g., a CA for an organization can only certify entities in that organization's name tree). Certificate user systems are able to mechanically check that the name subordination rule has been followed.
RFC 1422还有一个名称从属规则，该规则要求CA只能为名称（在X.500命名树中）从属于CA本身名称的实体颁发证书。PCA名称暗示了与PEM认证路径关联的信任。名称从属规则确保PCA下的CA在其可以认证的从属实体集合方面受到合理的约束（例如，组织的CA只能认证该组织名称树中的实体）。证书用户系统能够机械地检查是否遵循了名称从属规则。
The RFC 1422 uses the X.509 v1 certificate formats. The limitations of X.509 v1 required imposition of several structural restrictions to clearly associate policy information or restrict the utility of certificates. These restrictions included:
RFC 1422使用X.509 v1证书格式。X.509 v1的限制要求强制实施若干结构限制，以明确关联策略信息或限制证书的效用。这些限制包括：
(a) a pure top-down hierarchy, with all certification paths starting from IPRA;
(a) 纯自上而下的层次结构，所有认证路径都从IPRA开始；
(b) a naming subordination rule restricting the names of a CA's subjects; and
(b) 限制CA受试者姓名的命名从属规则；和
(c) use of the PCA concept, which requires knowledge of individual PCAs to be built into certificate chain verification logic. Knowledge of individual PCAs was required to determine if a chain could be accepted.
(c) 使用PCA概念，这需要将单个PCA的知识构建到证书链验证逻辑中。需要了解单个PCA，以确定链是否可以接受。
With X.509 v3, most of the requirements addressed by RFC 1422 can be addressed using certificate extensions, without a need to restrict the CA structures used. In particular, the certificate extensions relating to certificate policies obviate the need for PCAs and the constraint extensions obviate the need for the name subordination rule. As a result, this document supports a more flexible architecture, including:
对于X.509 v3，RFC 1422解决的大多数需求都可以使用证书扩展来解决，而无需限制使用的CA结构。特别是，与证书策略相关的证书扩展消除了PCA的需要，而约束扩展消除了名称从属规则的需要。因此，本文档支持更灵活的体系结构，包括：
(a) Certification paths may start with a public key of a CA in a user's own domain, or with the public key of the top of a hierarchy. Starting with the public key of a CA in a user's own domain has certain advantages. In some environments, the local domain is the most trusted.
(a) 认证路径可以从用户自己域中的CA公钥开始，也可以从层次结构顶部的公钥开始。从用户自己域中的CA公钥开始具有某些优势。在某些环境中，本地域是最受信任的。
(b) Name constraints may be imposed through explicit inclusion of a name constraints extension in a certificate, but are not required.
(b) 名称约束可以通过在证书中显式包含名称约束扩展来施加，但不是必需的。
(c) Policy extensions and policy mappings replace the PCA concept, which permits a greater degree of automation. The application can determine if the certification path is acceptable based on the contents of the certificates instead of a priori knowledge of PCAs. This permits automation of certificate chain processing.
(c) 策略扩展和策略映射取代了PCA概念，后者允许更高程度的自动化。应用程序可以基于证书的内容而不是pca的先验知识来确定证书路径是否可接受。这允许证书链处理的自动化。
When a certificate is issued, it is expected to be in use for its entire validity period. However, various circumstances may cause a certificate to become invalid prior to the expiration of the validity period. Such circumstances include change of name, change of association between subject and CA (e.g., an employee terminates employment with an organization), and compromise or suspected compromise of the corresponding private key. Under such circumstances, the CA needs to revoke the certificate.
颁发证书时，该证书预计将在其整个有效期内使用。但是，各种情况可能导致证书在有效期到期之前失效。此类情况包括姓名变更、主体与CA之间的关联变更（例如，员工终止与组织的雇佣关系）以及相应私钥的泄露或疑似泄露。在这种情况下，CA需要撤销证书。
X.509 defines one method of certificate revocation. This method involves each CA periodically issuing a signed data structure called a certificate revocation list (CRL). A CRL is a time stamped list identifying revoked certificates which is signed by a CA and made freely available in a public repository. Each revoked certificate is identified in a CRL by its certificate serial number. When a certificate-using system uses a certificate (e.g., for verifying a remote user's digital signature), that system not only checks the certificate signature and validity but also acquires a suitably-recent CRL and checks that the certificate serial number is not on that CRL. The meaning of "suitably-recent" may vary with local policy, but it usually means the most recently-issued CRL. A CA issues a new CRL on a regular periodic basis (e.g., hourly, daily, or weekly). An entry is added to the CRL as part of the next update following notification of revocation. An entry may be removed from the CRL after appearing on one regularly scheduled CRL issued beyond the revoked certificate's validity period.
X.509定义了一种证书撤销方法。此方法涉及每个CA定期发布一个称为证书吊销列表（CRL）的签名数据结构。CRL是一个时间戳列表，标识由CA签署并在公共存储库中免费提供的已吊销证书。每个被吊销的证书在CRL中都通过其证书序列号进行标识。当证书使用系统使用证书（例如，用于验证远程用户的数字签名）时，该系统不仅检查证书签名和有效性，还获取适当的最新CRL，并检查证书序列号不在该CRL上。“适当最近”的含义可能因当地政策而异，但通常指最近发布的CRL。CA定期（例如，每小时、每天或每周）发布新的CRL。在发出撤销通知后，将向CRL添加一个条目，作为下一次更新的一部分。在被吊销证书的有效期之后，在一个定期发布的CRL上出现的条目可能会从CRL中删除。
An advantage of this revocation method is that CRLs may be distributed by exactly the same means as certificates themselves, namely, via untrusted communications and server systems.
这种撤销方法的一个优点是，CRL可以通过与证书本身完全相同的方式分发，即通过不受信任的通信和服务器系统。
One limitation of the CRL revocation method, using untrusted communications and servers, is that the time granularity of revocation is limited to the CRL issue period. For example, if a revocation is reported now, that revocation will not be reliably
使用不可信通信和服务器的CRL撤销方法的一个限制是，撤销的时间粒度限制在CRL发布期间。例如，如果现在报告了吊销，则该吊销将无法可靠地进行
notified to certificate-using systems until the next periodic CRL is issued -- this may be up to one hour, one day, or one week depending on the frequency that the CA issues CRLs.
通知使用证书的系统，直到下一个定期CRL发布——这可能是一小时、一天或一周，具体取决于CA发布CRL的频率。
As with the X.509 v3 certificate format, in order to facilitate interoperable implementations from multiple vendors, the X.509 v2 CRL format needs to be profiled for Internet use. It is one goal of this document to specify that profile. However, this profile does not require CAs to issue CRLs. Message formats and protocols supporting on-line revocation notification may be defined in other PKIX specifications. On-line methods of revocation notification may be applicable in some environments as an alternative to the X.509 CRL. On-line revocation checking may significantly reduce the latency between a revocation report and the distribution of the information to relying parties. Once the CA accepts the report as authentic and valid, any query to the on-line service will correctly reflect the certificate validation impacts of the revocation. However, these methods impose new security requirements; the certificate validator shall trust the on-line validation service while the repository does not need to be trusted.
与X.509 v3证书格式一样，为了便于多个供应商的互操作实施，需要对X.509 v2 CRL格式进行分析，以供Internet使用。本文档的目标之一是指定该概要文件。但是，此配置文件不要求CAs发布CRL。支持在线撤销通知的消息格式和协议可以在其他PKIX规范中定义。在线撤销通知方法可能适用于某些环境，作为X.509 CRL的替代方案。在线撤销检查可以显著减少撤销报告与向依赖方分发信息之间的延迟。一旦CA接受报告为真实有效，对在线服务的任何查询都将正确反映撤销对证书验证的影响。然而，这些方法提出了新的安全要求；证书验证器应信任在线验证服务，而不需要信任存储库。
Operational protocols are required to deliver certificates and CRLs (or status information) to certificate using client systems. Provision is needed for a variety of different means of certificate and CRL delivery, including distribution procedures based on LDAP, HTTP, FTP, and X.500. Operational protocols supporting these functions are defined in other PKIX specifications. These specifications may include definitions of message formats and procedures for supporting all of the above operational environments, including definitions of or references to appropriate MIME content types.
使用客户端系统向证书传递证书和CRL（或状态信息）需要操作协议。需要提供各种不同的证书和CRL交付方式，包括基于LDAP、HTTP、FTP和X.500的分发过程。其他PKIX规范中定义了支持这些功能的操作协议。这些规范可能包括支持上述所有操作环境的消息格式和过程的定义，包括对适当MIME内容类型的定义或引用。
Management protocols are required to support on-line interactions between PKI user and management entities. For example, a management protocol might be used between a CA and a client system with which a key pair is associated, or between two CAs which cross-certify each other. The set of functions which potentially need to be supported by management protocols include:
需要管理协议来支持PKI用户和管理实体之间的在线交互。例如，可以在CA和与密钥对关联的客户机系统之间使用管理协议，或者在相互交叉认证的两个CA之间使用管理协议。管理协议可能需要支持的一组功能包括：
(a) registration: This is the process whereby a user first makes itself known to a CA (directly, or through an RA), prior to that CA issuing a certificate or certificates for that user.
(a) 注册：这是一个过程，用户在CA为该用户颁发一个或多个证书之前，首先向CA（直接或通过RA）表明自己的身份。
(b) initialization: Before a client system can operate securely it is necessary to install key materials which have the appropriate relationship with keys stored elsewhere in the infrastructure. For example, the client needs to be securely initialized with the public key and other assured information of the trusted CA(s), to be used in validating certificate paths. Furthermore, a client typically needs to be initialized with its own key pair(s).
(b) 初始化：在客户端系统能够安全运行之前，必须安装与基础结构中其他位置存储的密钥具有适当关系的密钥材料。例如，客户端需要使用公钥和受信任CA的其他有保证的信息进行安全初始化，以用于验证证书路径。此外，客户机通常需要使用自己的密钥对进行初始化。
(c) certification: This is the process in which a CA issues a certificate for a user's public key, and returns that certificate to the user's client system and/or posts that certificate in a repository.
(c) 认证：CA为用户的公钥颁发证书，并将该证书返回到用户的客户端系统和/或将该证书发布到存储库中的过程。
(d) key pair recovery: As an option, user client key materials (e.g., a user's private key used for encryption purposes) may be backed up by a CA or a key backup system. If a user needs to recover these backed up key materials (e.g., as a result of a forgotten password or a lost key chain file), an on-line protocol exchange may be needed to support such recovery.
(d) 密钥对恢复：作为一种选择，用户客户端密钥材料（例如，用于加密目的的用户私钥）可以由CA或密钥备份系统进行备份。如果用户需要恢复这些备份的密钥材料（例如，由于忘记密码或丢失密钥链文件），则可能需要在线协议交换来支持此类恢复。
(e) key pair update: All key pairs need to be updated regularly, i.e., replaced with a new key pair, and new certificates issued.
(e) 密钥对更新：需要定期更新所有密钥对，即用新密钥对替换，并颁发新证书。
(f) revocation request: An authorized person advises a CA of an abnormal situation requiring certificate revocation.
(f) 撤销请求：授权人通知CA需要撤销证书的异常情况。
(g) cross-certification: Two CAs exchange information used in establishing a cross-certificate. A cross-certificate is a certificate issued by one CA to another CA which contains a CA signature key used for issuing certificates.
(g) 交叉认证：两个CA交换用于建立交叉证书的信息。交叉证书是由一个CA向另一个CA颁发的证书，其中包含用于颁发证书的CA签名密钥。
Note that on-line protocols are not the only way of implementing the above functions. For all functions there are off-line methods of achieving the same result, and this specification does not mandate use of on-line protocols. For example, when hardware tokens are used, many of the functions may be achieved as part of the physical token delivery. Furthermore, some of the above functions may be combined into one protocol exchange. In particular, two or more of the registration, initialization, and certification functions can be combined into one protocol exchange.
请注意，在线协议不是实现上述功能的唯一方式。对于所有功能，都有实现相同结果的离线方法，本规范不强制使用在线协议。例如，当使用硬件令牌时，许多功能可以作为物理令牌传递的一部分来实现。此外，上述一些功能可以组合成一个协议交换。特别地，两个或多个注册、初始化和认证功能可以组合成一个协议交换。
The PKIX series of specifications may define a set of standard message formats supporting the above functions in future specifications. In that case, the protocols for conveying these messages in different environments (e.g., on-line, file transfer, e-mail, and WWW) will also be described in those specifications.
PKIX系列规范可在未来规范中定义一组支持上述功能的标准消息格式。在这种情况下，用于在不同环境（例如，在线、文件传输、电子邮件和WWW）中传送这些消息的协议也将在这些规范中描述。
4 Certificate and Certificate Extensions Profile
4证书和证书扩展配置文件
This section presents a profile for public key certificates that will foster interoperability and a reusable PKI. This section is based upon the X.509 v3 certificate format and the standard certificate extensions defined in [X.509]. The ISO/IEC/ITU documents use the 1993 version of ASN.1; while this document uses the 1988 ASN.1 syntax, the encoded certificate and standard extensions are equivalent. This section also defines private extensions required to support a PKI for the Internet community.
本节介绍了公钥证书的配置文件，它将促进互操作性和可重用的PKI。本节基于X.509 v3证书格式和[X.509]中定义的标准证书扩展。ISO/IEC/ITU文件使用1993版ASN.1；虽然本文档使用1988 ASN.1语法，但编码证书和标准扩展是等效的。本节还定义了为Internet社区支持PKI所需的专用扩展。
Certificates may be used in a wide range of applications and environments covering a broad spectrum of interoperability goals and a broader spectrum of operational and assurance requirements. The goal of this document is to establish a common baseline for generic applications requiring broad interoperability and limited special purpose requirements. In particular, the emphasis will be on supporting the use of X.509 v3 certificates for informal Internet electronic mail, IPsec, and WWW applications.
证书可用于广泛的应用程序和环境，涵盖广泛的互操作性目标和更广泛的操作和保证要求。本文档的目标是为需要广泛互操作性和有限特殊用途需求的通用应用程序建立通用基线。特别是，重点将是支持非正式Internet电子邮件、IPsec和WWW应用程序使用X.509 v3证书。
The X.509 v3 certificate basic syntax is as follows. For signature calculation, the certificate is encoded using the ASN.1 distinguished encoding rules (DER) [X.208]. ASN.1 DER encoding is a tag, length, value encoding system for each element.
X.509 v3证书的基本语法如下所示。对于签名计算，使用ASN.1可分辨编码规则（DER）[X.208]对证书进行编码。ASN.1 DER编码是每个元素的标记、长度、值编码系统。
Certificate ::= SEQUENCE {
tbsCertificate TBSCertificate,
signatureAlgorithm AlgorithmIdentifier,
signatureValue BIT STRING }
Certificate ::= SEQUENCE {
tbsCertificate TBSCertificate,
signatureAlgorithm AlgorithmIdentifier,
signatureValue BIT STRING }
TBSCertificate ::= SEQUENCE {
version [0] EXPLICIT Version DEFAULT v1,
serialNumber CertificateSerialNumber,
signature AlgorithmIdentifier,
issuer Name,
validity Validity,
subject Name,
subjectPublicKeyInfo SubjectPublicKeyInfo,
issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL,
-- If present, version shall be v2 or v3
subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL,
-- If present, version shall be v2 or v3
extensions [3] EXPLICIT Extensions OPTIONAL
-- If present, version shall be v3
}
TBSCertificate ::= SEQUENCE {
version [0] EXPLICIT Version DEFAULT v1,
serialNumber CertificateSerialNumber,
signature AlgorithmIdentifier,
issuer Name,
validity Validity,
subject Name,
subjectPublicKeyInfo SubjectPublicKeyInfo,
issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL,
-- If present, version shall be v2 or v3
subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL,
-- If present, version shall be v2 or v3
extensions [3] EXPLICIT Extensions OPTIONAL
-- If present, version shall be v3
}
Version ::= INTEGER { v1(0), v2(1), v3(2) }
Version ::= INTEGER { v1(0), v2(1), v3(2) }
CertificateSerialNumber ::= INTEGER
CertificateSerialNumber ::= INTEGER
Validity ::= SEQUENCE {
notBefore Time,
notAfter Time }
Validity ::= SEQUENCE {
notBefore Time,
notAfter Time }
Time ::= CHOICE {
utcTime UTCTime,
generalTime GeneralizedTime }
Time ::= CHOICE {
utcTime UTCTime,
generalTime GeneralizedTime }
UniqueIdentifier ::= BIT STRING
UniqueIdentifier ::= BIT STRING
SubjectPublicKeyInfo ::= SEQUENCE {
algorithm AlgorithmIdentifier,
subjectPublicKey BIT STRING }
SubjectPublicKeyInfo ::= SEQUENCE {
algorithm AlgorithmIdentifier,
subjectPublicKey BIT STRING }
Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
Extension ::= SEQUENCE {
extnID OBJECT IDENTIFIER,
critical BOOLEAN DEFAULT FALSE,
extnValue OCTET STRING }
Extension ::= SEQUENCE {
extnID OBJECT IDENTIFIER,
critical BOOLEAN DEFAULT FALSE,
extnValue OCTET STRING }
The following items describe the X.509 v3 certificate for use in the Internet.
以下项目描述了用于Internet的X.509 v3证书。
The Certificate is a SEQUENCE of three required fields. The fields are described in detail in the following subsections.
证书由三个必填字段组成。以下小节详细描述了这些字段。
The field contains the names of the subject and issuer, a public key associated with the subject, a validity period, and other associated information. The fields are described in detail in section 4.1.2; the tbscertificate may also include extensions which are described in section 4.2.
该字段包含主题和颁发者的名称、与主题相关联的公钥、有效期和其他相关信息。第4.1.2节详细描述了这些字段；TBSCE证书还可包括第4.2节所述的扩展。
The signatureAlgorithm field contains the identifier for the cryptographic algorithm used by the CA to sign this certificate. Section 7.2 lists the supported signature algorithms.
signatureAlgorithm字段包含CA用于签署此证书的加密算法的标识符。第7.2节列出了支持的签名算法。
An algorithm identifier is defined by the following ASN.1 structure:
算法标识符由以下ASN.1结构定义：
AlgorithmIdentifier ::= SEQUENCE {
algorithm OBJECT IDENTIFIER,
parameters ANY DEFINED BY algorithm OPTIONAL }
AlgorithmIdentifier ::= SEQUENCE {
algorithm OBJECT IDENTIFIER,
parameters ANY DEFINED BY algorithm OPTIONAL }
The algorithm identifier is used to identify a cryptographic algorithm. The OBJECT IDENTIFIER component identifies the algorithm (such as DSA with SHA-1). The contents of the optional parameters field will vary according to the algorithm identified. Section 7.2 lists the supported algorithms for this specification.
算法标识符用于识别加密算法。对象标识符组件标识算法（例如带有SHA-1的DSA）。可选参数字段的内容将根据识别的算法而变化。第7.2节列出了本规范支持的算法。
This field MUST contain the same algorithm identifier as the signature field in the sequence tbsCertificate (see sec. 4.1.2.3).
该字段必须包含与序列tbsCertificate中的签名字段相同的算法标识符（见第4.1.2.3节）。
The signatureValue field contains a digital signature computed upon the ASN.1 DER encoded tbsCertificate. The ASN.1 DER encoded tbsCertificate is used as the input to the signature function. This signature value is then ASN.1 encoded as a BIT STRING and included in the Certificate's signature field. The details of this process are specified for each of the supported algorithms in Section 7.2.
signatureValue字段包含根据ASN.1 DER编码的tbsCertificate计算的数字签名。ASN.1 DER编码的tbsCertificate用作签名函数的输入。然后将该签名值作为位字符串进行ASN.1编码，并包含在证书的签名字段中。第7.2节规定了每个受支持算法的详细过程。
By generating this signature, a CA certifies the validity of the information in the tbsCertificate field. In particular, the CA certifies the binding between the public key material and the subject of the certificate.
通过生成此签名，CA将证明tbsCertificate字段中信息的有效性。特别是，CA认证公钥材料与证书主题之间的绑定。
The sequence TBSCertificate contains information associated with the subject of the certificate and the CA who issued it. Every TBSCertificate contains the names of the subject and issuer, a public key associated with the subject, a validity period, a version number, and a serial number; some may contain optional unique identifier fields. The remainder of this section describes the syntax and semantics of these fields. A TBSCertificate may also include extensions. Extensions for the Internet PKI are described in Section 4.2.
序列TBSCertificate包含与证书主题和颁发证书的CA相关的信息。每个TBSCertificate包含主题和发行人的名称、与主题相关联的公钥、有效期、版本号和序列号；有些可能包含可选的唯一标识符字段。本节的其余部分介绍这些字段的语法和语义。TBSC证书还可以包括扩展。第4.2节介绍了Internet PKI的扩展。
This field describes the version of the encoded certificate. When extensions are used, as expected in this profile, use X.509 version 3 (value is 2). If no extensions are present, but a UniqueIdentifier is present, use version 2 (value is 1). If only basic fields are present, use version 1 (the value is omitted from the certificate as the default value).
此字段描述编码证书的版本。当使用扩展时，如本配置文件中所预期的，请使用X.509版本3（值为2）。如果不存在扩展名，但存在唯一标识符，则使用版本2（值为1）。如果仅存在基本字段，请使用版本1（该值作为默认值从证书中省略）。
Implementations SHOULD be prepared to accept any version certificate. At a minimum, conforming implementations MUST recognize version 3 certificates.
实现应该准备好接受任何版本证书。至少，一致性实现必须识别版本3证书。
Generation of version 2 certificates is not expected by implementations based on this profile.
基于此配置文件的实现不希望生成版本2证书。
The serial number is an integer assigned by the CA to each certificate. It MUST be unique for each certificate issued by a given CA (i.e., the issuer name and serial number identify a unique certificate).
序列号是CA分配给每个证书的整数。对于给定CA颁发的每个证书，它必须是唯一的（即，颁发者名称和序列号标识唯一的证书）。
This field contains the algorithm identifier for the algorithm used by the CA to sign the certificate.
此字段包含CA用于签署证书的算法的算法标识符。
This field MUST contain the same algorithm identifier as the signatureAlgorithm field in the sequence Certificate (see sec. 4.1.1.2). The contents of the optional parameters field will vary according to the algorithm identified. Section 7.2 lists the supported signature algorithms.
该字段必须包含与序列证书中的signatureAlgorithm字段相同的算法标识符（见第4.1.1.2节）。可选参数字段的内容将根据识别的算法而变化。第7.2节列出了支持的签名算法。
The issuer field identifies the entity who has signed and issued the certificate. The issuer field MUST contain a non-empty distinguished name (DN). The issuer field is defined as the X.501 type Name. [X.501] Name is defined by the following ASN.1 structures:
“颁发者”字段标识已签署和颁发证书的实体。颁发者字段必须包含非空的可分辨名称（DN）。issuer字段定义为X.501类型名称。[X.501]名称由以下ASN.1结构定义：
Name ::= CHOICE {
RDNSequence }
Name ::= CHOICE {
RDNSequence }
RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
RelativeDistinguishedName ::=
SET OF AttributeTypeAndValue
RelativeDistinguishedName ::=
SET OF AttributeTypeAndValue
AttributeTypeAndValue ::= SEQUENCE {
type AttributeType,
value AttributeValue }
AttributeTypeAndValue ::= SEQUENCE {
type AttributeType,
value AttributeValue }
AttributeType ::= OBJECT IDENTIFIER
AttributeType ::= OBJECT IDENTIFIER
AttributeValue ::= ANY DEFINED BY AttributeType
AttributeValue ::= ANY DEFINED BY AttributeType
DirectoryString ::= CHOICE {
teletexString TeletexString (SIZE (1..MAX)),
printableString PrintableString (SIZE (1..MAX)),
universalString UniversalString (SIZE (1..MAX)),
utf8String UTF8String (SIZE (1.. MAX)),
bmpString BMPString (SIZE (1..MAX)) }
DirectoryString ::= CHOICE {
teletexString TeletexString (SIZE (1..MAX)),
printableString PrintableString (SIZE (1..MAX)),
universalString UniversalString (SIZE (1..MAX)),
utf8String UTF8String (SIZE (1.. MAX)),
bmpString BMPString (SIZE (1..MAX)) }
The Name describes a hierarchical name composed of attributes, such as country name, and corresponding values, such as US. The type of the component AttributeValue is determined by the AttributeType; in general it will be a DirectoryString.
名称描述由属性（如国家名称）和相应值（如美国）组成的层次名称。组件AttributeValue的类型由AttributeType确定；通常，它将是一个DirectoryString。
The DirectoryString type is defined as a choice of PrintableString, TeletexString, BMPString, UTF8String, and UniversalString. The UTF8String encoding is the preferred encoding, and all certificates issued after December 31, 2003 MUST use the UTF8String encoding of DirectoryString (except as noted below). Until that date, conforming CAs MUST choose from the following options when creating a distinguished name, including their own:
DirectoryString类型定义为可打印字符串、电传字符串、BMPString、UTF8String和UniversalString的选择。UTF8String编码是首选编码，2003年12月31日之后颁发的所有证书都必须使用DirectoryString的UTF8String编码（以下说明除外）。在此日期之前，合格CA在创建可分辨名称（包括其自己的名称）时必须从以下选项中进行选择：
(a) if the character set is sufficient, the string MAY be represented as a PrintableString;
(a) 如果字符集足够，字符串可以表示为可打印字符串；
(b) failing (a), if the BMPString character set is sufficient the string MAY be represented as a BMPString; and
(b) 失败（a），如果BMPString字符集足够，则字符串可以表示为BMPString；和
(c) failing (a) and (b), the string MUST be represented as a UTF8String. If (a) or (b) is satisfied, the CA MAY still choose to represent the string as a UTF8String.
(c) 如果（a）和（b）失败，则字符串必须表示为UTF8String。如果满足（a）或（b），CA仍然可以选择将字符串表示为UTF8String。
Exceptions to the December 31, 2003 UTF8 encoding requirements are as follows:
2003年12月31日UTF8编码要求的例外情况如下：
(a) CAs MAY issue "name rollover" certificates to support an orderly migration to UTF8String encoding. Such certificates would include the CA's UTF8String encoded name as issuer and and the old name encoding as subject, or vice-versa.
(a) CAs可能会颁发“名称滚动”证书，以支持有序迁移到UTF8String编码。此类证书将包括CA的UTF8String编码名称作为颁发者和旧名称编码作为主题，反之亦然。
(b) As stated in section 4.1.2.6, the subject field MUST be populated with a non-empty distinguished name matching the contents of the issuer field in all certificates issued by the subject CA regardless of encoding.
(b) 如第4.1.2.6节所述，无论采用何种编码方式，必须使用与主体CA颁发的所有证书中的颁发者字段内容相匹配的非空可分辨名称填充主体字段。
The TeletexString and UniversalString are included for backward compatibility, and should not be used for certificates for new subjects. However, these types may be used in certificates where the name was previously established. Certificate users SHOULD be prepared to receive certificates with these types.
TELETEXTSTRING和UniversalString用于向后兼容，不应用于新科目的证书。但是，这些类型可以在以前建立名称的证书中使用。证书用户应该准备好接收这些类型的证书。
In addition, many legacy implementations support names encoded in the ISO 8859-1 character set (Latin1String) but tag them as TeletexString. The Latin1String includes characters used in Western European countries which are not part of the TeletexString charcter set. Implementations that process TeletexString SHOULD be prepared to handle the entire ISO 8859-1 character set.[ISO 8859-1]
此外，许多传统实现支持以ISO 8859-1字符集（拉丁字符串）编码的名称，但将其标记为TeletextString。拉丁字符串包括西欧国家使用的字符，这些字符不属于电传字符串字符集。处理电传字符串的实现应该准备好处理整个ISO 8859-1字符集。[ISO 8859-1]
As noted above, distinguished names are composed of attributes. This specification does not restrict the set of attribute types that may appear in names. However, conforming implementations MUST be prepared to receive certificates with issuer names containing the set of attribute types defined below. This specification also recommends support for additional attribute types.
如上所述，可分辨名称由属性组成。本规范不限制名称中可能出现的属性类型集。但是，一致性实现必须准备好接收具有包含以下定义的属性类型集的颁发者名称的证书。本规范还建议支持其他属性类型。
Standard sets of attributes have been defined in the X.500 series of specifications.[X.520] Implementations of this specification MUST be prepared to receive the following standard attribute types in issuer names: country, organization, organizational-unit, distinguished name qualifier, state or province name, and common name (e.g., "Susan Housley"). In addition, implementations of this specification SHOULD be prepared to receive the following standard attribute types in issuer names: locality, title, surname, given name, initials, and generation qualifier (e.g., "Jr.", "3rd", or "IV"). The syntax and associated object identifiers (OIDs) for these attribute types are provided in the ASN.1 modules in Appendices A and B.
标准属性集已在X.500系列规范中定义。[X.520]本规范的实现必须准备好接收发卡机构名称中的以下标准属性类型：国家、组织、组织单位、可分辨名称限定符、州或省名称以及通用名称（例如，“Susan Housley”）)此外，本规范的实现应准备好接收发卡机构名称中的以下标准属性类型：位置、标题、姓氏、给定名称、首字母缩写和生成限定符（例如，“Jr.”、“3rd”或“IV”）。附录A和B中的ASN.1模块提供了这些属性类型的语法和相关对象标识符（OID）。
In addition, implementations of this specification MUST be prepared to receive the domainComponent attribute, as defined in [RFC 2247]. The Domain (Nameserver) System (DNS) provides a hierarchical resource labeling system. This attribute provides is a convenient mechanism for organizations that wish to use DNs that parallel their DNS names. This is not a replacement for the dNSName component of the alternative name field. Implementations are not required to convert such names into DNS names. The syntax and associated OID for this attribute type is provided in the ASN.1 modules in Appendices A and B.
此外，本规范的实现必须准备好接收[RFC 2247]中定义的domainComponent属性。域（名称服务器）系统（DNS）提供了一个分层的资源标签系统。此属性为希望使用与其DNs名称并行的DNs的组织提供了一种方便的机制。这不是替代替代名称字段的dNSName组件。实现不需要将此类名称转换为DNS名称。附录A和B中的ASN.1模块提供了该属性类型的语法和相关OID。
Certificate users MUST be prepared to process the issuer distinguished name and subject distinguished name (see sec. 4.1.2.6) fields to perform name chaining for certification path validation (see section 6). Name chaining is performed by matching the issuer distinguished name in one certificate with the subject name in a CA certificate.
证书用户必须准备好处理颁发者可分辨名称和使用者可分辨名称（见第4.1.2.6节）字段，以执行证书路径验证的名称链接（见第6节）。名称链接是通过将一个证书中的颁发者可分辨名称与CA证书中的使用者名称相匹配来执行的。
This specification requires only a subset of the name comparison functionality specified in the X.500 series of specifications. The requirements for conforming implementations are as follows:
本规范仅需要X.500系列规范中指定的名称比较功能的子集。符合性实施的要求如下：
(a) attribute values encoded in different types (e.g., PrintableString and BMPString) may be assumed to represent different strings;
(a) 可以假设以不同类型编码的属性值（例如，可打印字符串和BMPString）表示不同的字符串；
(b) attribute values in types other than PrintableString are case sensitive (this permits matching of attribute values as binary objects);
(b) 非PrintableString类型的属性值区分大小写（这允许将属性值作为二进制对象进行匹配）；
(c) attribute values in PrintableString are not case sensitive (e.g., "Marianne Swanson" is the same as "MARIANNE SWANSON"); and
(c) PrintableString中的属性值不区分大小写（例如，“Marianne Swanson”与“Marianne Swanson”相同）；和
(d) attribute values in PrintableString are compared after removing leading and trailing white space and converting internal substrings of one or more consecutive white space characters to a single space.
(d) 在删除前导和尾随空格并将一个或多个连续空格字符的内部子字符串转换为单个空格后，将比较PrintableString中的属性值。
These name comparison rules permit a certificate user to validate certificates issued using languages or encodings unfamiliar to the certificate user.
这些名称比较规则允许证书用户验证使用证书用户不熟悉的语言或编码颁发的证书。
In addition, implementations of this specification MAY use these comparison rules to process unfamiliar attribute types for name chaining. This allows implementations to process certificates with unfamiliar attributes in the issuer name.
此外，本规范的实现可能会使用这些比较规则来处理名称链接的不熟悉属性类型。这使得实现能够处理在颁发者名称中具有不熟悉属性的证书。
Note that the comparison rules defined in the X.500 series of specifications indicate that the character sets used to encode data in distinguished names are irrelevant. The characters themselves are compared without regard to encoding. Implementations of the profile are permitted to use the comparison algorithm defined in the X.500 series. Such an implementation will recognize a superset of name matches recognized by the algorithm specified above.
请注意，X.500系列规范中定义的比较规则表明，用于以可分辨名称编码数据的字符集是不相关的。字符本身的比较不考虑编码。允许配置文件的实现使用X.500系列中定义的比较算法。这样的实现将识别由上面指定的算法识别的名称匹配的超集。
The certificate validity period is the time interval during which the CA warrants that it will maintain information about the status of the certificate. The field is represented as a SEQUENCE of two dates: the date on which the certificate validity period begins (notBefore) and the date on which the certificate validity period ends (notAfter). Both notBefore and notAfter may be encoded as UTCTime or GeneralizedTime.
证书有效期是CA保证其将维护有关证书状态的信息的时间间隔。该字段表示为两个日期的序列：证书有效期开始的日期（notBefore）和证书有效期结束的日期（notAfter）。notBefore和notAfter都可以编码为UTCTime或GeneralizedTime。
CAs conforming to this profile MUST always encode certificate validity dates through the year 2049 as UTCTime; certificate validity dates in 2050 or later MUST be encoded as GeneralizedTime.
符合此配置文件的CA必须始终将2049年的证书有效期编码为UTCTime；2050年或以后的证书有效期必须编码为GeneralizedTime。
The universal time type, UTCTime, is a standard ASN.1 type intended for international applications where local time alone is not adequate. UTCTime specifies the year through the two low order digits and time is specified to the precision of one minute or one second. UTCTime includes either Z (for Zulu, or Greenwich Mean Time) or a time differential.
通用时间类型UTCTime是一种标准ASN.1类型，适用于仅本地时间不够的国际应用。UTCTime通过两个低阶数字指定年份，时间指定精度为一分钟或一秒。UTCTime包括Z（代表Zulu或格林威治标准时间）或时间差。
For the purposes of this profile, UTCTime values MUST be expressed Greenwich Mean Time (Zulu) and MUST include seconds (i.e., times are YYMMDDHHMMSSZ), even where the number of seconds is zero. Conforming systems MUST interpret the year field (YY) as follows:
在本配置文件中，UTCTime值必须以格林尼治平均时间（Zulu）表示，并且必须包括秒（即时间为YYMMDDHHMMSZ），即使秒数为零。一致性系统必须将年份字段（YY）解释为：
Where YY is greater than or equal to 50, the year shall be interpreted as 19YY; and
若YY大于或等于50，则年份应解释为19YY；和
Where YY is less than 50, the year shall be interpreted as 20YY.
如果YY小于50，则年份应解释为20YY。
The generalized time type, GeneralizedTime, is a standard ASN.1 type for variable precision representation of time. Optionally, the GeneralizedTime field can include a representation of the time differential between local and Greenwich Mean Time.
广义时间类型GeneratedTime是时间的可变精度表示的标准ASN.1类型。可选地，GeneratedTime字段可以包括本地时间和格林威治平均时间之间的时间差的表示。
For the purposes of this profile, GeneralizedTime values MUST be expressed Greenwich Mean Time (Zulu) and MUST include seconds (i.e., times are YYYYMMDDHHMMSSZ), even where the number of seconds is zero. GeneralizedTime values MUST NOT include fractional seconds.
在本配置文件中，广义时间值必须表示为格林威治标准时间（Zulu），并且必须包括秒（即时间为YYYYMMDDHHMMSSZ），即使秒数为零。GeneralizedTime值不能包含小数秒。
The subject field identifies the entity associated with the public key stored in the subject public key field. The subject name may be carried in the subject field and/or the subjectAltName extension. If the subject is a CA (e.g., the basic constraints extension, as discussed in 4.2.1.10, is present and the value of cA is TRUE,) then the subject field MUST be populated with a non-empty distinguished name matching the contents of the issuer field (see sec. 4.1.2.4) in all certificates issued by the subject CA. If subject naming information is present only in the subjectAltName extension (e.g., a key bound only to an email address or URI), then the subject name MUST be an empty sequence and the subjectAltName extension MUST be critical.
主题字段标识与存储在主题公钥字段中的公钥关联的实体。主题名称可以包含在主题字段和/或主题名称扩展名中。如果主题是CA（例如，存在4.2.1.10中讨论的基本约束扩展，且CA值为真），则主题字段必须填充与颁发者字段内容匹配的非空可分辨名称（见第4.1.2.4节）在受试者CA颁发的所有证书中。如果受试者命名信息仅存在于subjectAltName扩展中（例如，仅绑定到电子邮件地址或URI的密钥），则受试者名称必须是空序列，且subjectAltName扩展必须是关键的。
Where it is non-empty, the subject field MUST contain an X.500 distinguished name (DN). The DN MUST be unique for each subject entity certified by the one CA as defined by the issuer name field. A CA may issue more than one certificate with the same DN to the same subject entity.
如果不为空，则主题字段必须包含X.500可分辨名称（DN）。对于每个主体实体，DN必须是唯一的，由发卡机构名称字段定义的一个CA认证。CA可以向同一主体实体颁发多个具有相同DN的证书。
The subject name field is defined as the X.501 type Name. Implementation requirements for this field are those defined for the issuer field (see sec. 4.1.2.4). When encoding attribute values of type DirectoryString, the encoding rules for the issuer field MUST be implemented. Implementations of this specification MUST be prepared to receive subject names containing the attribute types required for the issuer field. Implementations of this specification SHOULD be prepared to receive subject names containing the recommended attribute types for the issuer field. The syntax and associated object identifiers (OIDs) for these attribute types are provided in the ASN.1 modules in Appendices A and B. Implementations of this specification MAY use these comparison rules to process unfamiliar attribute types (i.e., for name chaining). This allows implementations to process certificates with unfamiliar attributes in the subject name.
主题名称字段定义为X.501类型名称。该领域的实施要求是为发卡机构领域定义的要求（见第4.1.2.4节）。对DirectoryString类型的属性值进行编码时，必须实现issuer字段的编码规则。本规范的实现必须准备好接收包含issuer字段所需属性类型的主题名称。本规范的实现应准备好接收包含issuer字段的推荐属性类型的主题名称。附录A和附录B中的ASN.1模块中提供了这些属性类型的语法和相关对象标识符（OID）。本规范的实施可以使用这些比较规则来处理不熟悉的属性类型（即名称链接）。这允许实现处理主题名称中具有不熟悉属性的证书。
In addition, legacy implementations exist where an RFC 822 name is embedded in the subject distinguished name as an EmailAddress attribute. The attribute value for EmailAddress is of type IA5String to permit inclusion of the character '@', which is not part of the PrintableString character set. EmailAddress attribute values are not case sensitive (e.g., "fanfeedback@redsox.com" is the same as "FANFEEDBACK@REDSOX.COM").
此外，在传统实现中，RFC 822名称作为EmailAddress属性嵌入到主题可分辨名称中。EmailAddress的属性值为IA5String类型，以允许包含字符“@”，该字符不属于PrintableString字符集。EmailAddress属性值不区分大小写（例如“fanfeedback@redsox.com“与”FANFEEDBACK@REDSOX.COM").
Conforming implementations generating new certificates with electronic mail addresses MUST use the rfc822Name in the subject alternative name field (see sec. 4.2.1.7) to describe such identities. Simultaneous inclusion of the EmailAddress attribute in the subject distinguished name to support legacy implementations is deprecated but permitted.
生成带有电子邮件地址的新证书的一致性实现必须在“主题备选名称”字段中使用RFC822名称（见第4.2.1.7节）来描述此类身份。不推荐同时在主题可分辨名称中包含EmailAddress属性以支持旧式实现，但允许这样做。
This field is used to carry the public key and identify the algorithm with which the key is used. The algorithm is identified using the AlgorithmIdentifier structure specified in section 4.1.1.2. The object identifiers for the supported algorithms and the methods for encoding the public key materials (public key and parameters) are specified in section 7.3.
此字段用于携带公钥并标识使用该密钥的算法。使用第4.1.1.2节规定的算法识别器结构识别算法。第7.3节规定了支持算法的对象标识符和公钥材料（公钥和参数）的编码方法。
These fields may only appear if the version is 2 or 3 (see sec. 4.1.2.1). The subject and issuer unique identifiers are present in the certificate to handle the possibility of reuse of subject and/or issuer names over time. This profile recommends that names not be reused for different entities and that Internet certificates not make use of unique identifiers. CAs conforming to this profile SHOULD NOT generate certificates with unique identifiers. Applications conforming to this profile SHOULD be capable of parsing unique identifiers and making comparisons.
这些字段仅在版本为2或3时出现（见第4.1.2.1节）。主体和颁发者的唯一标识符存在于证书中，以处理随着时间的推移主体和/或颁发者名称重复使用的可能性。此配置文件建议不要为不同的实体重用名称，并且Internet证书不要使用唯一标识符。符合此配置文件的CA不应生成具有唯一标识符的证书。符合此配置文件的应用程序应该能够解析唯一标识符并进行比较。
This field may only appear if the version is 3 (see sec. 4.1.2.1). If present, this field is a SEQUENCE of one or more certificate extensions. The format and content of certificate extensions in the Internet PKI is defined in section 4.2.
此字段仅在版本为3时出现（见第4.1.2.1节）。如果存在，此字段是一个或多个证书扩展的序列。第4.2节定义了Internet PKI中证书扩展的格式和内容。
The extensions defined for X.509 v3 certificates provide methods for associating additional attributes with users or public keys and for managing the certification hierarchy. The X.509 v3 certificate format also allows communities to define private extensions to carry information unique to those communities. Each extension in a certificate may be designated as critical or non-critical. A certificate using system MUST reject the certificate if it encounters a critical extension it does not recognize; however, a non-critical extension may be ignored if it is not recognized. The following sections present recommended extensions used within Internet certificates and standard locations for information. Communities may elect to use additional extensions; however, caution should be exercised in adopting any critical extensions in certificates which might prevent use in a general context.
为X.509 v3证书定义的扩展提供了将附加属性与用户或公钥关联以及管理证书层次结构的方法。X.509 v3证书格式还允许社区定义专用扩展，以承载这些社区特有的信息。证书中的每个扩展都可以指定为关键或非关键。如果证书使用系统遇到无法识别的关键扩展，则必须拒绝该证书；但是，如果未识别非关键扩展，则可能会忽略它。以下各节介绍了Internet证书和标准位置中使用的推荐扩展，以供参考。社区可以选择使用额外的扩展；但是，在证书中采用任何可能妨碍在一般环境中使用的关键扩展时，应谨慎。
Each extension includes an OID and an ASN.1 structure. When an extension appears in a certificate, the OID appears as the field extnID and the corresponding ASN.1 encoded structure is the value of the octet string extnValue. Only one instance of a particular extension may appear in a particular certificate. For example, a certificate may contain only one authority key identifier extension (see sec. 4.2.1.1). An extension includes the boolean critical, with a default value of FALSE. The text for each extension specifies the acceptable values for the critical field.
每个扩展都包括一个OID和一个ASN.1结构。当扩展名出现在证书中时，OID显示为字段extnID，相应的ASN.1编码结构是八位字节字符串extnValue的值。特定证书中只能出现特定扩展的一个实例。例如，证书可能只包含一个授权密钥标识符扩展（参见第4.2.1.1节）。扩展包括布尔临界值，默认值为FALSE。每个扩展名的文本指定临界字段的可接受值。
Conforming CAs MUST support key identifiers (see sec. 4.2.1.1 and 4.2.1.2), basic constraints (see sec. 4.2.1.10), key usage (see sec. 4.2.1.3), and certificate policies (see sec. 4.2.1.5) extensions. If the CA issues certificates with an empty sequence for the subject field, the CA MUST support the subject alternative name extension (see sec. 4.2.1.7). Support for the remaining extensions is OPTIONAL. Conforming CAs may support extensions that are not identified within this specification; certificate issuers are cautioned that marking such extensions as critical may inhibit interoperability.
合格CA必须支持密钥标识符（见第4.2.1.1和4.2.1.2节）、基本约束（见第4.2.1.10节）、密钥使用（见第4.2.1.3节）和证书策略（见第4.2.1.5节）扩展。如果CA为subject字段颁发的证书序列为空，则CA必须支持subject备选名称扩展（参见第4.2.1.7节）。对其余扩展的支持是可选的。合格的CA可支持本规范中未确定的扩展；证书颁发者应注意，将此类扩展标记为关键可能会抑制互操作性。
At a minimum, applications conforming to this profile MUST recognize the extensions which must or may be critical in this specification. These extensions are: key usage (see sec. 4.2.1.3), certificate policies (see sec. 4.2.1.5), the subject alternative name (see sec. 4.2.1.7), basic constraints (see sec. 4.2.1.10), name constraints (see sec. 4.2.1.11), policy constraints (see sec. 4.2.1.12), and extended key usage (see sec. 4.2.1.13).
至少，符合本规范的应用必须识别本规范中必须或可能至关重要的扩展。这些扩展包括：密钥使用（见第4.2.1.3节）、证书策略（见第4.2.1.5节）、主体替代名称（见第4.2.1.7节）、基本约束（见第4.2.1.10节）、名称约束（见第4.2.1.11节）、策略约束（见第4.2.1.12节）和扩展密钥使用（见第4.2.1.13节）。
In addition, this profile RECOMMENDS application support for the authority and subject key identifier (see sec. 4.2.1.1 and 4.2.1.2) extensions.
此外，该概要文件建议应用程序支持授权和主题密钥标识符（见第4.2.1.1节和第4.2.1.2节）扩展。
This section identifies standard certificate extensions defined in [X.509] for use in the Internet PKI. Each extension is associated with an OID defined in [X.509]. These OIDs are members of the id-ce arc, which is defined by the following:
本节确定了[X.509]中定义的用于Internet PKI的标准证书扩展。每个扩展都与[X.509]中定义的OID相关联。这些OID是id ce arc的成员，其定义如下：
id-ce OBJECT IDENTIFIER ::= {joint-iso-ccitt(2) ds(5) 29}
id-ce OBJECT IDENTIFIER ::= {joint-iso-ccitt(2) ds(5) 29}
The authority key identifier extension provides a means of identifying the public key corresponding to the private key used to sign a certificate. This extension is used where an issuer has multiple signing keys (either due to multiple concurrent key pairs or due to changeover). The identification may be based on either the key identifier (the subject key identifier in the issuer's certificate) or on the issuer name and serial number.
授权密钥标识符扩展提供了识别与用于签署证书的私钥相对应的公钥的方法。此扩展用于颁发者具有多个签名密钥（由于多个并发密钥对或由于转换）的情况。标识可以基于密钥标识符（发卡机构证书中的主体密钥标识符）或发卡机构名称和序列号。
The keyIdentifier field of the authorityKeyIdentifier extension MUST be included in all certificates generated by conforming CAs to facilitate chain building. There is one exception; where a CA distributes its public key in the form of a "self-signed" certificate, the authority key identifier may be omitted. In this case, the subject and authority key identifiers would be identical.
authorityKeyIdentifier扩展的keyIdentifier字段必须包含在合格CA生成的所有证书中，以便于链构建。有一个例外；如果CA以“自签名”证书的形式分发其公钥，则可以省略授权密钥标识符。在这种情况下，主题和授权密钥标识符将是相同的。
The value of the keyIdentifier field SHOULD be derived from the public key used to verify the certificate's signature or a method that generates unique values. Two common methods for generating key identifiers from the public key are described in (sec. 4.2.1.2). One common method for generating unique values isdescribed in (sec. 4.2.1.2). Where a key identifier has not been previously established, this specification recommends use of one of these methods for generating keyIdentifiers.
keyIdentifier字段的值应来自用于验证证书签名的公钥或生成唯一值的方法。（第4.2.1.2节）中描述了从公钥生成密钥标识符的两种常用方法。生成唯一值的一种常用方法如（第4.2.1.2节）所述。如果先前未建立密钥标识符，本规范建议使用这些方法之一来生成密钥标识符。
This profile recommends support for the key identifier method by all certificate users.
此配置文件建议所有证书用户支持密钥标识符方法。
This extension MUST NOT be marked critical.
此扩展不能标记为关键。
id-ce-authorityKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 35 }
id-ce-authorityKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 35 }
AuthorityKeyIdentifier ::= SEQUENCE {
keyIdentifier [0] KeyIdentifier OPTIONAL,
authorityCertIssuer [1] GeneralNames OPTIONAL,
authorityCertSerialNumber [2] CertificateSerialNumber OPTIONAL }
AuthorityKeyIdentifier ::= SEQUENCE {
keyIdentifier [0] KeyIdentifier OPTIONAL,
authorityCertIssuer [1] GeneralNames OPTIONAL,
authorityCertSerialNumber [2] CertificateSerialNumber OPTIONAL }
KeyIdentifier ::= OCTET STRING
KeyIdentifier ::= OCTET STRING
The subject key identifier extension provides a means of identifying certificates that contain a particular public key.
主题密钥标识符扩展提供了一种识别包含特定公钥的证书的方法。
To facilitate chain building, this extension MUST appear in all con-forming CA certificates, that is, all certificates including the basic constraints extension (see sec. 4.2.1.10) where the value of cA is TRUE. The value of the subject key identifier MUST be the value placed in the key identifier field of the Authority Key Identifier extension (see sec. 4.2.1.1) of certificates issued by the subject of this certificate.
为便于链构建，此扩展必须出现在所有构成CA的证书中，即所有证书中，包括CA值为真的基本约束扩展（见第4.2.1.10节）。主体密钥标识符的值必须是由本证书主体颁发的证书的授权密钥标识符扩展（见第4.2.1.1节）的密钥标识符字段中的值。
For CA certificates, subject key identifiers SHOULD be derived from the public key or a method that generates unique values. Two common methods for generating key identifiers from the public key are:
对于CA证书，主题密钥标识符应来自公钥或生成唯一值的方法。从公钥生成密钥标识符的两种常用方法是：
(1) The keyIdentifier is composed of the 160-bit SHA-1 hash of the value of the BIT STRING subjectPublicKey (excluding the tag, length, and number of unused bits).
(1) keyIdentifier由位字符串subjectPublicKey值的160位SHA-1散列组成（不包括标记、长度和未使用位的数量）。
(2) The keyIdentifier is composed of a four bit type field with the value 0100 followed by the least significant 60 bits of the SHA-1 hash of the value of the BIT STRING subjectPublicKey.
(2) keyIdentifier由一个四位类型字段组成，该字段的值为0100，后跟位字符串subjectPublicKey值的SHA-1散列的最低有效60位。
One common method for generating unique values is a monotomically increasing sequence of integers.
生成唯一值的一种常用方法是整数的单原子递增序列。
For end entity certificates, the subject key identifier extension provides a means for identifying certificates containing the particular public key used in an application. Where an end entity has obtained multiple certificates, especially from multiple CAs, the subject key identifier provides a means to quickly identify the set of certificates containing a particular public key. To assist applications in identificiation the appropriate end entity certificate, this extension SHOULD be included in all end entity certificates.
对于终端实体证书，主题密钥标识符扩展提供了一种方法，用于识别包含应用程序中使用的特定公钥的证书。当终端实体已经获得多个证书，特别是从多个CA获得多个证书时，主体密钥标识符提供了一种快速识别包含特定公钥的证书集的方法。为了帮助应用程序识别适当的终端实体证书，此扩展应包含在所有终端实体证书中。
For end entity certificates, subject key identifiers SHOULD be derived from the public key. Two common methods for generating key identifiers from the public key are identifed above.
对于终端实体证书，主题密钥标识符应该从公钥派生。上面识别了从公钥生成密钥标识符的两种常用方法。
Where a key identifier has not been previously established, this specification recommends use of one of these methods for generating keyIdentifiers.
如果先前未建立密钥标识符，本规范建议使用这些方法之一来生成密钥标识符。
This extension MUST NOT be marked critical.
此扩展不能标记为关键。
id-ce-subjectKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 14 }
id-ce-subjectKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 14 }
SubjectKeyIdentifier ::= KeyIdentifier
SubjectKeyIdentifier ::= KeyIdentifier
The key usage extension defines the purpose (e.g., encipherment, signature, certificate signing) of the key contained in the certificate. The usage restriction might be employed when a key that could be used for more than one operation is to be restricted. For example, when an RSA key should be used only for signing, the digitalSignature and/or nonRepudiation bits would be asserted. Likewise, when an RSA key should be used only for key management, the keyEncipherment bit would be asserted. When used, this extension SHOULD be marked critical.
密钥使用扩展定义了证书中包含的密钥的用途（例如，加密、签名、证书签名）。当要限制可用于多个操作的密钥时，可以使用使用限制。例如，当RSA密钥仅用于签名时，将断言数字签名和/或不可否认位。同样，当RSA密钥仅用于密钥管理时，将断言密钥加密位。使用时，此扩展应标记为关键。
id-ce-keyUsage OBJECT IDENTIFIER ::= { id-ce 15 }
id-ce-keyUsage OBJECT IDENTIFIER ::= { id-ce 15 }
KeyUsage ::= BIT STRING {
digitalSignature (0),
nonRepudiation (1),
keyEncipherment (2),
dataEncipherment (3),
keyAgreement (4),
keyCertSign (5),
KeyUsage ::= BIT STRING {
digitalSignature (0),
nonRepudiation (1),
keyEncipherment (2),
dataEncipherment (3),
keyAgreement (4),
keyCertSign (5),
cRLSign (6), encipherOnly (7), decipherOnly (8) }
cRLSign（6）、仅加密（7）、仅解密（8）}
Bits in the KeyUsage type are used as follows:
KeyUsage类型中的位使用如下：
The digitalSignature bit is asserted when the subject public key is used with a digital signature mechanism to support security services other than non-repudiation (bit 1), certificate signing (bit 5), or revocation information signing (bit 6). Digital signature mechanisms are often used for entity authentication and data origin authentication with integrity.
当主体公钥与数字签名机制一起使用以支持除不可否认性（位1）、证书签名（位5）或撤销信息签名（位6）以外的安全服务时，数字签名位被断言。数字签名机制通常用于实体身份验证和具有完整性的数据源身份验证。
The nonRepudiation bit is asserted when the subject public key is used to verify digital signatures used to provide a non-repudiation service which protects against the signing entity falsely denying some action, excluding certificate or CRL signing.
当主体公钥用于验证用于提供不可否认服务的数字签名时，将断言不可否认位，该服务可防止签名实体错误地拒绝某些操作，不包括证书或CRL签名。
The keyEncipherment bit is asserted when the subject public key is used for key transport. For example, when an RSA key is to be used for key management, then this bit shall asserted.
当主题公钥用于密钥传输时，密钥加密位被断言。例如，当RSA密钥用于密钥管理时，应断言该位。
The dataEncipherment bit is asserted when the subject public key is used for enciphering user data, other than cryptographic keys.
当主题公钥用于加密用户数据（加密密钥除外）时，数据加密位被断言。
The keyAgreement bit is asserted when the subject public key is used for key agreement. For example, when a Diffie-Hellman key is to be used for key management, then this bit shall asserted.
当主题公钥用于密钥协商时，将断言密钥协商位。例如，当Diffie-Hellman密钥用于密钥管理时，应断言该位。
The keyCertSign bit is asserted when the subject public key is used for verifying a signature on certificates. This bit may only be asserted in CA certificates.
当主题公钥用于验证证书上的签名时，会断言keyCertSign位。此位只能在CA证书中断言。
The cRLSign bit is asserted when the subject public key is used for verifying a signature on revocation information (e.g., a CRL).
当主体公钥用于验证撤销信息（例如CRL）上的签名时，cRLSign位被断言。
The meaning of the encipherOnly bit is undefined in the absence of the keyAgreement bit. When the encipherOnly bit is asserted and the keyAgreement bit is also set, the subject public key may be used only for enciphering data while performing key agreement.
在没有密钥协商位的情况下，仅加密位的含义未定义。当仅加密位被断言并且密钥协商位也被设置时，主体公钥可仅用于在执行密钥协商时对数据进行加密。
The meaning of the decipherOnly bit is undefined in the absence of the keyAgreement bit. When the decipherOnly bit is asserted and the keyAgreement bit is also set, the subject public key may be used only for deciphering data while performing key agreement.
在没有密钥协商位的情况下，仅解密位的含义未定义。当仅解密位被断言并且密钥协商位也被设置时，主体公钥可仅用于在执行密钥协商时解密数据。
This profile does not restrict the combinations of bits that may be set in an instantiation of the keyUsage extension. However, appropriate values for keyUsage extensions for particular algorithms are specified in section 7.3.
此配置文件不限制可在keyUsage扩展的实例化中设置的位的组合。但是，第7.3节规定了特定算法的密钥使用扩展的适当值。
This profile recommends against the use of this extension. CAs conforming to this profile MUST NOT generate certificates with critical private key usage period extensions.
此配置文件建议不要使用此扩展。符合此配置文件的CA不得生成具有关键私钥使用期延长的证书。
The private key usage period extension allows the certificate issuer to specify a different validity period for the private key than the certificate. This extension is intended for use with digital signature keys. This extension consists of two optional components, notBefore and notAfter. The private key associated with the certificate should not be used to sign objects before or after the times specified by the two components, respectively. CAs conforming to this profile MUST NOT generate certificates with private key usage period extensions unless at least one of the two components is present.
私钥使用期限扩展允许证书颁发者为私钥指定与证书不同的有效期。此扩展旨在与数字签名密钥一起使用。此扩展由两个可选组件组成，notBefore和notAfter。在两个组件分别指定的时间之前或之后，不应使用与证书关联的私钥对对象进行签名。符合此配置文件的CA不得生成私钥使用期限延长的证书，除非至少存在两个组件中的一个。
Where used, notBefore and notAfter are represented as GeneralizedTime and MUST be specified and interpreted as defined in section 4.1.2.5.2.
使用时，NOTBEARE和NOTBAFTER表示为一般化时间，必须按照第4.1.2.5.2节中的定义进行规定和解释。
id-ce-privateKeyUsagePeriod OBJECT IDENTIFIER ::= { id-ce 16 }
id-ce-privateKeyUsagePeriod OBJECT IDENTIFIER ::= { id-ce 16 }
PrivateKeyUsagePeriod ::= SEQUENCE {
notBefore [0] GeneralizedTime OPTIONAL,
notAfter [1] GeneralizedTime OPTIONAL }
PrivateKeyUsagePeriod ::= SEQUENCE {
notBefore [0] GeneralizedTime OPTIONAL,
notAfter [1] GeneralizedTime OPTIONAL }
The certificate policies extension contains a sequence of one or more policy information terms, each of which consists of an object identifier (OID) and optional qualifiers. These policy information terms indicate the policy under which the certificate has been issued and the purposes for which the certificate may be used. Optional qualifiers, which may be present, are not expected to change the definition of the policy.
证书策略扩展包含一个或多个策略信息术语序列，每个术语由对象标识符（OID）和可选限定符组成。这些保单信息术语表示签发证书的保单以及证书的用途。可能存在的可选限定符预计不会更改策略的定义。
Applications with specific policy requirements are expected to have a list of those policies which they will accept and to compare the policy OIDs in the certificate to that list. If this extension is critical, the path validation software MUST be able to interpret this extension (including the optional qualifier), or MUST reject the certificate.
具有特定策略要求的应用程序需要有一个它们将接受的策略列表，并将证书中的策略OID与该列表进行比较。如果此扩展是关键的，则路径验证软件必须能够解释此扩展（包括可选限定符），或者必须拒绝证书。
To promote interoperability, this profile RECOMMENDS that policy information terms consist of only an OID. Where an OID alone is insufficient, this profile strongly recommends that use of qualifiers be limited to those identified in this section.
为了促进互操作性，此概要文件建议策略信息术语只包含OID。如果单独使用OID是不够的，本概要文件强烈建议限定符的使用仅限于本节中确定的限定符。
This specification defines two policy qualifier types for use by certificate policy writers and certificate issuers. The qualifier types are the CPS Pointer and User Notice qualifiers.
本规范定义了两种策略限定符类型，供证书策略编写者和证书颁发者使用。限定符类型是CPS指针限定符和用户通知限定符。
The CPS Pointer qualifier contains a pointer to a Certification Practice Statement (CPS) published by the CA. The pointer is in the form of a URI.
CPS指针限定符包含指向CA发布的认证实践声明（CPS）的指针。该指针采用URI的形式。
User notice is intended for display to a relying party when a certificate is used. The application software SHOULD display all user notices in all certificates of the certification path used, except that if a notice is duplicated only one copy need be displayed. To prevent such duplication, this qualifier SHOULD only be present in end-entity certificates and CA certificates issued to other organizations.
用户通知旨在在使用证书时向依赖方显示。应用软件应显示所用认证路径的所有证书中的所有用户通知，但如果通知重复，则只需显示一份副本。为防止此类重复，此限定符应仅出现在颁发给其他组织的最终实体证书和CA证书中。
The user notice has two optional fields: the noticeRef field and the explicitText field.
用户通知有两个可选字段：noticeRef字段和explicitText字段。
The noticeRef field, if used, names an organization and identifies, by number, a particular textual statement prepared by that organization. For example, it might identify the organization "CertsRUs" and notice number 1. In a typical implementation, the application software will have a notice file containing the current set of notices for CertsRUs; the application will extract the notice text from the file and display it. Messages may be multilingual, allowing the software to select the particular language message for its own environment.
noticeRef字段（如果使用）命名一个组织，并通过编号标识该组织准备的特定文本声明。例如，它可能会标识组织“CertsRUs”并通知编号1。在典型的实现中，应用软件将有一个通知文件，其中包含CertSRU的当前通知集；应用程序将从文件中提取通知文本并显示它。消息可以是多语言的，允许软件为自己的环境选择特定的语言消息。
An explicitText field includes the textual statement directly in the certificate. The explicitText field is a string with a maximum size of 200 characters.
explicitText字段直接在证书中包含文本语句。explicitText字段是最大大小为200个字符的字符串。
If both the noticeRef and explicitText options are included in the one qualifier and if the application software can locate the notice text indicated by the noticeRef option then that text should be displayed; otherwise, the explicitText string should be displayed.
如果noticeRef和explicitText选项都包含在一个限定符中，并且如果应用软件可以找到noticeRef选项指示的通知文本，则应显示该文本；否则，应显示explicitText字符串。
id-ce-certificatePolicies OBJECT IDENTIFIER ::= { id-ce 32 }
id-ce-certificatePolicies OBJECT IDENTIFIER ::= { id-ce 32 }
certificatePolicies ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation
certificatePolicies ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation
PolicyInformation ::= SEQUENCE {
policyIdentifier CertPolicyId,
policyQualifiers SEQUENCE SIZE (1..MAX) OF
PolicyQualifierInfo OPTIONAL }
PolicyInformation ::= SEQUENCE {
policyIdentifier CertPolicyId,
policyQualifiers SEQUENCE SIZE (1..MAX) OF
PolicyQualifierInfo OPTIONAL }
CertPolicyId ::= OBJECT IDENTIFIER
CertPolicyId ::= OBJECT IDENTIFIER
PolicyQualifierInfo ::= SEQUENCE {
policyQualifierId PolicyQualifierId,
qualifier ANY DEFINED BY policyQualifierId }
PolicyQualifierInfo ::= SEQUENCE {
policyQualifierId PolicyQualifierId,
qualifier ANY DEFINED BY policyQualifierId }
-- policyQualifierIds for Internet policy qualifiers
--Internet策略限定符的PolicyQualifierID
id-qt OBJECT IDENTIFIER ::= { id-pkix 2 }
id-qt-cps OBJECT IDENTIFIER ::= { id-qt 1 }
id-qt-unotice OBJECT IDENTIFIER ::= { id-qt 2 }
id-qt OBJECT IDENTIFIER ::= { id-pkix 2 }
id-qt-cps OBJECT IDENTIFIER ::= { id-qt 1 }
id-qt-unotice OBJECT IDENTIFIER ::= { id-qt 2 }
PolicyQualifierId ::=
OBJECT IDENTIFIER ( id-qt-cps | id-qt-unotice )
PolicyQualifierId ::=
OBJECT IDENTIFIER ( id-qt-cps | id-qt-unotice )
Qualifier ::= CHOICE {
cPSuri CPSuri,
userNotice UserNotice }
Qualifier ::= CHOICE {
cPSuri CPSuri,
userNotice UserNotice }
CPSuri ::= IA5String
CPSuri ::= IA5String
UserNotice ::= SEQUENCE {
noticeRef NoticeReference OPTIONAL,
explicitText DisplayText OPTIONAL}
UserNotice ::= SEQUENCE {
noticeRef NoticeReference OPTIONAL,
explicitText DisplayText OPTIONAL}
NoticeReference ::= SEQUENCE {
organization DisplayText,
noticeNumbers SEQUENCE OF INTEGER }
NoticeReference ::= SEQUENCE {
organization DisplayText,
noticeNumbers SEQUENCE OF INTEGER }
DisplayText ::= CHOICE {
visibleString VisibleString (SIZE (1..200)),
bmpString BMPString (SIZE (1..200)),
utf8String UTF8String (SIZE (1..200)) }
DisplayText ::= CHOICE {
visibleString VisibleString (SIZE (1..200)),
bmpString BMPString (SIZE (1..200)),
utf8String UTF8String (SIZE (1..200)) }
This extension is used in CA certificates. It lists one or more pairs of OIDs; each pair includes an issuerDomainPolicy and a subjectDomainPolicy. The pairing indicates the issuing CA considers its issuerDomainPolicy equivalent to the subject CA's subjectDomainPolicy.
此扩展用于CA证书中。它列出了一对或多对OID；每对包括一个issuerDomainPolicy和一个subjectDomainPolicy。配对表示颁发CA认为其issuerDomainPolicy等同于主体CA的subjectDomainPolicy。
The issuing CA's users may accept an issuerDomainPolicy for certain applications. The policy mapping tells the issuing CA's users which policies associated with the subject CA are comparable to the policy they accept.
颁发CA的用户可以接受某些应用程序的颁发者域策略。策略映射告诉发布CA的用户哪些与主题CA关联的策略与其接受的策略相比较。
This extension may be supported by CAs and/or applications, and it MUST be non-critical.
CAs和/或应用程序可能支持此扩展，并且它必须是非关键的。
id-ce-policyMappings OBJECT IDENTIFIER ::= { id-ce 33 }
id-ce-policyMappings OBJECT IDENTIFIER ::= { id-ce 33 }
PolicyMappings ::= SEQUENCE SIZE (1..MAX) OF SEQUENCE {
issuerDomainPolicy CertPolicyId,
subjectDomainPolicy CertPolicyId }
PolicyMappings ::= SEQUENCE SIZE (1..MAX) OF SEQUENCE {
issuerDomainPolicy CertPolicyId,
subjectDomainPolicy CertPolicyId }
The subject alternative names extension allows additional identities to be bound to the subject of the certificate. Defined options include an Internet electronic mail address, a DNS name, an IP address, and a uniform resource identifier (URI). Other options exist, including completely local definitions. Multiple name forms, and multiple instances of each name form, may be included. Whenever such identities are to be bound into a certificate, the subject alternative name (or issuer alternative name) extension MUST be used.
subject alternative names扩展允许将其他标识绑定到证书的主题。定义的选项包括Internet电子邮件地址、DNS名称、IP地址和统一资源标识符（URI）。还有其他选项，包括完全本地定义。可以包括多个姓名表以及每个姓名表的多个实例。每当此类标识要绑定到证书中时，必须使用subject alternative name（或issuer alternative name）扩展名。
Because the subject alternative name is considered to be definitiviely bound to the public key, all parts of the subject alternative name MUST be verified by the CA.
因为主体替代名称被认为是明确绑定到公钥的，所以主体替代名称的所有部分都必须由CA进行验证。
Further, if the only subject identity included in the certificate is an alternative name form (e.g., an electronic mail address), then the subject distinguished name MUST be empty (an empty sequence), and the subjectAltName extension MUST be present. If the subject field contains an empty sequence, the subjectAltName extension MUST be marked critical.
此外，如果证书中包含的唯一受试者身份是替代名称形式（例如电子邮件地址），则受试者可分辨名称必须为空（空序列），并且必须存在受试者名称扩展名。如果主题字段包含空序列，则必须将subjectAltName扩展名标记为关键。
When the subjectAltName extension contains an Internet mail address, the address MUST be included as an rfc822Name. The format of an rfc822Name is an "addr-spec" as defined in RFC 822 [RFC 822]. An addr-spec has the form "local-part@domain". Note that an addr-spec has no phrase (such as a common name) before it, has no comment (text surrounded in parentheses) after it, and is not surrounded by "<" and ">". Note that while upper and lower case letters are allowed in an RFC 822 addr-spec, no significance is attached to the case.
当subjectAltName扩展名包含Internet邮件地址时，该地址必须包含为RFC822名称。RFC822名称的格式是RFC 822[RFC 822]中定义的“addr spec”。addr规范的格式为“本地”-part@domain". 请注意，addr规范前面没有短语（例如通用名称），后面没有注释（括号中包含的文本），并且没有被“<”和“>”包围。请注意，尽管RFC 822 addr规范中允许使用大写和小写字母，但大小写没有任何意义。
When the subjectAltName extension contains a iPAddress, the address MUST be stored in the octet string in "network byte order," as specified in RFC 791 [RFC 791]. The least significant bit (LSB) of
当subjectAltName扩展名包含iPAddress时，地址必须按照RFC 791[RFC 791]中的规定以“网络字节顺序”存储在八位字节字符串中。的最低有效位（LSB）
each octet is the LSB of the corresponding byte in the network address. For IP Version 4, as specified in RFC 791, the octet string MUST contain exactly four octets. For IP Version 6, as specified in RFC 1883, the octet string MUST contain exactly sixteen octets [RFC 1883].
每个八位字节是网络地址中相应字节的LSB。对于IP版本4，如RFC 791中所述，八位字节字符串必须正好包含四个八位字节。对于IP版本6，如RFC 1883中所规定，八位字节字符串必须正好包含十六个八位字节[RFC 1883]。
When the subjectAltName extension contains a domain name service label, the domain name MUST be stored in the dNSName (an IA5String). The name MUST be in the "preferred name syntax," as specified by RFC 1034 [RFC 1034]. Note that while upper and lower case letters are allowed in domain names, no signifigance is attached to the case. In addition, while the string " " is a legal domain name, subjectAltName extensions with a dNSName " " are not permitted. Finally, the use of the DNS representation for Internet mail addresses (wpolk.nist.gov instead of wpolk@nist.gov) is not permitted; such identities are to be encoded as rfc822Name.
当subjectAltName扩展名包含域名服务标签时，域名必须存储在dNSName（IA5String）中。名称必须采用RFC 1034[RFC 1034]指定的“首选名称语法”。请注意，虽然域名中允许使用大写和小写字母，但大小写不带任何意义。此外，虽然字符串“”是合法域名，但不允许使用dNSName“”的subjectAltName扩展名。最后，对互联网邮件地址使用DNS表示（wpolk.nist.gov，而不是wpolk@nist.gov)是不允许的；此类标识将被编码为rfc822Name。
When the subjectAltName extension contains a URI, the name MUST be stored in the uniformResourceIdentifier (an IA5String). The name MUST be a non-relative URL, and MUST follow the URL syntax and encoding rules specified in [RFC 1738]. The name must include both a scheme (e.g., "http" or "ftp") and a scheme-specific-part. The scheme-specific-part must include a fully qualified domain name or IP address as the host.
当subjectAltName扩展名包含URI时，该名称必须存储在uniformResourceIdentifier（IA5String）中。名称必须是非相对URL，并且必须遵循[RFC 1738]中指定的URL语法和编码规则。名称必须包括方案（例如“http”或“ftp”）和特定于方案的部分。方案特定部分必须包括作为主机的完全限定域名或IP地址。
As specified in [RFC 1738], the scheme name is not case-sensitive (e.g., "http" is equivalent to "HTTP"). The host part is also not case-sensitive, but other components of the scheme-specific-part may be case-sensitive. When comparing URIs, conforming implementations MUST compare the scheme and host without regard to case, but assume the remainder of the scheme-specific-part is case sensitive.
如[RFC 1738]所述，方案名称不区分大小写（例如，“http”相当于“http”）。主机部分也不区分大小写，但方案特定部分的其他组件可能区分大小写。在比较URI时，一致性实现必须比较方案和主机，而不考虑大小写，但假定方案特定部分的其余部分区分大小写。
Subject alternative names may be constrained in the same manner as subject distinguished names using the name constraints extension as described in section 4.2.1.11.
可使用第4.2.1.11节所述的名称约束扩展，以与受试者可分辨名称相同的方式约束受试者备选名称。
If the subjectAltName extension is present, the sequence MUST contain at least one entry. Unlike the subject field, conforming CAs MUST NOT issue certificates with subjectAltNames containing empty GeneralName fields. For example, an rfc822Name is represented as an IA5String. While an empty string is a valid IA5String, such an rfc822Name is not permitted by this profile. The behavior of clients that encounter such a certificate when processing a certificication path is not defined by this profile.
如果存在subjectAltName扩展名，则序列必须至少包含一个条目。与subject字段不同，一致性CA不得颁发SubjectAltName包含空GeneralName字段的证书。例如，RFC822名称表示为IA5String。虽然空字符串是有效的IA5String，但此配置文件不允许使用此类RFC822名称。此配置文件未定义在处理证书路径时遇到此类证书的客户端的行为。
Finally, the semantics of subject alternative names that include wildcard characters (e.g., as a placeholder for a set of names) are not addressed by this specification. Applications with specific requirements may use such names but shall define the semantics.
最后，包含通配符（例如，作为一组名称的占位符）的主题备选名称的语义不在本规范中讨论。具有特定要求的应用程序可使用此类名称，但应定义语义。
id-ce-subjectAltName OBJECT IDENTIFIER ::= { id-ce 17 }
id-ce-subjectAltName OBJECT IDENTIFIER ::= { id-ce 17 }
SubjectAltName ::= GeneralNames
SubjectAltName ::= GeneralNames
GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
GeneralName ::= CHOICE {
otherName [0] OtherName,
rfc822Name [1] IA5String,
dNSName [2] IA5String,
x400Address [3] ORAddress,
directoryName [4] Name,
ediPartyName [5] EDIPartyName,
uniformResourceIdentifier [6] IA5String,
iPAddress [7] OCTET STRING,
registeredID [8] OBJECT IDENTIFIER}
GeneralName ::= CHOICE {
otherName [0] OtherName,
rfc822Name [1] IA5String,
dNSName [2] IA5String,
x400Address [3] ORAddress,
directoryName [4] Name,
ediPartyName [5] EDIPartyName,
uniformResourceIdentifier [6] IA5String,
iPAddress [7] OCTET STRING,
registeredID [8] OBJECT IDENTIFIER}
OtherName ::= SEQUENCE {
type-id OBJECT IDENTIFIER,
value [0] EXPLICIT ANY DEFINED BY type-id }
OtherName ::= SEQUENCE {
type-id OBJECT IDENTIFIER,
value [0] EXPLICIT ANY DEFINED BY type-id }
EDIPartyName ::= SEQUENCE {
nameAssigner [0] DirectoryString OPTIONAL,
partyName [1] DirectoryString }
EDIPartyName ::= SEQUENCE {
nameAssigner [0] DirectoryString OPTIONAL,
partyName [1] DirectoryString }
As with 4.2.1.7, this extension is used to associate Internet style identities with the certificate issuer. Issuer alternative names MUST be encoded as in 4.2.1.7.
与4.2.1.7一样，此扩展用于将Internet样式标识与证书颁发者关联。发卡机构备选名称必须按照4.2.1.7进行编码。
Where present, this extension SHOULD NOT be marked critical.
如果存在此扩展，则不应将其标记为关键扩展。
id-ce-issuerAltName OBJECT IDENTIFIER ::= { id-ce 18 }
id-ce-issuerAltName OBJECT IDENTIFIER ::= { id-ce 18 }
IssuerAltName ::= GeneralNames
IssuerAltName ::= GeneralNames
The subject directory attributes extension is not recommended as an essential part of this profile, but it may be used in local environments. This extension MUST be non-critical.
不建议将subject directory attributes扩展作为此配置文件的重要部分，但它可以在本地环境中使用。此扩展必须是非关键的。
id-ce-subjectDirectoryAttributes OBJECT IDENTIFIER ::= { id-ce 9 }
id-ce-subjectDirectoryAttributes OBJECT IDENTIFIER ::= { id-ce 9 }
SubjectDirectoryAttributes ::= SEQUENCE SIZE (1..MAX) OF Attribute
SubjectDirectoryAttributes ::= SEQUENCE SIZE (1..MAX) OF Attribute
The basic constraints extension identifies whether the subject of the certificate is a CA and how deep a certification path may exist through that CA.
基本约束扩展标识证书的主题是否是CA，以及通过该CA的证书路径的深度。
The pathLenConstraint field is meaningful only if cA is set to TRUE. In this case, it gives the maximum number of CA certificates that may follow this certificate in a certification path. A value of zero indicates that only an end-entity certificate may follow in the path. Where it appears, the pathLenConstraint field MUST be greater than or equal to zero. Where pathLenConstraint does not appear, there is no limit to the allowed length of the certification path.
只有当cA设置为TRUE时，pathLenConstraint字段才有意义。在这种情况下，它给出了证书路径中该证书后面的CA证书的最大数量。值为零表示路径中只能跟随最终实体证书。出现时，pathLenConstraint字段必须大于或等于零。如果未显示pathLenConstraint，则对证书路径的允许长度没有限制。
This extension MUST appear as a critical extension in all CA certificates. This extension SHOULD NOT appear in end entity certificates.
此扩展必须在所有CA证书中显示为关键扩展。此扩展不应出现在最终实体证书中。
id-ce-basicConstraints OBJECT IDENTIFIER ::= { id-ce 19 }
id-ce-basicConstraints OBJECT IDENTIFIER ::= { id-ce 19 }
BasicConstraints ::= SEQUENCE {
cA BOOLEAN DEFAULT FALSE,
pathLenConstraint INTEGER (0..MAX) OPTIONAL }
BasicConstraints ::= SEQUENCE {
cA BOOLEAN DEFAULT FALSE,
pathLenConstraint INTEGER (0..MAX) OPTIONAL }
The name constraints extension, which MUST be used only in a CA certificate, indicates a name space within which all subject names in subsequent certificates in a certification path shall be located. Restrictions may apply to the subject distinguished name or subject alternative names. Restrictions apply only when the specified name form is present. If no name of the type is in the certificate, the certificate is acceptable.
name constraints扩展只能在CA证书中使用，它表示一个名称空间，证书路径中后续证书中的所有使用者名称都应位于该名称空间中。限制可能适用于受试者专有名称或受试者备选名称。仅当指定的名称表单存在时，限制才适用。如果证书中没有类型名称，则该证书是可接受的。
Restrictions are defined in terms of permitted or excluded name subtrees. Any name matching a restriction in the excludedSubtrees field is invalid regardless of information appearing in the permittedSubtrees. This extension MUST be critical.
限制是根据允许或排除的名称子树定义的。任何与excludedSubtrees字段中的限制匹配的名称都无效，无论permittedSubtrees中显示的信息如何。这一扩展必须至关重要。
Within this profile, the minimum and maximum fields are not used with any name forms, thus minimum is always zero, and maximum is always absent.
在此配置文件中，最小和最大字段不与任何名称表单一起使用，因此最小值始终为零，而最大值始终不存在。
For URIs, the constraint applies to the host part of the name. The constraint may specify a host or a domain. Examples would be "foo.bar.com"; and ".xyz.com". When the the constraint begins with a period, it may be expanded with one or more subdomains. That is, the constraint ".xyz.com" is satisfied by both abc.xyz.com and abc.def.xyz.com. However, the constraint ".xyz.com" is not satisfied by "xyz.com". When the constraint does not begin with a period, it specifies a host.
对于URI，约束将应用于名称的主机部分。该约束可以指定主机或域。例如“foo.bar.com”；和“.xyz.com”。当约束以句点开始时，可以用一个或多个子域展开。也就是说，abc.xyz.com和abc.def.xyz.com都满足约束“.xyz.com”。但是，“xyz.com”不满足约束“.xyz.com”。当约束不以句点开头时，它将指定一个主体。
A name constraint for Internat mail addresses may specify a particular mailbox, all addresses at a particular host, or all mailboxes in a domain. To indicate a particular mailbox, the constraint is the complete mail address. For example, "root@xyz.com" indicates the root mailbox on the host "xyz.com". To indicate all Internet mail addresses on a particular host, the constraint is specified as the host name. For example, the constraint "xyz.com" is satisfied by any mail address at the host "xyz.com". To specify any address within a domain, the constraint is specified with a leading period (as with URIs). For example, ".xyz.com" indicates all the Internet mail addresses in the domain "xyz.com", but Internet mail addresses on the host "xyz.com".
Internat邮件地址的名称约束可以指定特定邮箱、特定主机上的所有地址或域中的所有邮箱。要指示特定邮箱，约束条件是完整的邮件地址。例如，”root@xyz.com表示主机“xyz.com”上的根邮箱。要指示特定主机上的所有Internet邮件地址，将约束指定为主机名。例如，主机“xyz.com”上的任何邮件地址都满足约束“xyz.com”。若要指定域中的任何地址，将使用前导句点指定约束（与URI一样）。例如，“.xyz.com”表示域“xyz.com”中的所有Internet邮件地址，但主机“xyz.com”上的Internet邮件地址除外。
DNS name restrictions are expressed as foo.bar.com. Any subdomain satisfies the name constraint. For example, www.foo.bar.com would satisfy the constraint but bigfoo.bar.com would not.
DNS名称限制表示为foo.bar.com。任何子域都满足名称约束。例如，www.foo.bar.com将满足约束，但bigfoo.bar.com将不满足约束。
Legacy implementations exist where an RFC 822 name is embedded in the subject distinguished name in an attribute of type EmailAddress (see sec. 4.1.2.6). When rfc822 names are constrained, but the certificate does not include a subject alternative name, the rfc822 name constraint MUST be applied to the attribute of type EmailAddress in the subject distinguished name. The ASN.1 syntax for EmailAddress and the corresponding OID are supplied in Appendix A and B.
旧式实现中，RFC 822名称嵌入在EmailAddress类型属性中的主题可分辨名称中（见第4.1.2.6节）。当rfc822名称受到约束，但证书不包括使用者备选名称时，rfc822名称约束必须应用于使用者可分辨名称中EmailAddress类型的属性。EmailAddress的ASN.1语法和相应的OID在附录A和B中提供。
Restrictions of the form directoryName MUST be applied to the subject field in the certificate and to the subjectAltName extensions of type directoryName. Restrictions of the form x400Address MUST be applied to subjectAltName extensions of type x400Address.
格式directoryName的限制必须应用于证书中的subject字段和directoryName类型的subjectAltName扩展。x400Address格式的限制必须应用于x400Address类型的subjectAltName扩展名。
When applying restrictions of the form directoryName, an implementation MUST compare DN attributes. At a minimum, implementations MUST perform the DN comparison rules specified in Section 4.1.2.4. CAs issuing certificates with a restriction of the form directoryName SHOULD NOT rely on implementation of the full ISO DN name comparison algorithm. This implies name restrictions shall be stated identically to the encoding used in the subject field or subjectAltName extension.
应用directoryName表单的限制时，实现必须比较DN属性。实施至少必须执行第4.1.2.4节中规定的DN比较规则。CA颁发具有directoryName格式限制的证书不应依赖于完整ISO DN名称比较算法的实现。这意味着名称限制应与主题字段或主题名称扩展中使用的编码相同。
The syntax of iPAddress MUST be as described in section 4.2.1.7 with the following additions specifically for Name Constraints. For IPv4 addresses, the ipAddress field of generalName MUST contain eight (8) octets, encoded in the style of RFC 1519 (CIDR) to represent an address range.[RFC 1519] For IPv6 addresses, the ipAddress field MUST contain 32 octets similarly encoded. For example, a name constraint for "class C" subnet 10.9.8.0 shall be represented as the octets 0A 09 08 00 FF FF FF 00, representing the CIDR notation 10.9.8.0/255.255.255.0.
iPAddress的语法必须如第4.2.1.7节所述，并特别针对名称限制添加以下内容。对于IPv4地址，generalName的ipAddress字段必须包含八（8）个八位字节，以RFC 1519（CIDR）的样式进行编码以表示地址范围。[RFC 1519]对于IPv6地址，ipAddress字段必须包含32个八位字节，编码方式类似。例如，“C类”子网10.9.8.0的名称约束应表示为八位字节0A 09 08 00 FF 00，表示CIDR符号10.9.8.0/255.255.255.0。
The syntax and semantics for name constraints for otherName, ediPartyName, and registeredID are not defined by this specification.
本规范未定义otherName、ePartyName和registeredID的名称约束的语法和语义。
id-ce-nameConstraints OBJECT IDENTIFIER ::= { id-ce 30 }
id-ce-nameConstraints OBJECT IDENTIFIER ::= { id-ce 30 }
NameConstraints ::= SEQUENCE {
permittedSubtrees [0] GeneralSubtrees OPTIONAL,
excludedSubtrees [1] GeneralSubtrees OPTIONAL }
NameConstraints ::= SEQUENCE {
permittedSubtrees [0] GeneralSubtrees OPTIONAL,
excludedSubtrees [1] GeneralSubtrees OPTIONAL }
GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
GeneralSubtree ::= SEQUENCE {
base GeneralName,
minimum [0] BaseDistance DEFAULT 0,
maximum [1] BaseDistance OPTIONAL }
GeneralSubtree ::= SEQUENCE {
base GeneralName,
minimum [0] BaseDistance DEFAULT 0,
maximum [1] BaseDistance OPTIONAL }
BaseDistance ::= INTEGER (0..MAX)
BaseDistance ::= INTEGER (0..MAX)
The policy constraints extension can be used in certificates issued to CAs. The policy constraints extension constrains path validation in two ways. It can be used to prohibit policy mapping or require that each certificate in a path contain an acceptable policy identifier.
策略约束扩展可用于颁发给CA的证书。策略约束扩展以两种方式约束路径验证。它可用于禁止策略映射或要求路径中的每个证书包含可接受的策略标识符。
If the inhibitPolicyMapping field is present, the value indicates the number of additional certificates that may appear in the path before policy mapping is no longer permitted. For example, a value of one indicates that policy mapping may be processed in certificates issued by the subject of this certificate, but not in additional certificates in the path.
如果存在inhibitPolicyMapping字段，则该值指示在不再允许策略映射之前路径中可能出现的其他证书的数量。例如，值为1表示可以在该证书的主体颁发的证书中处理策略映射，但不能在路径中的其他证书中处理。
If the requireExplicitPolicy field is present, subsequent certificates shall include an acceptable policy identifier. The value of requireExplicitPolicy indicates the number of additional certificates that may appear in the path before an explicit policy is required. An acceptable policy identifier is the identifier of a
如果存在requireExplicitPolicy字段，则后续证书应包括可接受的策略标识符。requireExplicitPolicy的值表示在需要显式策略之前，路径中可能出现的其他证书的数量。可接受的策略标识符是策略的标识符
policy required by the user of the certification path or the identifier of a policy which has been declared equivalent through policy mapping.
证书路径的用户所需的策略或通过策略映射声明为等效的策略的标识符。
Conforming CAs MUST NOT issue certificates where policy constraints is a null sequence. That is, at least one of the inhibitPolicyMapping field or the requireExplicitPolicy field MUST be present. The behavior of clients that encounter a null policy constraints field is not addressed in this profile.
当策略约束为空序列时，符合条件的CA不得颁发证书。也就是说，必须至少存在inhibitPolicyMapping字段或requireExplicitPolicy字段中的一个。遇到空策略约束字段的客户机的行为在此配置文件中未解决。
This extension may be critical or non-critical.
此扩展可能是关键的，也可能是非关键的。
id-ce-policyConstraints OBJECT IDENTIFIER ::= { id-ce 36 }
id-ce-policyConstraints OBJECT IDENTIFIER ::= { id-ce 36 }
PolicyConstraints ::= SEQUENCE {
requireExplicitPolicy [0] SkipCerts OPTIONAL,
inhibitPolicyMapping [1] SkipCerts OPTIONAL }
PolicyConstraints ::= SEQUENCE {
requireExplicitPolicy [0] SkipCerts OPTIONAL,
inhibitPolicyMapping [1] SkipCerts OPTIONAL }
SkipCerts ::= INTEGER (0..MAX)
SkipCerts ::= INTEGER (0..MAX)
This field indicates one or more purposes for which the certified public key may be used, in addition to or in place of the basic purposes indicated in the key usage extension field. This field is defined as follows:
除密钥使用扩展字段中指示的基本用途外，此字段指示认证公钥可用于的一个或多个用途。该字段定义如下：
id-ce-extKeyUsage OBJECT IDENTIFIER ::= {id-ce 37}
id-ce-extKeyUsage OBJECT IDENTIFIER ::= {id-ce 37}
ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId
ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId
KeyPurposeId ::= OBJECT IDENTIFIER
KeyPurposeId ::= OBJECT IDENTIFIER
Key purposes may be defined by any organization with a need. Object identifiers used to identify key purposes shall be assigned in accordance with IANA or ITU-T Rec. X.660 | ISO/IEC/ITU 9834-1.
关键目的可由任何有需要的组织确定。用于识别关键用途的对象标识符应按照IANA或ITU-T Rec.X.660 | ISO/IEC/ITU 9834-1进行分配。
This extension may, at the option of the certificate issuer, be either critical or non-critical.
根据证书颁发者的选择，此扩展可以是关键的，也可以是非关键的。
If the extension is flagged critical, then the certificate MUST be used only for one of the purposes indicated.
如果扩展被标记为关键，则证书只能用于指定的用途之一。
If the extension is flagged non-critical, then it indicates the intended purpose or purposes of the key, and may be used in finding the correct key/certificate of an entity that has multiple keys/certificates. It is an advisory field and does not imply that usage of the key is restricted by the certification authority to the
如果扩展标记为非关键，则它指示密钥的预期用途，并可用于查找具有多个密钥/证书的实体的正确密钥/证书。这是一个咨询字段，并不意味着密钥的使用受到证书颁发机构的限制
purpose indicated. Certificate using applications may nevertheless require that a particular purpose be indicated in order for the certificate to be acceptable to that application.
目的明确。然而，使用证书的应用程序可能需要指明特定用途，以便该应用程序能够接受该证书。
If a certificate contains both a critical key usage field and a critical extended key usage field, then both fields MUST be processed independently and the certificate MUST only be used for a purpose consistent with both fields. If there is no purpose consistent with both fields, then the certificate MUST NOT be used for any purpose.
如果证书同时包含关键密钥使用字段和关键扩展密钥使用字段，则必须独立处理这两个字段，并且证书只能用于与这两个字段一致的目的。如果没有与这两个字段一致的目的，则证书不得用于任何目的。
The following key usage purposes are defined by this profile:
此配置文件定义了以下主要用途：
id-kp OBJECT IDENTIFIER ::= { id-pkix 3 }
id-kp OBJECT IDENTIFIER ::= { id-pkix 3 }
id-kp-serverAuth OBJECT IDENTIFIER ::= {id-kp 1}
-- TLS Web server authentication
-- Key usage bits that may be consistent: digitalSignature,
-- keyEncipherment or keyAgreement
--
id-kp-clientAuth OBJECT IDENTIFIER ::= {id-kp 2}
-- TLS Web client authentication
-- Key usage bits that may be consistent: digitalSignature and/or
-- keyAgreement
--
id-kp-codeSigning OBJECT IDENTIFIER ::= {id-kp 3}
-- Signing of downloadable executable code
-- Key usage bits that may be consistent: digitalSignature
--
id-kp-emailProtection OBJECT IDENTIFIER ::= {id-kp 4}
-- E-mail protection
-- Key usage bits that may be consistent: digitalSignature,
-- nonRepudiation, and/or (keyEncipherment
-- or keyAgreement)
--
id-kp-timeStamping OBJECT IDENTIFIER ::= { id-kp 8 }
-- Binding the hash of an object to a time from an agreed-upon time
-- source. Key usage bits that may be consistent: digitalSignature,
-- nonRepudiation
id-kp-serverAuth OBJECT IDENTIFIER ::= {id-kp 1}
-- TLS Web server authentication
-- Key usage bits that may be consistent: digitalSignature,
-- keyEncipherment or keyAgreement
--
id-kp-clientAuth OBJECT IDENTIFIER ::= {id-kp 2}
-- TLS Web client authentication
-- Key usage bits that may be consistent: digitalSignature and/or
-- keyAgreement
--
id-kp-codeSigning OBJECT IDENTIFIER ::= {id-kp 3}
-- Signing of downloadable executable code
-- Key usage bits that may be consistent: digitalSignature
--
id-kp-emailProtection OBJECT IDENTIFIER ::= {id-kp 4}
-- E-mail protection
-- Key usage bits that may be consistent: digitalSignature,
-- nonRepudiation, and/or (keyEncipherment
-- or keyAgreement)
--
id-kp-timeStamping OBJECT IDENTIFIER ::= { id-kp 8 }
-- Binding the hash of an object to a time from an agreed-upon time
-- source. Key usage bits that may be consistent: digitalSignature,
-- nonRepudiation
The CRL distribution points extension identifies how CRL information is obtained. The extension SHOULD be non-critical, but this profile recommends support for this extension by CAs and applications. Further discussion of CRL management is contained in section 5.
CRL分发点扩展标识如何获取CRL信息。扩展应该是非关键的，但此概要文件建议CAs和应用程序支持此扩展。关于CRL管理的进一步讨论见第5节。
If the cRLDistributionPoints extension contains a DistributionPointName of type URI, the following semantics MUST be assumed: the URI is a pointer to the current CRL for the associated reasons and will be issued by the associated cRLIssuer. The expected values for the URI are those defined in 4.2.1.7. Processing rules for other values are not defined by this specification. If the distributionPoint omits reasons, the CRL MUST include revocations for all reasons. If the distributionPoint omits cRLIssuer, the CRL MUST be issued by the CA that issued the certificate.
如果cRLDistributionPoints扩展包含URI类型的DistributionPointName，则必须假定以下语义：URI是指向当前CRL的指针，其原因与关联的cRLIssuer相关。URI的预期值是4.2.1.7中定义的值。本规范未定义其他值的处理规则。如果distributionPoint忽略了原因，CRL必须包括所有原因的撤销。如果分发点省略了cRLIssuer，则CRL必须由颁发证书的CA颁发。
id-ce-cRLDistributionPoints OBJECT IDENTIFIER ::= { id-ce 31 }
id-ce-cRLDistributionPoints OBJECT IDENTIFIER ::= { id-ce 31 }
cRLDistributionPoints ::= {
CRLDistPointsSyntax }
cRLDistributionPoints ::= {
CRLDistPointsSyntax }
CRLDistPointsSyntax ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint
CRLDistPointsSyntax ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint
DistributionPoint ::= SEQUENCE {
distributionPoint [0] DistributionPointName OPTIONAL,
reasons [1] ReasonFlags OPTIONAL,
cRLIssuer [2] GeneralNames OPTIONAL }
DistributionPoint ::= SEQUENCE {
distributionPoint [0] DistributionPointName OPTIONAL,
reasons [1] ReasonFlags OPTIONAL,
cRLIssuer [2] GeneralNames OPTIONAL }
DistributionPointName ::= CHOICE {
fullName [0] GeneralNames,
nameRelativeToCRLIssuer [1] RelativeDistinguishedName }
DistributionPointName ::= CHOICE {
fullName [0] GeneralNames,
nameRelativeToCRLIssuer [1] RelativeDistinguishedName }
ReasonFlags ::= BIT STRING {
unused (0),
keyCompromise (1),
cACompromise (2),
affiliationChanged (3),
superseded (4),
cessationOfOperation (5),
certificateHold (6) }
ReasonFlags ::= BIT STRING {
unused (0),
keyCompromise (1),
cACompromise (2),
affiliationChanged (3),
superseded (4),
cessationOfOperation (5),
certificateHold (6) }
This section defines one new extension for use in the Internet Public Key Infrastructure. This extension may be used to direct applications to identify an on-line validation service supporting the issuing CA. As the information may be available in multiple forms, each extension is a sequence of IA5String values, each of which represents a URI. The URI implicitly specifies the location and format of the information and the method for obtaining the information.
本节定义了一个用于Internet公钥基础设施的新扩展。此扩展可用于指导应用程序识别支持颁发CA的在线验证服务。由于信息可能以多种形式提供，每个扩展是一个IA5String值序列，每个值代表一个URI。URI隐式地指定信息的位置和格式以及获取信息的方法。
An object identifier is defined for the private extension. The object identifier associated with the private extension is defined under the arc id-pe within the id-pkix name space. Any future extensions defined for the Internet PKI will also be defined under the arc id-pe.
为专用扩展定义了对象标识符。与专用扩展关联的对象标识符在id pkix名称空间中的arc id pe下定义。为互联网PKI定义的任何未来扩展也将在arc id pe下定义。
id-pkix OBJECT IDENTIFIER ::=
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) }
id-pkix OBJECT IDENTIFIER ::=
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) }
id-pe OBJECT IDENTIFIER ::= { id-pkix 1 }
id-pe OBJECT IDENTIFIER ::= { id-pkix 1 }
The authority information access extension indicates how to access CA information and services for the issuer of the certificate in which the extension appears. Information and services may include on-line validation services and CA policy data. (The location of CRLs is not specified in this extension; that information is provided by the cRLDistributionPoints extension.) This extension may be included in subject or CA certificates, and it MUST be non-critical.
authority information access extension表示如何访问证书颁发者的CA信息和服务，该证书中显示了该扩展。信息和服务可能包括在线验证服务和CA策略数据。（此扩展中未指定CRL的位置；该信息由cRLDistributionPoints扩展提供。）此扩展可以包含在subject或CA证书中，并且必须是非关键的。
id-pe-authorityInfoAccess OBJECT IDENTIFIER ::= { id-pe 1 }
id-pe-authorityInfoAccess OBJECT IDENTIFIER ::= { id-pe 1 }
AuthorityInfoAccessSyntax ::=
SEQUENCE SIZE (1..MAX) OF AccessDescription
AuthorityInfoAccessSyntax ::=
SEQUENCE SIZE (1..MAX) OF AccessDescription
AccessDescription ::= SEQUENCE {
accessMethod OBJECT IDENTIFIER,
accessLocation GeneralName }
AccessDescription ::= SEQUENCE {
accessMethod OBJECT IDENTIFIER,
accessLocation GeneralName }
id-ad OBJECT IDENTIFIER ::= { id-pkix 48 }
id-ad OBJECT IDENTIFIER ::= { id-pkix 48 }
id-ad-caIssuers OBJECT IDENTIFIER ::= { id-ad 2 }
id-ad-caIssuers OBJECT IDENTIFIER ::= { id-ad 2 }
Each entry in the sequence AuthorityInfoAccessSyntax describes the format and location of additional information about the CA who issued the certificate in which this extension appears. The type and format of the information is specified by the accessMethod field; the accessLocation field specifies the location of the information. The retrieval mechanism may be implied by the accessMethod or specified by accessLocation.
sequence AuthorityInfoAccessSyntax中的每个条目都描述了有关颁发此扩展出现在其中的证书的CA的附加信息的格式和位置。信息的类型和格式由accessMethod字段指定；accessLocation字段指定信息的位置。检索机制可能由accessLocation指定的访问器方法暗示。
This profile defines one OID for accessMethod. The id-ad-caIssuers OID is used when the additional information lists CAs that have issued certificates superior to the CA that issued the certificate
此配置文件为accessMethod定义了一个OID。当附加信息列出已颁发证书的CA优于颁发证书的CA时，将使用id ad caIssuers OID
containing this extension. The referenced CA Issuers description is intended to aid certificate users in the selection of a certification path that terminates at a point trusted by the certificate user.
包含此扩展名。引用的CA颁发者描述旨在帮助证书用户选择终止于证书用户信任点的证书路径。
When id-ad-caIssuers appears as accessInfoType, the accessLocation field describes the referenced description server and the access protocol to obtain the referenced description. The accessLocation field is defined as a GeneralName, which can take several forms. Where the information is available via http, ftp, or ldap, accessLocation MUST be a uniformResourceIdentifier. Where the information is available via the directory access protocol (dap), accessLocation MUST be a directoryName. When the information is available via electronic mail, accessLocation MUST be an rfc822Name. The semantics of other name forms of accessLocation (when accessMethod is id-ad-caIssuers) are not defined by this specification.
当id ad caIssuers显示为accessInfoType时，accessLocation字段描述引用的描述服务器和获取引用描述的访问协议。accessLocation字段定义为GeneralName，可以采用多种形式。如果信息通过http、ftp或ldap可用，则accessLocation必须是uniformResourceIdentifier。如果信息通过目录访问协议（dap）可用，则accessLocation必须是directoryName。当信息通过电子邮件提供时，accessLocation必须是RFC822名称。accessLocation的其他名称形式的语义（当accessMethod为id ad caIssuers时）不在本规范中定义。
Additional access descriptors may be defined in other PKIX specifications.
其他访问描述符可在其他PKIX规范中定义。
5 CRL and CRL Extensions Profile
5 CRL和CRL扩展配置文件
As described above, one goal of this X.509 v2 CRL profile is to foster the creation of an interoperable and reusable Internet PKI. To achieve this goal, guidelines for the use of extensions are specified, and some assumptions are made about the nature of information included in the CRL.
如上所述，X.509 v2 CRL概要文件的一个目标是促进创建可互操作和可重用的Internet PKI。为了实现这一目标，指定了扩展使用指南，并对CRL中包含的信息的性质进行了一些假设。
CRLs may be used in a wide range of applications and environments covering a broad spectrum of interoperability goals and an even broader spectrum of operational and assurance requirements. This profile establishes a common baseline for generic applications requiring broad interoperability. The profile defines a baseline set of information that can be expected in every CRL. Also, the profile defines common locations within the CRL for frequently used attributes as well as common representations for these attributes.
CRL可用于范围广泛的应用程序和环境，涵盖广泛的互操作性目标以及更广泛的操作和保证要求。此概要文件为需要广泛互操作性的通用应用程序建立了通用基线。概要文件定义了每个CRL中可以预期的一组基线信息。此外，配置文件还定义了CRL中常用属性的公共位置以及这些属性的公共表示。
This profile does not define any private Internet CRL extensions or CRL entry extensions.
此配置文件未定义任何专用Internet CRL扩展或CRL条目扩展。
Environments with additional or special purpose requirements may build on this profile or may replace it.
具有附加或特殊用途需求的环境可以基于此配置文件构建，也可以替换此配置文件。
Conforming CAs are not required to issue CRLs if other revocation or certificate status mechanisms are provided. Conforming CAs that issue CRLs MUST issue version 2 CRLs, and CAs MUST include the date by which the next CRL will be issued in the nextUpdate field (see
如果提供了其他撤销或证书状态机制，则符合条件的CA无需颁发CRL。发布CRL的合格CA必须发布版本2 CRL，且CA必须在nextUpdate字段中包含下一个CRL发布的日期（参见
sec. 5.1.2.5), the CRL number extension (see sec. 5.2.3) and the authority key identifier extension (see sec. 5.2.1). Conforming applications are required to process version 1 and 2 CRLs.
秒。CRL编号扩展（见第5.2.3节）和授权密钥标识符扩展（见第5.2.1节）。要求符合要求的应用程序处理版本1和2 CRL。
The X.509 v2 CRL syntax is as follows. For signature calculation, the data that is to be signed is ASN.1 DER encoded. ASN.1 DER encoding is a tag, length, value encoding system for each element.
X.509 v2 CRL语法如下所示。对于签名计算，要签名的数据是ASN.1 DER编码的。ASN.1 DER编码是每个元素的标记、长度、值编码系统。
CertificateList ::= SEQUENCE {
tbsCertList TBSCertList,
signatureAlgorithm AlgorithmIdentifier,
signatureValue BIT STRING }
CertificateList ::= SEQUENCE {
tbsCertList TBSCertList,
signatureAlgorithm AlgorithmIdentifier,
signatureValue BIT STRING }
TBSCertList ::= SEQUENCE {
version Version OPTIONAL,
-- if present, shall be v2
signature AlgorithmIdentifier,
issuer Name,
thisUpdate Time,
nextUpdate Time OPTIONAL,
revokedCertificates SEQUENCE OF SEQUENCE {
userCertificate CertificateSerialNumber,
revocationDate Time,
crlEntryExtensions Extensions OPTIONAL
-- if present, shall be v2
} OPTIONAL,
crlExtensions [0] EXPLICIT Extensions OPTIONAL
-- if present, shall be v2
}
TBSCertList ::= SEQUENCE {
version Version OPTIONAL,
-- if present, shall be v2
signature AlgorithmIdentifier,
issuer Name,
thisUpdate Time,
nextUpdate Time OPTIONAL,
revokedCertificates SEQUENCE OF SEQUENCE {
userCertificate CertificateSerialNumber,
revocationDate Time,
crlEntryExtensions Extensions OPTIONAL
-- if present, shall be v2
} OPTIONAL,
crlExtensions [0] EXPLICIT Extensions OPTIONAL
-- if present, shall be v2
}
-- Version, Time, CertificateSerialNumber, and Extensions
-- are all defined in the ASN.1 in section 4.1
-- Version, Time, CertificateSerialNumber, and Extensions
-- are all defined in the ASN.1 in section 4.1
-- AlgorithmIdentifier is defined in section 4.1.1.2
--第4.1.1.2节定义了算法标识符
The following items describe the use of the X.509 v2 CRL in the Internet PKI.
以下项目描述了X.509 v2 CRL在Internet PKI中的使用。
The CertificateList is a SEQUENCE of three required fields. The fields are described in detail in the following subsections.
CertificateList是由三个必填字段组成的序列。以下小节详细描述了这些字段。
The first field in the sequence is the tbsCertList. This field is itself a sequence containing the name of the issuer, issue date, issue date of the next list, the list of revoked certificates, and optional CRL extensions. Further, each entry on the revoked certificate list is defined by a sequence of user certificate serial number, revocation date, and optional CRL entry extensions.
序列中的第一个字段是tbsCertList。此字段本身是一个序列，包含颁发者的名称、颁发日期、下一个列表的颁发日期、已吊销证书的列表以及可选的CRL扩展名。此外，吊销证书列表上的每个条目由用户证书序列号、吊销日期和可选CRL条目扩展的序列定义。
The signatureAlgorithm field contains the algorithm identifier for the algorithm used by the CA to sign the CertificateList. The field is of type AlgorithmIdentifier, which is defined in section 4.1.1.2. Section 7.2 lists the supported algorithms for this specification. Conforming CAs MUST use the algorithm identifiers presented in section 7.2 when signing with a supported signature algorithm.
signatureAlgorithm字段包含CA用于签署证书列表的算法的算法标识符。该字段为第4.1.1.2节定义的AlgorithmIdentifier类型。第7.2节列出了本规范支持的算法。当使用受支持的签名算法签名时，一致性CA必须使用第7.2节中提供的算法标识符。
This field MUST contain the same algorithm identifier as the signature field in the sequence tbsCertList (see sec. 5.1.2.2).
该字段必须包含与序列tbsCertList中签名字段相同的算法标识符（见第5.1.2.2节）。
The signatureValue field contains a digital signature computed upon the ASN.1 DER encoded tbsCertList. The ASN.1 DER encoded tbsCertList is used as the input to the signature function. This signature value is then ASN.1 encoded as a BIT STRING and included in the CRL's signatureValue field. The details of this process are specified for each of the supported algorithms in section 7.2.
signatureValue字段包含根据ASN.1 DER编码的tbsCertList计算的数字签名。ASN.1 DER编码的tbsCertList用作签名函数的输入。然后将该签名值作为位字符串进行ASN.1编码，并包含在CRL的signatureValue字段中。第7.2节规定了每个受支持算法的详细过程。
The certificate list to be signed, or TBSCertList, is a SEQUENCE of required and optional fields. The required fields identify the CRL issuer, the algorithm used to sign the CRL, the date and time the CRL was issued, and the date and time by which the CA will issue the next CRL.
要签名的证书列表或TBSCertList是一系列必填字段和可选字段。必填字段标识CRL颁发者、用于签署CRL的算法、CRL颁发的日期和时间以及CA将颁发下一个CRL的日期和时间。
Optional fields include lists of revoked certificates and CRL extensions. The revoked certificate list is optional to support the case where a CA has not revoked any unexpired certificates that it has issued. The profile requires conforming CAs to use the CRL extension cRLNumber in all CRLs issued.
可选字段包括已吊销证书和CRL扩展的列表。吊销证书列表是可选的，以支持CA未吊销其颁发的任何未过期证书的情况。配置文件要求合格CA在所有发布的CRL中使用CRL扩展CRL编号。
This optional field describes the version of the encoded CRL. When extensions are used, as required by this profile, this field MUST be present and MUST specify version 2 (the integer value is 1).
此可选字段描述编码CRL的版本。使用扩展时，根据此配置文件的要求，此字段必须存在，并且必须指定版本2（整数值为1）。
This field contains the algorithm identifier for the algorithm used to sign the CRL. Section 7.2 lists OIDs for the most popular signature algorithms used in the Internet PKI.
此字段包含用于签署CRL的算法的算法标识符。第7.2节列出了互联网PKI中最流行的签名算法的OID。
This field MUST contain the same algorithm identifier as the signatureAlgorithm field in the sequence CertificateList (see section 5.1.1.2).
该字段必须包含与序列证书列表中的signatureAlgorithm字段相同的算法标识符（见第5.1.1.2节）。
The issuer name identifies the entity who has signed and issued the CRL. The issuer identity is carried in the issuer name field. Alternative name forms may also appear in the issuerAltName extension (see sec. 5.2.2). The issuer name field MUST contain an X.500 distinguished name (DN). The issuer name field is defined as the X.501 type Name, and MUST follow the encoding rules for the issuer name field in the certificate (see sec. 4.1.2.4).
发卡机构名称标识已签署和签发CRL的实体。发卡机构标识包含在发卡机构名称字段中。其他名称形式也可能出现在issuerAltName扩展中（见第5.2.2节）。发卡机构名称字段必须包含X.500可分辨名称（DN）。发卡机构名称字段定义为X.501类型名称，必须遵循证书中发卡机构名称字段的编码规则（见第4.1.2.4节）。
This field indicates the issue date of this CRL. ThisUpdate may be encoded as UTCTime or GeneralizedTime.
此字段表示此CRL的发布日期。此更新可以编码为UTCTime或GeneralizedTime。
CAs conforming to this profile that issue CRLs MUST encode thisUpdate as UTCTime for dates through the year 2049. CAs conforming to this profile that issue CRLs MUST encode thisUpdate as GeneralizedTime for dates in the year 2050 or later.
发布CRL的符合此配置文件的CA必须将此更新编码为截止2049年的UTCTime。发布CRL的符合此配置文件的CA必须将此更新编码为2050年或更高日期的通用时间。
Where encoded as UTCTime, thisUpdate MUST be specified and interpreted as defined in section 4.1.2.5.1. Where encoded as GeneralizedTime, thisUpdate MUST be specified and interpreted as defined in section 4.1.2.5.2.
如果编码为UTCTime，则必须按照第4.1.2.5.1节中的定义指定和解释此更新。如果编码为GeneratedTime，则必须按照第4.1.2.5.2节中的定义指定和解释此更新。
This field indicates the date by which the next CRL will be issued. The next CRL could be issued before the indicated date, but it will not be issued any later than the indicated date. CAs SHOULD issue CRLs with a nextUpdate time equal to or later than all previous CRLs. nextUpdate may be encoded as UTCTime or GeneralizedTime.
此字段表示下一个CRL的发布日期。下一个CRL可以在指定日期之前发布，但不会在指定日期之后发布。CA应发出CRL，其下一个启动日期时间等于或晚于所有以前的CRL。nextUpdate可以编码为UTCTime或GeneralizedTime。
This profile requires inclusion of nextUpdate in all CRLs issued by conforming CAs. Note that the ASN.1 syntax of TBSCertList describes this field as OPTIONAL, which is consistent with the ASN.1 structure defined in [X.509]. The behavior of clients processing CRLs which omit nextUpdate is not specified by this profile.
此配置文件要求在合格CAs发布的所有CRL中包含nextUpdate。请注意，TBSCertList的ASN.1语法将此字段描述为可选字段，这与[X.509]中定义的ASN.1结构一致。此配置文件未指定处理忽略nextUpdate的CRL的客户端的行为。
CAs conforming to this profile that issue CRLs MUST encode nextUpdate as UTCTime for dates through the year 2049. CAs conforming to this profile that issue CRLs MUST encode nextUpdate as GeneralizedTime for dates in the year 2050 or later.
发布CRL的符合此配置文件的CA必须将nextUpdate编码为截止2049年的UTCTime。发布CRL的符合此配置文件的CA必须将nextUpdate编码为2050年或以后日期的通用时间。
Where encoded as UTCTime, nextUpdate MUST be specified and interpreted as defined in section 4.1.2.5.1. Where encoded as GeneralizedTime, nextUpdate MUST be specified and interpreted as defined in section 4.1.2.5.2.
如果编码为UTCTime，则必须按照第4.1.2.5.1节的定义指定和解释nextUpdate。如果编码为GeneralizedTime，则必须按照第4.1.2.5.2节的定义指定和解释nextUpdate。
Revoked certificates are listed. The revoked certificates are named by their serial numbers. Certificates revoked by the CA are uniquely identified by the certificate serial number. The date on which the revocation occurred is specified. The time for revocationDate MUST be expressed as described in section 5.1.2.4. Additional information may be supplied in CRL entry extensions; CRL entry extensions are discussed in section 5.3.
将列出已吊销的证书。被吊销的证书以其序列号命名。CA吊销的证书由证书序列号唯一标识。已指定吊销发生的日期。撤销日期的时间必须如第5.1.2.4节所述。附加信息可在CRL条目扩展中提供；第5.3节讨论了CRL条目扩展。
This field may only appear if the version is 2 (see sec. 5.1.2.1). If present, this field is a SEQUENCE of one or more CRL extensions. CRL extensions are discussed in section 5.2.
此字段仅在版本为2时出现（见第5.1.2.1节）。如果存在，此字段是一个或多个CRL扩展的序列。第5.2节讨论了CRL扩展。
The extensions defined by ANSI X9 and ISO/IEC/ITU for X.509 v2 CRLs [X.509] [X9.55] provide methods for associating additional attributes with CRLs. The X.509 v2 CRL format also allows communities to define private extensions to carry information unique to those communities. Each extension in a CRL may be designated as critical or non-critical. A CRL validation MUST fail if it encounters a critical extension which it does not know how to process. However, an unrecognized non-critical extension may be ignored. The following subsections present those extensions used within Internet CRLs. Communities may elect to include extensions in CRLs which are not defined in this specification. However, caution should be exercised in adopting any critical extensions in CRLs which might be used in a general context.
ANSI X9和ISO/IEC/ITU为X.509 v2 CRL[X.509][X9.55]定义的扩展提供了将附加属性与CRL关联的方法。X.509 v2 CRL格式还允许社区定义专用扩展，以承载这些社区特有的信息。CRL中的每个扩展可指定为关键或非关键。如果遇到不知道如何处理的关键扩展，CRL验证必须失败。但是，可能会忽略无法识别的非关键扩展。以下小节介绍了Internet CRL中使用的扩展。社区可以选择在本规范中未定义的CRL中包含扩展。然而，在CRL中采用任何可能在一般情况下使用的关键扩展时，应谨慎。
Conforming CAs that issue CRLs are required to include the authority key identifier (see sec. 5.2.1) and the CRL number (see sec. 5.2.3) extensions in all CRLs issued.
发布CRL的合格CA需要在所有发布的CRL中包括授权密钥标识符（见第5.2.1节）和CRL编号（见第5.2.3节）扩展。
The authority key identifier extension provides a means of identifying the public key corresponding to the private key used to sign a CRL. The identification can be based on either the key identifier (the subject key identifier in the CRL signer's certificate) or on the issuer name and serial number. This extension is especially useful where an issuer has more than one signing key, either due to multiple concurrent key pairs or due to changeover.
授权密钥标识符扩展提供了识别与用于签署CRL的私钥相对应的公钥的方法。标识可以基于密钥标识符（CRL签名者证书中的主体密钥标识符）或颁发者名称和序列号。当颁发者由于多个并发密钥对或由于转换而具有多个签名密钥时，此扩展尤其有用。
Conforming CAs MUST use the key identifier method, and MUST include this extension in all CRLs issued.
符合条件的CA必须使用密钥标识符方法，并且必须在发布的所有CRL中包含此扩展。
The syntax for this CRL extension is defined in section 4.2.1.1.
第4.2.1.1节定义了此CRL扩展的语法。
The issuer alternative names extension allows additional identities to be associated with the issuer of the CRL. Defined options include an rfc822 name (electronic mail address), a DNS name, an IP address, and a URI. Multiple instances of a name and multiple name forms may be included. Whenever such identities are used, the issuer alternative name extension MUST be used.
发卡机构备选名称扩展允许其他身份与CRL的发卡机构关联。定义的选项包括rfc822名称（电子邮件地址）、DNS名称、IP地址和URI。可以包括一个名称的多个实例和多个名称表单。无论何时使用此类标识，都必须使用发卡机构备选名称扩展名。
The issuerAltName extension SHOULD NOT be marked critical.
ISSUERATNAME扩展不应标记为关键。
The OID and syntax for this CRL extension are defined in section 4.2.1.8.
第4.2.1.8节定义了此CRL扩展的OID和语法。
The CRL number is a non-critical CRL extension which conveys a monotonically increasing sequence number for each CRL issued by a CA. This extension allows users to easily determine when a particular CRL supersedes another CRL. CAs conforming to this profile MUST include this extension in all CRLs.
CRL编号是一个非关键CRL扩展，它为CA发布的每个CRL传递单调递增的序列号。此扩展允许用户轻松确定特定CRL何时取代另一个CRL。符合此配置文件的CA必须在所有CRL中包括此扩展。
id-ce-cRLNumber OBJECT IDENTIFIER ::= { id-ce 20 }
id-ce-cRLNumber OBJECT IDENTIFIER ::= { id-ce 20 }
cRLNumber ::= INTEGER (0..MAX)
cRLNumber ::= INTEGER (0..MAX)
The delta CRL indicator is a critical CRL extension that identifies a delta-CRL. The use of delta-CRLs can significantly improve processing time for applications which store revocation information in a format other than the CRL structure. This allows changes to be added to the local database while ignoring unchanged information that is already in the local database.
增量CRL指示器是识别增量CRL的关键CRL扩展。对于以CRL结构以外的格式存储撤销信息的应用程序，使用增量CRL可以显著缩短处理时间。这允许将更改添加到本地数据库，同时忽略本地数据库中已存在的未更改信息。
When a delta-CRL is issued, the CAs MUST also issue a complete CRL.
当发出增量CRL时，CAs还必须发出完整的CRL。
The value of BaseCRLNumber identifies the CRL number of the base CRL that was used as the starting point in the generation of this delta-CRL. The delta-CRL contains the changes between the base CRL and the current CRL issued along with the delta-CRL. It is the decision of a CA as to whether to provide delta-CRLs. Again, a delta-CRL MUST NOT be issued without a corresponding complete CRL. The value of CRLNumber for both the delta-CRL and the corresponding complete CRL MUST be identical.
BaseCRLNumber的值标识用作生成此增量CRL的起点的基本CRL的CRL编号。增量CRL包含基本CRL和随增量CRL一起发布的当前CRL之间的更改。CA决定是否提供增量CRL。同样，如果没有相应的完整CRL，则不得发布增量CRL。增量CRL和相应完整CRL的CRLNumber值必须相同。
A CRL user constructing a locally held CRL from delta-CRLs MUST consider the constructed CRL incomplete and unusable if the CRLNumber of the received delta-CRL is more than one greater than the CRLnumber of the delta-CRL last processed.
从Delta CRLS构造本地保持CRL的CRL用户必须考虑所构建的CRL不完整和不可用，如果接收到的delta CRL的CRLT大于大于最后处理的Delta CRL的CRLT数。
id-ce-deltaCRLIndicator OBJECT IDENTIFIER ::= { id-ce 27 }
id-ce-deltaCRLIndicator OBJECT IDENTIFIER ::= { id-ce 27 }
deltaCRLIndicator ::= BaseCRLNumber
deltaCRLIndicator ::= BaseCRLNumber
BaseCRLNumber ::= CRLNumber
BaseCRLNumber ::= CRLNumber
The issuing distribution point is a critical CRL extension that identifies the CRL distribution point for a particular CRL, and it indicates whether the CRL covers revocation for end entity certificates only, CA certificates only, or a limitied set of reason codes. Although the extension is critical, conforming implementations are not required to support this extension.
发布分发点是一个关键的CRL扩展，用于标识特定CRL的CRL分发点，并指示CRL是否仅涵盖终端实体证书、CA证书或有限的原因码集的吊销。尽管扩展非常关键，但不需要一致性实现来支持此扩展。
The CRL is signed using the CA's private key. CRL Distribution Points do not have their own key pairs. If the CRL is stored in the X.500 Directory, it is stored in the Directory entry corresponding to the CRL distribution point, which may be different than the Directory entry of the CA.
CRL使用CA的私钥进行签名。CRL分发点没有自己的密钥对。如果CRL存储在X.500目录中，则它存储在对应于CRL分发点的目录条目中，该目录条目可能不同于CA的目录条目。
The reason codes associated with a distribution point shall be specified in onlySomeReasons. If onlySomeReasons does not appear, the distribution point shall contain revocations for all reason codes. CAs may use CRL distribution points to partition the CRL on the basis of compromise and routine revocation. In this case, the revocations with reason code keyCompromise (1) and cACompromise (2) appear in one distribution point, and the revocations with other reason codes appear in another distribution point.
与配送点相关的原因代码应仅在客户手册中规定。如果没有出现onlySomeReasons，则分发点应包含所有原因代码的撤销。CA可以使用CRL分发点根据折衷和例行撤销对CRL进行分区。在这种情况下，带有原因码KeyConvention（1）和cACompromise（2）的撤销出现在一个分发点，带有其他原因码的撤销出现在另一个分发点。
Where the issuingDistributionPoint extension contains a URL, the following semantics MUST be assumed: the object is a pointer to the most current CRL issued by this CA. The URI schemes ftp, http, mailto [RFC1738] and ldap [RFC1778] are defined for this purpose. The URI MUST be an absolute, not relative, pathname and MUST specify the host.
如果issuingDistributionPoint扩展包含URL，则必须假设以下语义：对象是指向此CA发布的最新CRL的指针。为此，定义了URI方案ftp、http、mailto[RFC1738]和ldap[RFC1778]。URI必须是绝对路径名，而不是相对路径名，并且必须指定主机。
id-ce-issuingDistributionPoint OBJECT IDENTIFIER ::= { id-ce 28 }
id-ce-issuingDistributionPoint OBJECT IDENTIFIER ::= { id-ce 28 }
issuingDistributionPoint ::= SEQUENCE {
distributionPoint [0] DistributionPointName OPTIONAL,
onlyContainsUserCerts [1] BOOLEAN DEFAULT FALSE,
onlyContainsCACerts [2] BOOLEAN DEFAULT FALSE,
onlySomeReasons [3] ReasonFlags OPTIONAL,
indirectCRL [4] BOOLEAN DEFAULT FALSE }
issuingDistributionPoint ::= SEQUENCE {
distributionPoint [0] DistributionPointName OPTIONAL,
onlyContainsUserCerts [1] BOOLEAN DEFAULT FALSE,
onlyContainsCACerts [2] BOOLEAN DEFAULT FALSE,
onlySomeReasons [3] ReasonFlags OPTIONAL,
indirectCRL [4] BOOLEAN DEFAULT FALSE }
The CRL entry extensions already defined by ANSI X9 and ISO/IEC/ITU for X.509 v2 CRLs provide methods for associating additional attributes with CRL entries [X.509] [X9.55]. The X.509 v2 CRL format also allows communities to define private CRL entry extensions to carry information unique to those communities. Each extension in a CRL entry may be designated as critical or non-critical. A CRL validation MUST fail if it encounters a critical CRL entry extension which it does not know how to process. However, an unrecognized non-critical CRL entry extension may be ignored. The following subsections present recommended extensions used within Internet CRL entries and standard locations for information. Communities may elect to use additional CRL entry extensions; however, caution should be exercised in adopting any critical extensions in CRL entries which might be used in a general context.
ANSI X9和ISO/IEC/ITU为X.509 v2 CRL定义的CRL条目扩展提供了将附加属性与CRL条目[X.509][X9.55]关联的方法。X.509 v2 CRL格式还允许社区定义专用CRL条目扩展，以承载这些社区特有的信息。CRL条目中的每个扩展可指定为关键或非关键。如果遇到不知道如何处理的关键CRL条目扩展，CRL验证必须失败。但是，可能会忽略无法识别的非关键CRL条目扩展。以下小节介绍了Internet CRL条目和标准位置中使用的推荐扩展，以供参考。社区可以选择使用额外的CRL进入扩展；但是，在CRL条目中采用任何可能在一般上下文中使用的关键扩展时，应谨慎。
All CRL entry extensions used in this specification are non-critical. Support for these extensions is optional for conforming CAs and applications. However, CAs that issue CRLs SHOULD include reason codes (see sec. 5.3.1) and invalidity dates (see sec. 5.3.3) whenever this information is available.
本规范中使用的所有CRL条目扩展都是非关键的。对于符合条件的CA和应用程序，对这些扩展的支持是可选的。但是，发布CRL的CA应包括原因代码（见第5.3.1节）和失效日期（见第5.3.3节），只要该信息可用。
The reasonCode is a non-critical CRL entry extension that identifies the reason for the certificate revocation. CAs are strongly encouraged to include meaningful reason codes in CRL entries; however, the reason code CRL entry extension SHOULD be absent instead of using the unspecified (0) reasonCode value.
reasonCode是识别证书吊销原因的非关键CRL条目扩展。强烈鼓励CA在CRL条目中包含有意义的原因代码；但是，应不存在原因代码CRL条目扩展名，而不是使用未指定的（0）原因代码值。
id-ce-cRLReason OBJECT IDENTIFIER ::= { id-ce 21 }
id-ce-cRLReason OBJECT IDENTIFIER ::= { id-ce 21 }
-- reasonCode ::= { CRLReason }
-- reasonCode ::= { CRLReason }
CRLReason ::= ENUMERATED {
unspecified (0),
keyCompromise (1),
cACompromise (2),
affiliationChanged (3),
superseded (4),
cessationOfOperation (5),
certificateHold (6),
removeFromCRL (8) }
CRLReason ::= ENUMERATED {
unspecified (0),
keyCompromise (1),
cACompromise (2),
affiliationChanged (3),
superseded (4),
cessationOfOperation (5),
certificateHold (6),
removeFromCRL (8) }
The hold instruction code is a non-critical CRL entry extension that provides a registered instruction identifier which indicates the action to be taken after encountering a certificate that has been placed on hold.
保持指令代码是一个非关键CRL条目扩展，它提供了一个注册指令标识符，该标识符指示遇到已被保持的证书后要采取的操作。
id-ce-holdInstructionCode OBJECT IDENTIFIER ::= { id-ce 23 }
id-ce-holdInstructionCode OBJECT IDENTIFIER ::= { id-ce 23 }
holdInstructionCode ::= OBJECT IDENTIFIER
holdInstructionCode ::= OBJECT IDENTIFIER
The following instruction codes have been defined. Conforming applications that process this extension MUST recognize the following instruction codes.
已定义以下指令代码。处理此扩展的一致性应用程序必须识别以下指令代码。
holdInstruction OBJECT IDENTIFIER ::=
{ iso(1) member-body(2) us(840) x9-57(10040) 2 }
holdInstruction OBJECT IDENTIFIER ::=
{ iso(1) member-body(2) us(840) x9-57(10040) 2 }
id-holdinstruction-none OBJECT IDENTIFIER ::= {holdInstruction 1}
id-holdinstruction-callissuer
OBJECT IDENTIFIER ::= {holdInstruction 2}
id-holdinstruction-reject OBJECT IDENTIFIER ::= {holdInstruction 3}
id-holdinstruction-none OBJECT IDENTIFIER ::= {holdInstruction 1}
id-holdinstruction-callissuer
OBJECT IDENTIFIER ::= {holdInstruction 2}
id-holdinstruction-reject OBJECT IDENTIFIER ::= {holdInstruction 3}
Conforming applications which encounter an id-holdinstruction-callissuer MUST call the certificate issuer or reject the certificate. Conforming applications which encounter an id-
遇到id持有者的一致性应用程序必须呼叫证书颁发者或拒绝证书。遇到id的一致性应用程序-
holdinstruction-reject MUST reject the certificate. The hold instruction id-holdinstruction-none is semantically equivalent to the absence of a holdInstructionCode, and its use is strongly deprecated for the Internet PKI.
holdinstruction reject必须拒绝证书。hold指令id holdinstruction none在语义上等同于没有holdInstructionCode，因此强烈反对将其用于Internet PKI。
The invalidity date is a non-critical CRL entry extension that provides the date on which it is known or suspected that the private key was compromised or that the certificate otherwise became invalid. This date may be earlier than the revocation date in the CRL entry, which is the date at which the CA processed the revocation. When a revocation is first posted by a CA in a CRL, the invalidity date may precede the date of issue of earlier CRLs, but the revocation date SHOULD NOT precede the date of issue of earlier CRLs. Whenever this information is available, CAs are strongly encouraged to share it with CRL users.
无效日期是一个非关键CRL条目扩展，提供已知或怀疑私钥被泄露或证书以其他方式变得无效的日期。此日期可能早于CRL条目中的撤销日期，即CA处理撤销的日期。当CA首次在CRL中发布撤销时，无效日期可以早于早期CRL的发布日期，但撤销日期不应早于早期CRL的发布日期。只要此信息可用，强烈鼓励CA与CRL用户共享。
The GeneralizedTime values included in this field MUST be expressed in Greenwich Mean Time (Zulu), and MUST be specified and interpreted as defined in section 4.1.2.5.2.
此字段中包含的广义时间值必须以格林威治平均时间（Zulu）表示，并且必须按照第4.1.2.5.2节的规定进行指定和解释。
id-ce-invalidityDate OBJECT IDENTIFIER ::= { id-ce 24 }
id-ce-invalidityDate OBJECT IDENTIFIER ::= { id-ce 24 }
invalidityDate ::= GeneralizedTime
invalidityDate ::= GeneralizedTime
This CRL entry extension identifies the certificate issuer associated with an entry in an indirect CRL, i.e. a CRL that has the indirectCRL indicator set in its issuing distribution point extension. If this extension is not present on the first entry in an indirect CRL, the certificate issuer defaults to the CRL issuer. On subsequent entries in an indirect CRL, if this extension is not present, the certificate issuer for the entry is the same as that for the preceding entry. This field is defined as follows:
此CRL条目扩展标识与间接CRL中的条目关联的证书颁发者，即在其颁发分发点扩展中设置了间接CRL指示符的CRL。如果间接CRL中的第一个条目上不存在此扩展名，则证书颁发者默认为CRL颁发者。对于间接CRL中的后续条目，如果不存在此扩展名，则该条目的证书颁发者与前一条目的证书颁发者相同。该字段定义如下：
id-ce-certificateIssuer OBJECT IDENTIFIER ::= { id-ce 29 }
id-ce-certificateIssuer OBJECT IDENTIFIER ::= { id-ce 29 }
certificateIssuer ::= GeneralNames
certificateIssuer ::= GeneralNames
If used by conforming CAs that issue CRLs, this extension is always critical. If an implementation ignored this extension it could not correctly attribute CRL entries to certificates. This specification RECOMMENDS that implementations recognize this extension.
如果由发布CRL的合格CA使用，此扩展总是至关重要的。如果实现忽略了此扩展，则无法将CRL条目正确地属性化为证书。本规范建议实现识别此扩展。
6 Certification Path Validation
6认证路径验证
Certification path validation procedures for the Internet PKI are based on section 12.4.3 of [X.509]. Certification path processing verifies the binding between the subject distinguished name and/or subject alternative name and subject public key. The binding is limited by constraints which are specified in the certificates which comprise the path. The basic constraints and policy constraints extensions allow the certification path processing logic to automate the decision making process.
互联网PKI的认证路径验证程序基于[X.509]第12.4.3节。认证路径处理验证使用者可分辨名称和/或使用者备选名称与使用者公钥之间的绑定。绑定受到在构成路径的证书中指定的约束的限制。基本约束和策略约束扩展允许认证路径处理逻辑自动化决策过程。
This section describes an algorithm for validating certification paths. Conforming implementations of this specification are not required to implement this algorithm, but MUST be functionally equivalent to the external behavior resulting from this procedure. Any algorithm may be used by a particular implementation so long as it derives the correct result.
本节介绍验证证书路径的算法。实现该算法不需要符合本规范的实现，但必须在功能上等同于该程序产生的外部行为。任何算法都可以由特定的实现使用，只要它得到正确的结果。
In section 6.1, the text describes basic path validation. This text assumes that all valid paths begin with certificates issued by a single "most-trusted CA". The algorithm requires the public key of the CA, the CA's name, the validity period of the public key, and any constraints upon the set of paths which may be validated using this key.
在第6.1节中，本文描述了基本路径验证。本文假定所有有效路径都以单个“最受信任的CA”颁发的证书开头。该算法需要CA的公钥、CA的名称、公钥的有效期以及对可使用该密钥验证的路径集的任何约束。
The "most-trusted CA" is a matter of policy: it could be a root CA in a hierarchical PKI; the CA that issued the verifier's own certificate(s); or any other CA in a network PKI. The path validation procedure is the same regardless of the choice of "most-trusted CA."
“最受信任的CA”是一个策略问题：它可以是分层PKI中的根CA；颁发验证者自己证书的CA；或网络PKI中的任何其他CA。无论选择“最受信任的CA”，路径验证过程都是相同的
section 6.2 describes extensions to the basic path validation algorithm. Two specific cases are discussed: the case where paths may begin with one of several trusted CAs; and where compatibility with the PEM architecture is required.
第6.2节描述了对基本路径验证算法的扩展。讨论了两种具体情况：路径可以从多个可信CA中的一个开始的情况；以及需要与PEM体系结构兼容的地方。
The text assumes that the trusted public key (and related information) is contained in a "self-signed" certificate. This simplifies the description of the path processing procedure. Note that the signature on the self-signed certificate does not provide any security services. The trusted public key (and related information) may be obtained in other formats; the information is trusted because of other procedures used to obtain and protect it.
文本假定受信任的公钥（和相关信息）包含在“自签名”证书中。这简化了路径处理过程的描述。请注意，自签名证书上的签名不提供任何安全服务。可信公钥（和相关信息）可以以其他格式获得；由于用于获取和保护该信息的其他过程，因此该信息是可信的。
The goal of path validation is to verify the binding between a subject distinguished name or subject alternative name and subject public key, as represented in the "end entity" certificate, based on the public key of the "most-trusted CA". This requires obtaining a sequence of certificates that support that binding. The procedures performed to obtain this sequence is outside the scope of this section.
路径验证的目标是基于“最受信任CA”的公钥，验证使用者可分辨名称或使用者备选名称与使用者公钥之间的绑定，如“最终实体”证书中所示。这需要获取支持该绑定的证书序列。为获得该序列而执行的程序不在本节的范围内。
The following text also assumes that certificates do not use subject or unique identifier fields or private critical extensions, as recommended within this profile. However, if these components appear in certificates, they MUST be processed. Finally, policy qualifiers are also neglected for the sake of clarity.
以下文本还假设证书不使用主题或唯一标识符字段或私有关键扩展，如本配置文件中所建议的。但是，如果这些组件出现在证书中，则必须对其进行处理。最后，为了清晰起见，政策限定词也被忽略了。
A certification path is a sequence of n certificates where:
证书路径是n个证书的序列，其中：
* for all x in {1,(n-1)}, the subject of certificate x is the issuer of certificate x+1. * certificate x=1 is the the self-signed certificate, and * certificate x=n is the end entity certificate.
* 对于{1，（n-1）}中的所有x，证书x的主体是证书x+1的颁发者。*证书x=1是自签名证书，而*证书x=n是最终实体证书。
This section assumes the following inputs are provided to the path processing logic:
本节假设为路径处理逻辑提供以下输入：
(a) a certification path of length n;
(a) 长度为n的认证路径；
(b) a set of initial policy identifiers (each comprising a sequence of policy element identifiers), which identifies one or more certificate policies, any one of which would be acceptable for the purposes of certification path processing, or the special value "any-policy";
(b) 一组初始策略标识符（每个标识符包括一系列策略元素标识符），用于标识一个或多个证书策略，其中任何一个对于证书路径处理来说都是可接受的，或特殊值“any policy”；
(c) the current date/time (if not available internally to the certification path processing module); and
(c) 当前日期/时间（如果认证路径处理模块内部不可用）；和
(d) the time, T, for which the validity of the path should be determined. (This may be the current date/time, or some point in the past.)
(d) 应确定路径有效性的时间T。（这可能是当前日期/时间，也可能是过去的某个时间点。）
From the inputs, the procedure intializes five state variables:
根据输入，程序初始化五个状态变量：
(a) acceptable policy set: A set of certificate policy identifiers comprising the policy or policies recognized by the public key user together with policies deemed equivalent through policy mapping. The initial value of the acceptable policy set is the special value "any-policy".
(a) 可接受策略集：一组证书策略标识符，包括公钥用户识别的一个或多个策略，以及通过策略映射被认为等效的策略。可接受策略集的初始值是特殊值“any policy”。
(b) constrained subtrees: A set of root names defining a set of subtrees within which all subject names in subsequent certificates in the certification path shall fall. The initial value is "unbounded".
(b) 受约束子树：一组根名称，定义一组子树，其中证书路径中后续证书中的所有主题名称都应属于该子树。初始值为“无界”。
(c) excluded subtrees: A set of root names defining a set of subtrees within which no subject name in subsequent certificates in the certification path may fall. The initial value is "empty".
(c) 排除子树：定义一组子树的一组根名称，在该子树中，证书路径中的后续证书中可能没有主题名称。初始值为“空”。
(d) explicit policy: an integer which indicates if an explicit policy identifier is required. The integer indicates the first certificate in the path where this requirement is imposed. Once set, this variable may be decreased, but may not be increased. (That is, if a certificate in the path requires explicit policy identifiers, a later certificate can not remove this requirement.) The initial value is n+1.
(d) 显式策略：一个整数，指示是否需要显式策略标识符。整数表示施加此要求的路径中的第一个证书。一旦设置，该变量可以减少，但不能增加。（即，如果路径中的证书需要显式策略标识符，则以后的证书无法删除此要求。）初始值为n+1。
(e) policy mapping: an integer which indicates if policy mapping is permitted. The integer indicates the last certificate on which policy mapping may be applied. Once set, this variable may be decreased, but may not be increased. (That is, if a certificate in the path specifies policy mapping is not permitted, it can not be overriden by a later certificate.) The initial value is n+1.
(e) 策略映射：一个整数，指示是否允许策略映射。整数表示可以应用策略映射的最后一个证书。一旦设置，该变量可以减少，但不能增加。（也就是说，如果路径中的证书指定不允许策略映射，则它不能被以后的证书覆盖。）初始值为n+1。
The actions performed by the path processing software for each certificate i=1 through n are described below. The self-signed certificate is certificate i=1, the end entity certificate is i=n. The processing is performed sequentially, so that processing certificate i affects the state variables for processing certificate (i+1). Note that actions (h) through (m) are not applied to the end entity certificate (certificate n).
下面描述路径处理软件对每个证书i＝1到n执行的操作。自签名证书是证书i=1，最终实体证书是i=n。按顺序执行处理，以便处理证书i影响处理证书（i+1）的状态变量。请注意，操作（h）到（m）不适用于最终实体证书（证书n）。
The path processing actions to be performed are:
要执行的路径处理操作包括：
(a) Verify the basic certificate information, including:
(a) 验证基本证书信息，包括：
(1) the certificate was signed using the subject public key from certificate i-1 (in the special case i=1, this step may be omitted; if not, use the subject public key from the same certificate),
(1) 证书是使用证书i-1中的主体公钥签署的（在特殊情况下，i=1，此步骤可以省略；如果不是，则使用同一证书中的主体公钥），
(2) the certificate validity period includes time T,
(2) 证书有效期包括时间T，
(3) the certificate had not been revoked at time T and is not currently on hold status that commenced before time T, (this may be determined by obtaining the appropriate CRL or status information, or by out-of-band mechanisms), and
(3) 该证书在时间T未被撤销，且当前未处于时间T之前开始的暂停状态（这可通过获取适当的CRL或状态信息，或通过带外机制确定），以及
(4) the subject and issuer names chain correctly (that is, the issuer of this certificate was the subject of the previous certificate.)
(4) 使用者和颁发者名称链正确（即，此证书的颁发者是上一个证书的使用者。）
(b) Verify that the subject name and subjectAltName extension (critical or noncritical) is consistent with the constrained subtrees state variables.
(b) 验证subject name和subjectAltName扩展（关键或非关键）是否与受约束子树状态变量一致。
(c) Verify that the subject name and subjectAltName extension (critical or noncritical) is consistent with the excluded subtrees state variables.
(c) 验证subject name和subjectAltName扩展（关键或非关键）是否与排除的子树状态变量一致。
(d) Verify that policy information is consistent with the initial policy set:
(d) 验证策略信息是否与初始策略集一致：
(1) if the explicit policy state variable is less than or equal to i, a policy identifier in the certificate shall be in the initial policy set; and
(1) 如果显式策略状态变量小于或等于i，则证书中的策略标识符应位于初始策略集中；和
(2) if the policy mapping variable is less than or equal to i, the policy identifier may not be mapped.
(2) 如果策略映射变量小于或等于i，则可能不会映射策略标识符。
(e) Verify that policy information is consistent with the acceptable policy set:
(e) 验证策略信息是否与可接受的策略集一致：
(1) if the certificate policies extension is marked critical, the intersection of the policies extension and the acceptable policy set shall be non-null;
(1) 如果证书策略扩展标记为关键，则策略扩展与可接受策略集的交集应不为空；
(2) the acceptable policy set is assigned the resulting intersection as its new value.
(2) 可接受的策略集被指定结果交叉点作为其新值。
(g) Verify that the intersection of the acceptable policy set and the initial policy set is non-null.
(g) 验证可接受策略集与初始策略集的交集是否为非空。
(h) Recognize and process any other critical extension present in the certificate.
(h) 识别并处理证书中存在的任何其他关键扩展。
(i) Verify that the certificate is a CA certificate (as specified in a basicConstraints extension or as verified out-of-band).
(i) 验证该证书是否为CA证书（如basicConstraints扩展中指定的或已在带外验证的）。
(j) If permittedSubtrees is present in the certificate, set the constrained subtrees state variable to the intersection of its previous value and the value indicated in the extension field.
(j) 如果证书中存在permittedSubtrees，请将约束子树状态变量设置为其先前值与扩展字段中指示的值的交点。
(k) If excludedSubtrees is present in the certificate, set the excluded subtrees state variable to the union of its previous value and the value indicated in the extension field.
(k) 如果证书中存在excludedSubtrees，请将excluded subtrees状态变量设置为其上一个值与扩展字段中指示的值的并集。
(l) If a policy constraints extension is included in the certificate, modify the explicit policy and policy mapping state variables as follows:
(l) 如果证书中包含策略约束扩展，请修改显式策略和策略映射状态变量，如下所示：
(1) If requireExplicitPolicy is present and has value r, the explicit policy state variable is set to the minimum of its current value and the sum of r and i (the current certificate in the sequence).
(1) 如果存在requireExplicitPolicy且其值为r，则显式策略状态变量将设置为其当前值与r和i（序列中的当前证书）之和的最小值。
(2) If inhibitPolicyMapping is present and has value q, the policy mapping state variable is set to the minimum of its current value and the sum of q and i (the current certificate in the sequence).
(2) 如果存在策略映射并具有值q，则策略映射状态变量将设置为其当前值与q和i（序列中的当前证书）之和的最小值。
(m) If a key usage extension is marked critical, ensure the keyCertSign bit is set.
(m) 如果密钥使用扩展被标记为关键，请确保设置了keyCertSign位。
If any one of the above checks fail, the procedure terminates, returning a failure indication and an appropriate reason. If none of the above checks fail on the end-entity certificate, the procedure terminates, returning a success indication together with the set of all policy qualifier values encountered in the set of certificates.
如果上述任何一项检查失败，程序将终止，并返回失败指示和适当原因。如果上述检查均未在结束实体证书上失败，则过程将终止，并返回一个成功指示以及证书集中遇到的所有策略限定符值集。
The path validation algorithm presented in 6.1 is based on several simplifying assumptions (e.g., a single trusted CA that starts all valid paths). This algorithm may be extended for cases where the assumptions do not hold.
6.1中介绍的路径验证算法基于几个简化假设（例如，启动所有有效路径的单个可信CA）。该算法可以扩展到假设不成立的情况。
This procedure may be extended for multiple trusted CAs by providing a set of self-signed certificates to the validation module. In this case, a valid path could begin with any one of the self-signed certificates. Limitations in the trust paths for any particular key may be incorporated into the self-signed certificate's extensions. In this way, the self-signed certificates permit the path validation module to automatically incorporate local security policy and requirements.
通过向验证模块提供一组自签名证书，可以将此过程扩展到多个受信任CA。在这种情况下，有效路径可以从任何一个自签名证书开始。任何特定密钥的信任路径中的限制可以合并到自签名证书的扩展中。通过这种方式，自签名证书允许路径验证模块自动合并本地安全策略和要求。
It is also possible to specify an extended version of the above certification path processing procedure which results in default behavior identical to the rules of PEM [RFC 1422]. In this extended version, additional inputs to the procedure are a list of one or more Policy Certification Authorities (PCAs) names and an indicator of the position in the certification path where the PCA is expected. At the nominated PCA position, the CA name is compared against this list. If a recognized PCA name is found, then a constraint of SubordinateToCA is implicitly assumed for the remainder of the
还可以指定上述认证路径处理过程的扩展版本，该过程产生与PEM[RFC 1422]规则相同的默认行为。在此扩展版本中，程序的其他输入包括一个或多个政策认证机构（PCA）名称的列表和认证路径中预期PCA位置的指示器。在指定的PCA位置，将CA名称与此列表进行比较。如果找到一个可识别的PCA名称，则会隐式地为剩余的
certification path and processing continues. If no valid PCA name is found, and if the certification path cannot be validated on the basis of identified policies, then the certification path is considered invalid.
继续验证路径和处理。如果找不到有效的PCA名称，并且如果无法根据已识别的策略验证认证路径，则认为认证路径无效。
7 Algorithm Support
7算法支持
This section describes cryptographic algorithms which may be used with this profile. The section describes one-way hash functions and digital signature algorithms which may be used to sign certificates and CRLs, and identifies OIDs for public keys contained in a certificate.
本节介绍可与此配置文件一起使用的加密算法。本节描述了单向散列函数和数字签名算法，可用于对证书和CRL进行签名，并标识证书中包含的公钥的OID。
Conforming CAs and applications are not required to support the algorithms or algorithm identifiers described in this section. However, conforming CAs and applications that use the algorithms identified here MUST support them as specified.
一致性CA和应用程序不需要支持本节中描述的算法或算法标识符。但是，使用此处确定的算法的一致性CA和应用程序必须按照规定支持它们。
This section identifies one-way hash functions for use in the Internet PKI. One-way hash functions are also called message digest algorithms. SHA-1 is the preferred one-way hash function for the Internet PKI. However, PEM uses MD2 for certificates [RFC 1422] [RFC 1423] and MD5 is used in other legacy applications. For this reason, MD2 and MD5 are included in this profile.
本节确定了在Internet PKI中使用的单向散列函数。单向散列函数也称为消息摘要算法。SHA-1是Internet PKI首选的单向散列函数。但是，PEM将MD2用于证书[RFC 1422][RFC 1423]，而MD5用于其他遗留应用程序。因此，此概要文件中包括MD2和MD5。
MD2 was developed by Ron Rivest for RSA Data Security. RSA Data Security has not placed the MD2 algorithm in the public domain. Rather, RSA Data Security has granted license to use MD2 for non-commercial Internet Privacy-Enhanced Mail. For this reason, MD2 may continue to be used with PEM certificates, but SHA-1 is preferred. MD2 produces a 128-bit "hash" of the input. MD2 is fully described in RFC 1319 [RFC 1319].
MD2是由Ron Rivest为RSA数据安全而开发的。RSA Data Security尚未将MD2算法置于公共域中。相反，RSA Data Security已授予将MD2用于非商业互联网隐私增强邮件的许可。因此，MD2可以继续与PEM证书一起使用，但首选SHA-1。MD2生成输入的128位“哈希”。MD2在RFC 1319[RFC 1319]中有完整描述。
At the Selected Areas in Cryptography '95 conference in May 1995, Rogier and Chauvaud presented an attack on MD2 that can nearly find collisions [RC95]. Collisions occur when one can find two different messages that generate the same message digest. A checksum operation in MD2 is the only remaining obstacle to the success of the attack. For this reason, the use of MD2 for new applications is discouraged. It is still reasonable to use MD2 to verify existing signatures, as the ability to find collisions in MD2 does not enable an attacker to find new messages having a previously computed hash value.
在1995年5月的95年密码学会议上，Rogier和Chauvaud提出了一种对MD2的攻击，这种攻击几乎可以找到碰撞[RC95]。当可以找到生成相同消息摘要的两条不同消息时，就会发生冲突。MD2中的校验和操作是攻击成功的唯一障碍。因此，不鼓励在新应用程序中使用MD2。使用MD2来验证现有签名仍然是合理的，因为在MD2中查找冲突的能力无法使攻击者找到具有先前计算的哈希值的新消息。
MD5 was developed by Ron Rivest for RSA Data Security. RSA Data Security has placed the MD5 algorithm in the public domain. MD5 produces a 128-bit "hash" of the input. MD5 is fully described in RFC 1321 [RFC 1321].
MD5是由Ron Rivest为RSA数据安全而开发的。RSA Data Security将MD5算法置于公共领域。MD5生成输入的128位“哈希”。RFC 1321[RFC 1321]中对MD5进行了全面描述。
Den Boer and Bosselaers [DB94] have found pseudo-collisions for MD5, but there are no other known cryptanalytic results. The use of MD5 for new applications is discouraged. It is still reasonable to use MD5 to verify existing signatures.
Den Boer和Bosselaers[DB94]发现了MD5的伪碰撞，但没有其他已知的密码分析结果。不鼓励在新应用程序中使用MD5。使用MD5来验证现有签名仍然是合理的。
SHA-1 was developed by the U.S. Government. SHA-1 produces a 160-bit "hash" of the input. SHA-1 is fully described in FIPS 180-1 [FIPS 180-1].
SHA-1由美国政府开发。SHA-1生成输入的160位“散列”。SHA-1在FIPS 180-1[FIPS 180-1]中有完整描述。
SHA-1 is the one-way hash function of choice for use with both the RSA and DSA signature algorithms (see sec. 7.2).
SHA-1是选择用于RSA和DSA签名算法的单向散列函数（参见第7.2节）。
Certificates and CRLs described by this standard may be signed with any public key signature algorithm. The certificate or CRL indicates the algorithm through an algorithm identifier which appears in the signatureAlgorithm field in a Certificate or CertificateList. This algorithm identifier is an OID and has optionally associated parameters. This section identifies algorithm identifiers and parameters that shall be used in the signatureAlgorithm field in a Certificate or CertificateList.
本标准描述的证书和CRL可以使用任何公钥签名算法进行签名。证书或CRL通过出现在证书或证书列表的signatureAlgorithm字段中的算法标识符指示算法。此算法标识符是一个OID，并具有可选的关联参数。本节确定了应在证书或证书列表的signatureAlgorithm字段中使用的算法标识符和参数。
RSA and DSA are the most popular signature algorithms used in the Internet. Signature algorithms are always used in conjunction with a one-way hash function identified in section 7.1.
RSA和DSA是互联网上最流行的签名算法。签名算法始终与第7.1节中确定的单向散列函数结合使用。
The signature algorithm and one-way hash function used to sign a certificate or CRL is indicated by use of an algorithm identifier. An algorithm identifier is an OID, and may include associated parameters. This section identifies OIDS for RSA and DSA. The contents of the parameters component for each algorithm vary; details are provided for each algorithm.
用于对证书或CRL进行签名的签名算法和单向哈希函数通过使用算法标识符来表示。算法标识符是OID，并且可以包括相关联的参数。本节介绍RSA和DSA的OID。每个算法的参数组件的内容各不相同；每个算法都提供了详细信息。
The data to be signed (e.g., the one-way hash function output value) is formatted for the signature algorithm to be used. Then, a private key operation (e.g., RSA encryption) is performed to generate the
将要签名的数据（例如，单向散列函数输出值）格式化为要使用的签名算法。然后，执行私钥操作（例如，RSA加密）以生成密钥
signature value. This signature value is then ASN.1 encoded as a BIT STRING and included in the Certificate or CertificateList in the signature field.
签名值。然后，该签名值被ASN.1编码为位字符串，并包含在签名字段的证书或证书列表中。
A patent statement regarding the RSA algorithm can be found at the end of this profile.
有关RSA算法的专利声明可在本概要文件末尾找到。
The RSA algorithm is named for its inventors: Rivest, Shamir, and Adleman. This profile includes three signature algorithms based on the RSA asymmetric encryption algorithm. The signature algorithms combine RSA with either the MD2, MD5, or the SHA-1 one-way hash functions.
RSA算法以其发明者命名：Rivest、Shamir和Adleman。此配置文件包括三种基于RSA非对称加密算法的签名算法。签名算法将RSA与MD2、MD5或SHA-1单向散列函数相结合。
The signature algorithm with MD2 and the RSA encryption algorithm is defined in PKCS #1 [RFC 2313]. As defined in RFC 2313, the ASN.1 OID used to identify this signature algorithm is:
带有MD2和RSA加密算法的签名算法在PKCS#1[RFC 2313]中定义。如RFC 2313中所定义，用于识别此签名算法的ASN.1 OID为：
md2WithRSAEncryption OBJECT IDENTIFIER ::= {
iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
pkcs-1(1) 2 }
md2WithRSAEncryption OBJECT IDENTIFIER ::= {
iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
pkcs-1(1) 2 }
The signature algorithm with MD5 and the RSA encryption algorithm is defined in PKCS #1 [RFC 2313]. As defined in RFC 2313, the ASN.1 OID used to identify this signature algorithm is:
带有MD5和RSA加密算法的签名算法在PKCS#1[RFC 2313]中定义。如RFC 2313中所定义，用于识别此签名算法的ASN.1 OID为：
md5WithRSAEncryption OBJECT IDENTIFIER ::= {
iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
pkcs-1(1) 4 }
md5WithRSAEncryption OBJECT IDENTIFIER ::= {
iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
pkcs-1(1) 4 }
The signature algorithm with SHA-1 and the RSA encryption algorithm is implemented using the padding and encoding conventions described in PKCS #1 [RFC 2313]. The message digest is computed using the SHA-1 hash algorithm. The ASN.1 object identifier used to identify this signature algorithm is:
SHA-1签名算法和RSA加密算法使用PKCS#1[RFC 2313]中描述的填充和编码约定实现。使用SHA-1哈希算法计算消息摘要。用于标识此签名算法的ASN.1对象标识符为：
sha-1WithRSAEncryption OBJECT IDENTIFIER ::= {
iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
pkcs-1(1) 5 }
sha-1WithRSAEncryption OBJECT IDENTIFIER ::= {
iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
pkcs-1(1) 5 }
When any of these three OIDs appears within the ASN.1 type AlgorithmIdentifier, the parameters component of that type shall be the ASN.1 type NULL.
当这三个OID中的任何一个出现在ASN.1类型算法标识符中时，该类型的参数组件应为ASN.1类型NULL。
The RSA signature generation process and the encoding of the result is described in detail in RFC 2313.
RFC 2313详细描述了RSA签名生成过程和结果编码。
A patent statement regarding the DSA can be found at the end of this profile.
有关DSA的专利声明可在本简介末尾找到。
The Digital Signature Algorithm (DSA) is also called the Digital Signature Standard (DSS). DSA was developed by the U.S. Government, and DSA is used in conjunction with the the SHA-1 one-way hash function. DSA is fully described in FIPS 186 [FIPS 186]. The ASN.1 OIDs used to identify this signature algorithm are:
数字签名算法（DSA）也称为数字签名标准（DSS）。DSA是由美国政府开发的，DSA和SHA-1单向散列函数一起使用。DSA在FIPS 186[FIPS 186]中有详细描述。用于识别此签名算法的ASN.1 OID包括：
id-dsa-with-sha1 ID ::= {
iso(1) member-body(2) us(840) x9-57 (10040)
x9cm(4) 3 }
id-dsa-with-sha1 ID ::= {
iso(1) member-body(2) us(840) x9-57 (10040)
x9cm(4) 3 }
Where the id-dsa-with-sha1 algorithm identifier appears as the algorithm field in an AlgorithmIdentifier, the encoding shall omit the parameters field. That is, the AlgorithmIdentifier shall be a SEQUENCE of one component - the OBJECT IDENTIFIER id-dsa-with-sha1.
如果id-dsa-with-sha1算法标识符显示为算法标识符中的算法字段，则编码应省略参数字段。也就是说，算法标识符应为一个组件的序列-对象标识符id-dsa-with-sha1。
The DSA parameters in the subjectPublicKeyInfo field of the certificate of the issuer shall apply to the verification of the signature.
签发人证书的subjectPublicKeyInfo字段中的DSA参数应适用于签名验证。
When signing, the DSA algorithm generates two values. These values are commonly referred to as r and s. To easily transfer these two values as one signature, they shall be ASN.1 encoded using the following ASN.1 structure:
签名时，DSA算法生成两个值。这些值通常称为r和s。为了方便地将这两个值作为一个签名传输，应使用以下ASN.1结构对其进行ASN.1编码：
Dss-Sig-Value ::= SEQUENCE {
r INTEGER,
s INTEGER }
Dss-Sig-Value ::= SEQUENCE {
r INTEGER,
s INTEGER }
Certificates described by this profile may convey a public key for any public key algorithm. The certificate indicates the algorithm through an algorithm identifier. This algorithm identifier is an OID and optionally associated parameters.
此概要文件描述的证书可以传递任何公钥算法的公钥。证书通过算法标识符指示算法。此算法标识符是OID和可选关联参数。
This section identifies preferred OIDs and parameters for the RSA, DSA, and Diffie-Hellman algorithms. Conforming CAs shall use the identified OIDs when issuing certificates containing public keys for these algorithms. Conforming applications supporting any of these algorithms shall, at a minimum, recognize the OID identified in this section.
本节确定了RSA、DSA和Diffie-Hellman算法的首选OID和参数。合格CA在颁发包含这些算法公钥的证书时，应使用识别的OID。支持这些算法的一致性应用程序应至少识别本节中确定的OID。
The OID rsaEncryption identifies RSA public keys.
RSA加密识别RSA公钥。
pkcs-1 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840)
rsadsi(113549) pkcs(1) 1 }
pkcs-1 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840)
rsadsi(113549) pkcs(1) 1 }
rsaEncryption OBJECT IDENTIFIER ::= { pkcs-1 1}
rsaEncryption OBJECT IDENTIFIER ::= { pkcs-1 1}
The rsaEncryption OID is intended to be used in the algorithm field of a value of type AlgorithmIdentifier. The parameters field shall have ASN.1 type NULL for this algorithm identifier.
RSAOID加密用于AlgorithmIdentifier类型值的算法字段。对于该算法标识符，参数字段的ASN.1类型应为NULL。
The RSA public key shall be encoded using the ASN.1 type RSAPublicKey:
RSA公钥应使用ASN.1类型的RSAPublicKey进行编码：
RSAPublicKey ::= SEQUENCE {
modulus INTEGER, -- n
publicExponent INTEGER -- e -- }
RSAPublicKey ::= SEQUENCE {
modulus INTEGER, -- n
publicExponent INTEGER -- e -- }
where modulus is the modulus n, and publicExponent is the public exponent e. The DER encoded RSAPublicKey is the value of the BIT STRING subjectPublicKey.
式中，模数为模数n，公共指数为公共指数e。DER编码的RSAPPublicKey是位字符串subjectPublicKey的值。
This OID is used in public key certificates for both RSA signature keys and RSA encryption keys. The intended application for the key may be indicated in the key usage field (see sec. 4.2.1.3). The use of a single key for both signature and encryption purposes is not recommended, but is not forbidden.
此OID用于RSA签名密钥和RSA加密密钥的公钥证书。钥匙的预期用途可在钥匙使用字段中指明（见第4.2.1.3节）。不建议将单个密钥用于签名和加密目的，但也不禁止。
If the keyUsage extension is present in an end entity certificate
which conveys an RSA public key, any combination of the following
values may be present: digitalSignature; nonRepudiation;
keyEncipherment; and dataEncipherment. If the keyUsage extension is
present in a CA certificate which conveys an RSA public key, any
combination of the following values may be present:
digitalSignature; nonRepudiation; keyEncipherment; dataEncipherment;
keyCertSign; and cRLSign. However, this specification RECOMMENDS
that if keyCertSign or cRLSign is present, both keyEncipherment and
dataEncipherment should not be present.
If the keyUsage extension is present in an end entity certificate
which conveys an RSA public key, any combination of the following
values may be present: digitalSignature; nonRepudiation;
keyEncipherment; and dataEncipherment. If the keyUsage extension is
present in a CA certificate which conveys an RSA public key, any
combination of the following values may be present:
digitalSignature; nonRepudiation; keyEncipherment; dataEncipherment;
keyCertSign; and cRLSign. However, this specification RECOMMENDS
that if keyCertSign or cRLSign is present, both keyEncipherment and
dataEncipherment should not be present.
The Diffie-Hellman OID supported by this profile is defined by ANSI X9.42 [X9.42].
此配置文件支持的Diffie-Hellman OID由ANSI X9.42[X9.42]定义。
dhpublicnumber OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) ansi-x942(10046) number-type(2) 1 }
dhpublicnumber OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) ansi-x942(10046) number-type(2) 1 }
The dhpublicnumber OID is intended to be used in the algorithm field of a value of type AlgorithmIdentifier. The parameters field of that type, which has the algorithm-specific syntax ANY DEFINED BY algorithm, have the ASN.1 type DomainParameters for this algorithm.
dhpublicnumber OID用于AlgorithmIdentifier类型值的算法字段。该类型的参数字段具有任何算法定义的特定于算法的语法，具有此算法的ASN.1类型DomainParameters。
DomainParameters ::= SEQUENCE {
p INTEGER, -- odd prime, p=jq +1
g INTEGER, -- generator, g
q INTEGER, -- factor of p-1
j INTEGER OPTIONAL, -- subgroup factor
validationParms ValidationParms OPTIONAL }
DomainParameters ::= SEQUENCE {
p INTEGER, -- odd prime, p=jq +1
g INTEGER, -- generator, g
q INTEGER, -- factor of p-1
j INTEGER OPTIONAL, -- subgroup factor
validationParms ValidationParms OPTIONAL }
ValidationParms ::= SEQUENCE {
seed BIT STRING,
pgenCounter INTEGER }
ValidationParms ::= SEQUENCE {
seed BIT STRING,
pgenCounter INTEGER }
The fields of type DomainParameters have the following meanings:
DomainParameters类型的字段具有以下含义：
p identifies the prime p defining the Galois field;
p标识定义伽罗瓦域的素数p；
g specifies the generator of the multiplicative subgroup of order g;
g指定g阶乘法子群的生成器；
q specifies the prime factor of p-1;
q表示p-1的素因子；
j optionally specifies the value that satisfies the equation p=jq+1 to support the optional verification of group parameters;
j可选地指定满足方程式p=jq+1的值，以支持组参数的可选验证；
seed optionally specifies the bit string parameter used as the seed for the system parameter generation process; and
seed可选地指定用作系统参数生成过程种子的位字符串参数；和
pgenCounter optionally specifies the integer value output as part of the of the system parameter prime generation process.
PGF可选地指定整数值输出，作为系统参数素数生成过程的一部分。
If either of the parameter generation components (pgencounter or seed) is provided, the other shall be present as well.
如果提供了任何一个参数生成组件（PGF或seed），则另一个也应存在。
The Diffie-Hellman public key shall be ASN.1 encoded as an INTEGER; this encoding shall be used as the contents (i.e., the value) of the subjectPublicKey component (a BIT STRING) of the subjectPublicKeyInfo data element.
Diffie-Hellman公钥应为ASN.1编码为整数；该编码应用作subjectPublicKeyInfo数据元素的subjectPublicKey组件（位字符串）的内容（即值）。
DHPublicKey ::= INTEGER -- public key, y = g^x mod p
DHPublicKey ::= INTEGER -- public key, y = g^x mod p
If the keyUsage extension is present in a certificate which conveys a DH public key, the following values may be present: keyAgreement; encipherOnly; and decipherOnly. At most one of encipherOnly and decipherOnly shall be asserted in keyUsage extension.
如果传递DH公钥的证书中存在keyUsage扩展，则可能存在以下值：keyAgreement；仅加密；而且只能破译。密钥使用扩展中最多只能声明EncrypherOnly和DecrypherOnly中的一个。
The Digital Signature Algorithm (DSA) is also known as the Digital Signature Standard (DSS). The DSA OID supported by this profile is
数字签名算法（DSA）也称为数字签名标准（DSS）。此配置文件支持的DSA OID是
id-dsa ID ::= { iso(1) member-body(2) us(840) x9-57(10040)
x9cm(4) 1 }
id-dsa ID ::= { iso(1) member-body(2) us(840) x9-57(10040)
x9cm(4) 1 }
The id-dsa algorithm syntax includes optional parameters. These parameters are commonly referred to as p, q, and g. When omitted, the parameters component shall be omitted entirely. That is, the AlgorithmIdentifier shall be a SEQUENCE of one component - the OBJECT IDENTIFIER id-dsa.
id dsa算法语法包括可选参数。这些参数通常称为p、q和g。省略时，应完全省略参数组件。也就是说，算法标识符应该是一个组件的序列-对象标识符id dsa。
If the DSA algorithm parameters are present in the subjectPublicKeyInfo AlgorithmIdentifier, the parameters are included using the following ASN.1 structure:
如果DSA算法参数存在于subjectPublicKeyInfo算法标识符中，则使用以下ASN.1结构包含这些参数：
Dss-Parms ::= SEQUENCE {
p INTEGER,
q INTEGER,
g INTEGER }
Dss-Parms ::= SEQUENCE {
p INTEGER,
q INTEGER,
g INTEGER }
If the DSA algorithm parameters are absent from the subjectPublicKeyInfo AlgorithmIdentifier and the CA signed the subject certificate using DSA, then the certificate issuer's DSA parameters apply to the subject's DSA key. If the DSA algorithm parameters are absent from the subjectPublicKeyInfo AlgorithmIdentifier and the CA signed the subject certificate using a signature algorithm other than DSA, then the subject's DSA parameters are distributed by other means. If the subjectPublicKeyInfo AlgorithmIdentifier field omits the parameters component and the CA signed the subject with a signature algorithm other than DSA, then clients shall reject the certificate.
如果subjectPublicKeyInfo算法标识符中缺少DSA算法参数，并且CA使用DSA签署了受试者证书，则证书颁发者的DSA参数将应用于受试者的DSA密钥。如果subjectPublicKeyInfo算法标识符中缺少DSA算法参数，且CA使用DSA以外的签名算法对受试者证书进行签名，则受试者的DSA参数将通过其他方式分发。如果subjectPublicKeyInfo AlgorithmIdentifier字段省略了参数组件，CA使用DSA以外的签名算法对该主题进行签名，则客户端应拒绝该证书。
When signing, DSA algorithm generates two values. These values are commonly referred to as r and s. To easily transfer these two values as one signature, they are ASN.1 encoded using the following ASN.1 structure:
签名时，DSA算法生成两个值。这些值通常称为r和s。为了方便地将这两个值作为一个签名传输，它们使用以下ASN.1结构进行ASN.1编码：
Dss-Sig-Value ::= SEQUENCE {
r INTEGER,
s INTEGER }
Dss-Sig-Value ::= SEQUENCE {
r INTEGER,
s INTEGER }
The encoded signature is conveyed as the value of the BIT STRING signature in a Certificate or CertificateList.
编码签名在证书或证书列表中作为位字符串签名的值传递。
The DSA public key shall be ASN.1 DER encoded as an INTEGER; this encoding shall be used as the contents (i.e., the value) of the subjectPublicKey component (a BIT STRING) of the SubjectPublicKeyInfo data element.
DSA公钥应为ASN.1 DER编码为整数；该编码应用作SubjectPublicKeyInfo数据元素的subjectPublicKey组件（位字符串）的内容（即值）。
DSAPublicKey ::= INTEGER -- public key, Y
DSAPublicKey ::= INTEGER -- public key, Y
If the keyUsage extension is present in an end entity certificate which conveys a DSA public key, any combination of the following values may be present: digitalSignature; and nonRepudiation.
如果传递DSA公钥的最终实体证书中存在keyUsage扩展，则可能存在以下值的任意组合：digitalSignature；不可否认。
If the keyUsage extension is present in an CA certificate which conveys a DSA public key, any combination of the following values may be present: digitalSignature; nonRepudiation; keyCertSign; and cRLSign.
如果传递DSA公钥的CA证书中存在keyUsage扩展，则可能存在以下值的任意组合：digitalSignature；不否认；键盘符号；和cRLSign。
8 References
8参考文献
[FIPS 180-1] Federal Information Processing Standards Publication (FIPS PUB) 180-1, Secure Hash Standard, 17 April 1995. [Supersedes FIPS PUB 180 dated 11 May 1993.]
[FIPS 180-1]联邦信息处理标准出版物（FIPS PUB）180-1，安全哈希标准，1995年4月17日。[取代1993年5月11日发布的FIPS PUB 180。]
[FIPS 186] Federal Information Processing Standards Publication (FIPS PUB) 186, Digital Signature Standard, 18 May 1994.
[FIPS 186]联邦信息处理标准出版物（FIPS PUB）186，数字签名标准，1994年5月18日。
[RC95] Rogier, N. and Chauvaud, P., "The compression function of MD2 is not collision free," Presented at Selected Areas in Cryptography '95, May 1995.
[RC95]Rogier，N.和Chauvaud，P.，“MD2的压缩功能不是无冲突的”，发表于1995年5月《密码学》95的选定领域。
[RFC 791] Postel, J., "Internet Protocol", STD 5, RFC 791, September 1981.
[RFC 791]Postel，J.，“互联网协议”，STD 5，RFC 7911981年9月。
[RFC 822] Crocker, D., "Standard for the format of ARPA Internet text messages", STD 11, RFC 822, August 1982.
[RFC 822]Crocker，D.，“ARPA互联网文本信息格式标准”，STD 11，RFC 822，1982年8月。
[RFC 1034] Mockapetris, P., "Domain names - concepts and facilities", STD 13, RFC 1034, November 1987.
[RFC 1034]Mockapetris，P.，“域名-概念和设施”，STD 13，RFC 1034，1987年11月。
[RFC 1319] Kaliski, B., "The MD2 Message-Digest Algorithm," RFC 1319, April 1992.
[RFC 1319]Kaliski，B.，“MD2消息摘要算法”，RFC 1319，1992年4月。
[RFC 1321] Rivest, R., "The MD5 Message-Digest Algorithm," RFC 1321, April 1992.
[RFC 1321]Rivest，R.，“MD5消息摘要算法”，RFC 13211992年4月。
[RFC 1422] Kent, S., "Privacy Enhancement for Internet Electronic Mail: Part II: Certificate-Based Key Management," RFC 1422, February 1993.
[RFC 1422]Kent，S.，“互联网电子邮件的隐私增强：第二部分：基于证书的密钥管理”，RFC 1422，1993年2月。
[RFC 1423] Balenson, D., "Privacy Enhancement for Internet Electronic Mail: Part III: Algorithms, Modes, and Identifiers," RFC 1423, February 1993.
[RFC 1423]Balenson，D.，“互联网电子邮件的隐私增强：第三部分：算法、模式和标识符”，RFC 1423，1993年2月。
[RFC 1519] Fuller, V., Li, T., Yu, J. and K. Varadhan. "Classless Inter-Domain Routing (CIDR): an Address Assignment and Aggregation Strategy", RFC 1519, September 1993.
[RFC 1519]Fuller，V.，Li，T.，Yu，J.和K.Varadhan。“无类别域间路由（CIDR）：一种地址分配和聚合策略”，RFC 1519，1993年9月。
[RFC 1738] Berners-Lee, T., Masinter L., and M. McCahill. "Uniform Resource Locators (URL)", RFC 1738, December 1994.
[RFC 1738]Berners Lee，T.，Masinter L.，和M.McCahill。“统一资源定位器（URL）”，RFC 17381994年12月。
[RFC 1778] Howes, T., Kille S., Yeong, W. and C. Robbins. "The String Representation of Standard Attribute Syntaxes," RFC 1778, March 1995.
[RFC 1778]Howes，T.，Kille S.，Yeong，W.和C.Robbins。“标准属性语法的字符串表示”，RFC17781995年3月。
[RFC 1883] Deering, S. and R. Hinden. "Internet Protocol, Version 6 (IPv6) Specification", RFC 1883, December 1995.
[RFC 1883]Deering，S.和R.Hinden。“互联网协议，第6版（IPv6）规范”，RFC 1883，1995年12月。
[RFC 2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC 2119]Bradner，S.，“RFC中用于表示需求水平的关键词”，BCP 14，RFC 2119，1997年3月。
[RFC 2247] Kille, S., Wahl, M., Grimstad, A., Huber, R. and S. Sataluri. "Using Domains in LDAP/X.500 Distinguished Names", RFC 2247, January 1998.
[RFC 2247]Kille，S.，Wahl，M.，Grimstad，A.，Huber，R.和S.Sataluri。“使用LDAP/X.500可分辨名称中的域”，RFC 2247，1998年1月。
[RFC 2277] Alvestrand, H., "IETF Policy on Character Sets and Languages", RFC 2277, January 1998.
[RFC 2277]Alvestrand，H.，“IETF字符集和语言政策”，RFC 2277，1998年1月。
[RFC 2279] Yergeau, F., "UTF-8, a transformation format of ISO 10646", RFC 2279, January 1998.
[RFC 2279]Yergeau，F.，“UTF-8，ISO 10646的转换格式”，RFC 2279，1998年1月。
[RFC 2313] Kaliski, B., "PKCS #1: RSA Encryption Version 1.5", RFC 2313, March 1998.
[RFC 2313]Kaliski，B.，“PKCS#1:RSA加密版本1.5”，RFC 2313，1998年3月。
[SDN.701] SDN.701, "Message Security Protocol 4.0", Revision A 1997-02-06.
[SDN.701]SDN.701，“消息安全协议4.0”，修订版A 1997-02-06。
[X.208] CCITT Recommendation X.208: Specification of Abstract Syntax Notation One (ASN.1), 1988.
[X.208]CCITT建议X.208：抽象语法符号1规范（ASN.1），1988年。
[X.501] ITU-T Recommendation X.501: Information Technology - Open Systems Interconnection - The Directory: Models, 1993.
[X.501]ITU-T建议X.501：信息技术-开放系统互连-目录：模型，1993年。
[X.509] ITU-T Recommendation X.509 (1997 E): Information Technology - Open Systems Interconnection - The Directory: Authentication Framework, June 1997.
[X.509]ITU-T建议X.509（1997 E）：信息技术——开放系统互连——目录：认证框架，1997年6月。
[X.520] ITU-T Recommendation X.520: Information Technology - Open Systems Interconnection - The Directory: Selected Attribute Types, 1993.
[X.520]ITU-T建议X.520：信息技术——开放系统互连——目录：选定属性类型，1993年。
[X9.42] ANSI X9.42-199x, Public Key Cryptography for The Financial Services Industry: Agreement of Symmetric Algorithm Keys Using Diffie-Hellman (Working Draft), December 1997.
[X9.42]ANSI X9.42-199x，《金融服务业的公钥加密：使用Diffie-Hellman的对称算法密钥协议》（工作草案），1997年12月。
[X9.55] ANSI X9.55-1995, Public Key Cryptography For The Financial Services Industry: Extensions To Public Key Certificates And Certificate Revocation Lists, 8 December, 1995.
[X9.55]ANSI X9.55-1995，金融服务业的公钥加密：公钥证书和证书撤销列表的扩展，1995年12月8日。
[X9.57] ANSI X9.57-199x, Public Key Cryptography For The Financial Services Industry: Certificate Management (Working Draft), 21 June, 1996.
[X9.57]ANSI X9.57-199x，金融服务业的公钥加密：证书管理（工作草案），1996年6月21日。
9 Intellectual Property Rights
9知识产权
The IETF has been notified of intellectual property rights claimed in regard to some or all of the specification contained in this document. For more information consult the online list of claimed rights.
IETF已收到关于本文件所含部分或全部规范的知识产权声明。有关更多信息，请查阅在线权利主张列表。
The IETF takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any effort to identify any such rights. Information on the IETF's procedures with respect to rights in standards-track and standards-related documentation can be found in BCP-11. Copies of claims of rights made available for publication and any assurances of licenses to be made available, or the result of an attempt made to
IETF对可能声称与本文件所述技术的实施或使用有关的任何知识产权或其他权利的有效性或范围，或此类权利下的任何许可可能或可能不可用的程度，不采取任何立场；它也不表示它已作出任何努力来确定任何此类权利。有关IETF在标准跟踪和标准相关文件中权利的程序信息，请参见BCP-11。可供发布的权利主张副本和任何许可证保证副本，或试图
obtain a general license or permission for the use of such proprietary rights by implementors or users of this specification can be obtained from the IETF Secretariat.
可从IETF秘书处获得本规范实施者或用户使用此类专有权利的一般许可或许可。
10 Security Considerations
10安全考虑
The majority of this specification is devoted to the format and content of certificates and CRLs. Since certificates and CRLs are digitally signed, no additional integrity service is necessary. Neither certificates nor CRLs need be kept secret, and unrestricted and anonymous access to certificates and CRLs has no security implications.
本规范的大部分内容用于证书和CRL的格式和内容。由于证书和CRL是数字签名的，因此不需要额外的完整性服务。证书和CRL都不需要保密，对证书和CRL的无限制匿名访问没有安全隐患。
However, security factors outside the scope of this specification will affect the assurance provided to certificate users. This section highlights critical issues that should be considered by implementors, administrators, and users.
但是，本规范范围之外的安全因素将影响向证书用户提供的保证。本节重点介绍实施者、管理员和用户应该考虑的关键问题。
The procedures performed by CAs and RAs to validate the binding of the subject's identity of their public key greatly affect the assurance that should be placed in the certificate. Relying parties may wish to review the CA's certificate practice statement. This may be particularly important when issuing certificates to other CAs.
CAs和RAs为验证其公钥主体身份的绑定而执行的程序极大地影响了应在证书中放置的保证。依赖方可能希望审查CA的证书实践声明。当向其他CA颁发证书时，这可能特别重要。
The use of a single key pair for both signature and other purposes is strongly discouraged. Use of separate key pairs for signature and key management provides several benefits to the users. The ramifications associated with loss or disclosure of a signature key are different from loss or disclosure of a key management key. Using separate key pairs permits a balanced and flexible response. Similarly, different validity periods or key lengths for each key pair may be appropriate in some application environments. Unfortunately, some legacy applications (e.g., SSL) use a single key pair for signature and key management.
强烈反对将单个密钥对用于签名和其他目的。使用单独的密钥对进行签名和密钥管理为用户提供了一些好处。与签名密钥的丢失或泄露相关的后果不同于密钥管理密钥的丢失或泄露。使用单独的密钥对允许平衡和灵活的响应。类似地，在某些应用程序环境中，每个密钥对的不同有效期或密钥长度可能是合适的。不幸的是，一些遗留应用程序（例如SSL）使用单个密钥对进行签名和密钥管理。
The protection afforded private keys is a critical factor in maintaining security. On a small scale, failure of users to protect their private keys will permit an attacker to masquerade as them, or decrypt their personal information. On a larger scale, compromise of a CA's private signing key may have a catastrophic effect. If an attacker obtains the private key unnoticed, the attacker may issue bogus certificates and CRLs. Existence of bogus certificates and CRLs will undermine confidence in the system. If the compromise is detected, all certificates issued to the CA shall be revoked, preventing services between its users and users of other CAs. Rebuilding after such a compromise will be problematic, so CAs are advised to implement a combination of strong technical measures (e.g., tamper-resistant cryptographic modules) and appropriate
私钥的保护是维护安全性的关键因素。在小范围内，如果用户未能保护其私钥，攻击者就可以伪装成私钥，或解密其个人信息。在更大范围内，CA私有签名密钥的泄露可能会产生灾难性的影响。如果攻击者在未被注意的情况下获取私钥，则攻击者可能会颁发伪造的证书和CRL。伪造证书和CRL的存在将削弱对系统的信心。如果检测到泄露，则应撤销颁发给CA的所有证书，从而阻止其用户与其他CA用户之间的服务。在这样的妥协之后重建将是有问题的，因此建议CA实施强有力的技术措施（例如，防篡改加密模块）和适当的
management procedures (e.g., separation of duties) to avoid such an incident.
避免此类事件的管理程序（如职责分离）。
Loss of a CA's private signing key may also be problematic. The CA would not be able to produce CRLs or perform normal key rollover. CAs are advised to maintain secure backup for signing keys. The security of the key backup procedures is a critical factor in avoiding key compromise.
CA的私人签名密钥丢失也可能有问题。CA将无法生成CRL或执行正常的密钥翻转。建议CA为签名密钥维护安全备份。密钥备份过程的安全性是避免密钥泄露的关键因素。
The availability and freshness of revocation information will affect the degree of assurance that should be placed in a certificate. While certificates expire naturally, events may occur during its natural lifetime which negate the binding between the subject and public key. If revocation information is untimely or unavailable, the assurance associated with the binding is clearly reduced. Similarly, implementations of the Path Validation mechanism described in section 6 that omit revocation checking provide less assurance than those that support it.
吊销信息的可用性和新鲜度将影响证书中应包含的保证程度。虽然证书自然过期，但在其自然生存期内可能会发生事件，从而否定主题和公钥之间的绑定。如果撤销信息不及时或不可用，则与绑定相关的保证将明显减少。类似地，第6节中描述的路径验证机制的实现省略了撤销检查，与支持撤销检查的实现相比，提供的保证更少。
The path validation algorithm depends on the certain knowledge of the public keys (and other information) about one or more trusted CAs. The decision to trust a CA is an important decision as it ultimately determines the trust afforded a certificate. The authenticated distribution of trusted CA public keys (usually in the form of a "self-signed" certificate) is a security critical out of band process that is beyond the scope of this specification.
路径验证算法依赖于关于一个或多个可信CA的公钥（和其他信息）的特定知识。信任CA的决定是一个重要的决定，因为它最终决定了对证书的信任。可信CA公钥的认证分发（通常以“自签名”证书的形式）是一个安全关键的带外过程，超出了本规范的范围。
In addition, where a key compromise or CA failure occurs for a trusted CA, the user will need to modify the information provided to the path validation routine. Selection of too many trusted CAs will make the trusted CA information difficult to maintain. On the other hand, selection of only one trusted CA may limit users to a closed community of users until a global PKI emerges.
此外，当可信CA出现密钥泄露或CA故障时，用户需要修改提供给路径验证例程的信息。选择过多的可信CA将使可信CA信息难以维护。另一方面，仅选择一个受信任的CA可能会将用户限制在一个封闭的用户社区中，直到出现一个全局PKI。
The quality of implementations that process certificates may also affect the degree of assurance provided. The path validation algorithm described in section 6 relies upon the integrity of the trusted CA information, and especially the integrity of the public keys associated with the trusted CAs. By substituting public keys for which an attacker has the private key, an attacker could trick the user into accepting false certificates.
过程证书的实现质量也可能影响所提供的保证程度。第6节中描述的路径验证算法依赖于可信CA信息的完整性，尤其是与可信CA相关联的公钥的完整性。通过替换攻击者拥有私钥的公钥，攻击者可以欺骗用户接受虚假证书。
The binding between a key and certificate subject cannot be stronger than the cryptographic module implementation and algorithms used to generate the signature. Short key lengths or weak hash algorithms will limit the utility of a certificate. CAs are encouraged to note advances in cryptology so they can employ strong cryptographic techniques. In addition, CAs should decline to issue certificates to
密钥和证书主体之间的绑定不能强于用于生成签名的加密模块实现和算法。短密钥长度或弱哈希算法将限制证书的实用性。鼓励CA注意密码学的进展，以便他们能够使用强大的密码技术。此外，CAs应拒绝向客户颁发证书
CAs or end entities that generate weak signatures.
生成弱签名的CA或终端实体。
Inconsistent application of name comparison rules may result in acceptance of invalid X.509 certification paths, or rejection of valid ones. The X.500 series of specifications defines rules for comparing distinguished names require comparison of strings without regard to case, character set, multi-character white space substring, or leading and trailing white space. This specification relaxes these requirements, requiring support for binary comparison at a minimum.
名称比较规则的不一致应用可能会导致接受无效的X.509认证路径，或拒绝有效路径。X.500系列规范定义了用于比较区分名称的规则，这些规则要求比较字符串，而不考虑大小写、字符集、多字符空格子字符串或前导和尾随空格。本规范放宽了这些要求，至少需要支持二进制比较。
CAs shall encode the distinguished name in the subject field of a CA certificate identically to the distinguished name in the issuer field in certificates issued by the latter CA. If CAs use different encodings, implementations of this specification may fail to recognize name chains for paths that include this certificate. As a consequence, valid paths could be rejected.
CA应将CA证书主题字段中的可分辨名称编码为与CA颁发的证书中颁发者字段中的可分辨名称相同的名称。如果CA使用不同的编码，则本规范的实现可能无法识别包含该证书的路径的名称链。因此，可能会拒绝有效路径。
In addition, name constraints for distinguished names shall be stated identically to the encoding used in the subject field or subjectAltName extension. If not, (1) name constraints stated as excludedSubTrees will not match and invalid paths will be accepted and (2) name constraints expressed as permittedSubtrees will not match and valid paths will be rejected. To avoid acceptance of invalid paths, CAs should state name constraints for distinguished names as permittedSubtrees where ever possible.
此外，可分辨名称的名称限制应与主题字段或主题名称扩展中使用的编码相同。如果不匹配，（1）表示为excludedSubTrees的名称约束将不匹配，将接受无效路径；（2）表示为permittedSubtrees的名称约束将不匹配，将拒绝有效路径。为避免接受无效路径，CA应尽可能将可分辨名称的名称约束声明为permittedSubtrees。
This section describes data objects used by conforming PKI components in an "ASN.1-like" syntax. This syntax is a hybrid of the 1988 and 1993 ASN.1 syntaxes. The 1988 ASN.1 syntax is augmented with 1993 UNIVERSAL Types UniversalString, BMPString and UTF8String.
本节以“ASN.1-like”语法描述一致性PKI组件使用的数据对象。这种语法是1988年和1993年ASN.1语法的混合。1988年的ASN.1语法通过1993年的通用类型UniversalString、BMPString和UTF8String进行了扩充。
The ASN.1 syntax does not permit the inclusion of type statements in the ASN.1 module, and the 1993 ASN.1 standard does not permit use of the new UNIVERSAL types in modules using the 1988 syntax. As a result, this module does not conform to either version of the ASN.1 standard.
ASN.1语法不允许在ASN.1模块中包含类型语句，1993年ASN.1标准不允许在使用1988语法的模块中使用新的通用类型。因此，该模块不符合ASN.1标准的任何版本。
This appendix may be converted into 1988 ASN.1 by replacing the defintions for the UNIVERSAL Types with the 1988 catch-all "ANY".
本附录可转换为1988年ASN.1，方法是将通用型的定义替换为1988年的“任何”。
PKIX1Explicit88 {iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0) id-pkix1-explicit-88(1)}
PKIX1Explicit88 {iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0) id-pkix1-explicit-88(1)}
DEFINITIONS EXPLICIT TAGS ::=
DEFINITIONS EXPLICIT TAGS ::=
BEGIN
开始
-- EXPORTS ALL --
--全部出口--
-- IMPORTS NONE --
--没有进口--
-- UNIVERSAL Types defined in '93 and '98 ASN.1
-- but required by this specification
-- UNIVERSAL Types defined in '93 and '98 ASN.1
-- but required by this specification
UniversalString ::= [UNIVERSAL 28] IMPLICIT OCTET STRING
-- UniversalString is defined in ASN.1:1993
UniversalString ::= [UNIVERSAL 28] IMPLICIT OCTET STRING
-- UniversalString is defined in ASN.1:1993
BMPString ::= [UNIVERSAL 30] IMPLICIT OCTET STRING
-- BMPString is the subtype of UniversalString and models
-- the Basic Multilingual Plane of ISO/IEC/ITU 10646-1
BMPString ::= [UNIVERSAL 30] IMPLICIT OCTET STRING
-- BMPString is the subtype of UniversalString and models
-- the Basic Multilingual Plane of ISO/IEC/ITU 10646-1
UTF8String ::= [UNIVERSAL 12] IMPLICIT OCTET STRING
-- The content of this type conforms to RFC 2279.
UTF8String ::= [UNIVERSAL 12] IMPLICIT OCTET STRING
-- The content of this type conforms to RFC 2279.
-- -- PKIX specific OIDs
----特定于PKIX的OID
id-pkix OBJECT IDENTIFIER ::=
{ iso(1) identified-organization(3) dod(6) internet(1)
id-pkix OBJECT IDENTIFIER ::=
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) }
-- PKIX arcs
security(5) mechanisms(5) pkix(7) }
-- PKIX arcs
id-pe OBJECT IDENTIFIER ::= { id-pkix 1 }
-- arc for private certificate extensions
id-qt OBJECT IDENTIFIER ::= { id-pkix 2 }
-- arc for policy qualifier types
id-kp OBJECT IDENTIFIER ::= { id-pkix 3 }
-- arc for extended key purpose OIDS
id-ad OBJECT IDENTIFIER ::= { id-pkix 48 }
-- arc for access descriptors
id-pe OBJECT IDENTIFIER ::= { id-pkix 1 }
-- arc for private certificate extensions
id-qt OBJECT IDENTIFIER ::= { id-pkix 2 }
-- arc for policy qualifier types
id-kp OBJECT IDENTIFIER ::= { id-pkix 3 }
-- arc for extended key purpose OIDS
id-ad OBJECT IDENTIFIER ::= { id-pkix 48 }
-- arc for access descriptors
-- policyQualifierIds for Internet policy qualifiers
--Internet策略限定符的PolicyQualifierID
id-qt-cps OBJECT IDENTIFIER ::= { id-qt 1 }
-- OID for CPS qualifier
id-qt-unotice OBJECT IDENTIFIER ::= { id-qt 2 }
-- OID for user notice qualifier
id-qt-cps OBJECT IDENTIFIER ::= { id-qt 1 }
-- OID for CPS qualifier
id-qt-unotice OBJECT IDENTIFIER ::= { id-qt 2 }
-- OID for user notice qualifier
-- access descriptor definitions
--访问描述符定义
id-ad-ocsp OBJECT IDENTIFIER ::= { id-ad 1 }
id-ad-caIssuers OBJECT IDENTIFIER ::= { id-ad 2 }
id-ad-ocsp OBJECT IDENTIFIER ::= { id-ad 1 }
id-ad-caIssuers OBJECT IDENTIFIER ::= { id-ad 2 }
-- attribute data types --
--属性数据类型--
Attribute ::= SEQUENCE {
type AttributeType,
values SET OF AttributeValue
-- at least one value is required -- }
Attribute ::= SEQUENCE {
type AttributeType,
values SET OF AttributeValue
-- at least one value is required -- }
AttributeType ::= OBJECT IDENTIFIER
AttributeType ::= OBJECT IDENTIFIER
AttributeValue ::= ANY
AttributeValue ::= ANY
AttributeTypeAndValue ::= SEQUENCE {
type AttributeType,
value AttributeValue }
AttributeTypeAndValue ::= SEQUENCE {
type AttributeType,
value AttributeValue }
-- suggested naming attributes: Definition of the following
-- information object set may be augmented to meet local
-- requirements. Note that deleting members of the set may
-- prevent interoperability with conforming implementations.
-- presented in pairs: the AttributeType followed by the
-- type definition for the corresponding AttributeValue
-- suggested naming attributes: Definition of the following
-- information object set may be augmented to meet local
-- requirements. Note that deleting members of the set may
-- prevent interoperability with conforming implementations.
-- presented in pairs: the AttributeType followed by the
-- type definition for the corresponding AttributeValue
--Arc for standard naming attributes
id-at OBJECT IDENTIFIER ::= {joint-iso-ccitt(2) ds(5) 4}
--Arc for standard naming attributes
id-at OBJECT IDENTIFIER ::= {joint-iso-ccitt(2) ds(5) 4}
-- Attributes of type NameDirectoryString
id-at-name AttributeType ::= {id-at 41}
id-at-surname AttributeType ::= {id-at 4}
id-at-givenName AttributeType ::= {id-at 42}
id-at-initials AttributeType ::= {id-at 43}
id-at-generationQualifier AttributeType ::= {id-at 44}
-- Attributes of type NameDirectoryString
id-at-name AttributeType ::= {id-at 41}
id-at-surname AttributeType ::= {id-at 4}
id-at-givenName AttributeType ::= {id-at 42}
id-at-initials AttributeType ::= {id-at 43}
id-at-generationQualifier AttributeType ::= {id-at 44}
X520name ::= CHOICE {
teletexString TeletexString (SIZE (1..ub-name)),
printableString PrintableString (SIZE (1..ub-name)),
universalString UniversalString (SIZE (1..ub-name)),
utf8String UTF8String (SIZE (1..ub-name)),
bmpString BMPString (SIZE(1..ub-name)) }
X520name ::= CHOICE {
teletexString TeletexString (SIZE (1..ub-name)),
printableString PrintableString (SIZE (1..ub-name)),
universalString UniversalString (SIZE (1..ub-name)),
utf8String UTF8String (SIZE (1..ub-name)),
bmpString BMPString (SIZE(1..ub-name)) }
--
--
id-at-commonName AttributeType ::= {id-at 3}
id-at-commonName AttributeType ::= {id-at 3}
X520CommonName ::= CHOICE {
teletexString TeletexString (SIZE (1..ub-common-name)),
printableString PrintableString (SIZE (1..ub-common-name)),
universalString UniversalString (SIZE (1..ub-common-name)),
utf8String UTF8String (SIZE (1..ub-common-name)),
bmpString BMPString (SIZE(1..ub-common-name)) }
X520CommonName ::= CHOICE {
teletexString TeletexString (SIZE (1..ub-common-name)),
printableString PrintableString (SIZE (1..ub-common-name)),
universalString UniversalString (SIZE (1..ub-common-name)),
utf8String UTF8String (SIZE (1..ub-common-name)),
bmpString BMPString (SIZE(1..ub-common-name)) }
--
--
id-at-localityName AttributeType ::= {id-at 7}
id-at-localityName AttributeType ::= {id-at 7}
X520LocalityName ::= CHOICE {
teletexString TeletexString (SIZE (1..ub-locality-name)),
printableString PrintableString (SIZE (1..ub-locality-name)),
universalString UniversalString (SIZE (1..ub-locality-name)),
utf8String UTF8String (SIZE (1..ub-locality-name)),
bmpString BMPString (SIZE(1..ub-locality-name)) }
X520LocalityName ::= CHOICE {
teletexString TeletexString (SIZE (1..ub-locality-name)),
printableString PrintableString (SIZE (1..ub-locality-name)),
universalString UniversalString (SIZE (1..ub-locality-name)),
utf8String UTF8String (SIZE (1..ub-locality-name)),
bmpString BMPString (SIZE(1..ub-locality-name)) }
--
--
id-at-stateOrProvinceName AttributeType ::= {id-at 8}
id-at-stateOrProvinceName AttributeType ::= {id-at 8}
X520StateOrProvinceName ::= CHOICE {
teletexString TeletexString (SIZE (1..ub-state-name)),
printableString PrintableString (SIZE (1..ub-state-name)),
universalString UniversalString (SIZE (1..ub-state-name)),
utf8String UTF8String (SIZE (1..ub-state-name)),
bmpString BMPString (SIZE(1..ub-state-name)) }
X520StateOrProvinceName ::= CHOICE {
teletexString TeletexString (SIZE (1..ub-state-name)),
printableString PrintableString (SIZE (1..ub-state-name)),
universalString UniversalString (SIZE (1..ub-state-name)),
utf8String UTF8String (SIZE (1..ub-state-name)),
bmpString BMPString (SIZE(1..ub-state-name)) }
--
--
id-at-organizationName AttributeType ::= {id-at 10}
id-at-organizationName AttributeType ::= {id-at 10}
X520OrganizationName ::= CHOICE {
teletexString TeletexString (SIZE (1..ub-organization-name)),
printableString PrintableString (SIZE (1..ub-organization-name)),
universalString UniversalString (SIZE (1..ub-organization-name)),
utf8String UTF8String (SIZE (1..ub-organization-name)),
bmpString BMPString (SIZE(1..ub-organization-name)) }
X520OrganizationName ::= CHOICE {
teletexString TeletexString (SIZE (1..ub-organization-name)),
printableString PrintableString (SIZE (1..ub-organization-name)),
universalString UniversalString (SIZE (1..ub-organization-name)),
utf8String UTF8String (SIZE (1..ub-organization-name)),
bmpString BMPString (SIZE(1..ub-organization-name)) }
--
--
id-at-organizationalUnitName AttributeType ::= {id-at 11}
id-at-organizationalUnitName AttributeType ::= {id-at 11}
X520OrganizationalUnitName ::= CHOICE {
teletexString TeletexString (SIZE (1..ub-organizational-unit-name)),
printableString PrintableString
(SIZE (1..ub-organizational-unit-name)),
universalString UniversalString
(SIZE (1..ub-organizational-unit-name)),
utf8String UTF8String (SIZE (1..ub-organizational-unit-name)),
bmpString BMPString (SIZE(1..ub-organizational-unit-name)) }
X520OrganizationalUnitName ::= CHOICE {
teletexString TeletexString (SIZE (1..ub-organizational-unit-name)),
printableString PrintableString
(SIZE (1..ub-organizational-unit-name)),
universalString UniversalString
(SIZE (1..ub-organizational-unit-name)),
utf8String UTF8String (SIZE (1..ub-organizational-unit-name)),
bmpString BMPString (SIZE(1..ub-organizational-unit-name)) }
--
--
id-at-title AttributeType ::= {id-at 12}
id-at-title AttributeType ::= {id-at 12}
X520Title ::= CHOICE {
teletexString TeletexString (SIZE (1..ub-title)),
printableString PrintableString (SIZE (1..ub-title)),
universalString UniversalString (SIZE (1..ub-title)),
utf8String UTF8String (SIZE (1..ub-title)),
bmpString BMPString (SIZE(1..ub-title)) }
X520Title ::= CHOICE {
teletexString TeletexString (SIZE (1..ub-title)),
printableString PrintableString (SIZE (1..ub-title)),
universalString UniversalString (SIZE (1..ub-title)),
utf8String UTF8String (SIZE (1..ub-title)),
bmpString BMPString (SIZE(1..ub-title)) }
--
--
id-at-dnQualifier AttributeType ::= {id-at 46}
X520dnQualifier ::= PrintableString
id-at-dnQualifier AttributeType ::= {id-at 46}
X520dnQualifier ::= PrintableString
id-at-countryName AttributeType ::= {id-at 6}
X520countryName ::= PrintableString (SIZE (2)) -- IS 3166 codes
id-at-countryName AttributeType ::= {id-at 6}
X520countryName ::= PrintableString (SIZE (2)) -- IS 3166 codes
-- Legacy attributes
--遗留属性
pkcs-9 OBJECT IDENTIFIER ::=
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 9 }
pkcs-9 OBJECT IDENTIFIER ::=
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 9 }
emailAddress AttributeType ::= { pkcs-9 1 }
emailAddress AttributeType ::= { pkcs-9 1 }
Pkcs9email ::= IA5String (SIZE (1..ub-emailaddress-length))
Pkcs9email ::= IA5String (SIZE (1..ub-emailaddress-length))
-- naming data types --
--命名数据类型--
Name ::= CHOICE { -- only one possibility for now --
rdnSequence RDNSequence }
Name ::= CHOICE { -- only one possibility for now --
rdnSequence RDNSequence }
RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
DistinguishedName ::= RDNSequence
DistinguishedName ::= RDNSequence
RelativeDistinguishedName ::=
SET SIZE (1 .. MAX) OF AttributeTypeAndValue
RelativeDistinguishedName ::=
SET SIZE (1 .. MAX) OF AttributeTypeAndValue
-- Directory string type --
--目录字符串类型--
DirectoryString ::= CHOICE {
teletexString TeletexString (SIZE (1..MAX)),
printableString PrintableString (SIZE (1..MAX)),
universalString UniversalString (SIZE (1..MAX)),
utf8String UTF8String (SIZE (1..MAX)),
bmpString BMPString (SIZE(1..MAX)) }
DirectoryString ::= CHOICE {
teletexString TeletexString (SIZE (1..MAX)),
printableString PrintableString (SIZE (1..MAX)),
universalString UniversalString (SIZE (1..MAX)),
utf8String UTF8String (SIZE (1..MAX)),
bmpString BMPString (SIZE(1..MAX)) }
-- certificate and CRL specific structures begin here
--证书和CRL特定结构从这里开始
Certificate ::= SEQUENCE {
tbsCertificate TBSCertificate,
signatureAlgorithm AlgorithmIdentifier,
signature BIT STRING }
Certificate ::= SEQUENCE {
tbsCertificate TBSCertificate,
signatureAlgorithm AlgorithmIdentifier,
signature BIT STRING }
TBSCertificate ::= SEQUENCE {
version [0] Version DEFAULT v1,
serialNumber CertificateSerialNumber,
signature AlgorithmIdentifier,
issuer Name,
validity Validity,
subject Name,
subjectPublicKeyInfo SubjectPublicKeyInfo,
issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL,
-- If present, version shall be v2 or v3
subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL,
-- If present, version shall be v2 or v3
extensions [3] Extensions OPTIONAL
-- If present, version shall be v3 -- }
TBSCertificate ::= SEQUENCE {
version [0] Version DEFAULT v1,
serialNumber CertificateSerialNumber,
signature AlgorithmIdentifier,
issuer Name,
validity Validity,
subject Name,
subjectPublicKeyInfo SubjectPublicKeyInfo,
issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL,
-- If present, version shall be v2 or v3
subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL,
-- If present, version shall be v2 or v3
extensions [3] Extensions OPTIONAL
-- If present, version shall be v3 -- }
Version ::= INTEGER { v1(0), v2(1), v3(2) }
Version ::= INTEGER { v1(0), v2(1), v3(2) }
CertificateSerialNumber ::= INTEGER
CertificateSerialNumber ::= INTEGER
Validity ::= SEQUENCE {
notBefore Time,
notAfter Time }
Validity ::= SEQUENCE {
notBefore Time,
notAfter Time }
Time ::= CHOICE {
utcTime UTCTime,
generalTime GeneralizedTime }
Time ::= CHOICE {
utcTime UTCTime,
generalTime GeneralizedTime }
UniqueIdentifier ::= BIT STRING
UniqueIdentifier ::= BIT STRING
SubjectPublicKeyInfo ::= SEQUENCE {
algorithm AlgorithmIdentifier,
subjectPublicKey BIT STRING }
SubjectPublicKeyInfo ::= SEQUENCE {
algorithm AlgorithmIdentifier,
subjectPublicKey BIT STRING }
Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
Extension ::= SEQUENCE {
extnID OBJECT IDENTIFIER,
critical BOOLEAN DEFAULT FALSE,
extnValue OCTET STRING }
Extension ::= SEQUENCE {
extnID OBJECT IDENTIFIER,
critical BOOLEAN DEFAULT FALSE,
extnValue OCTET STRING }
-- CRL structures
--CRL结构
CertificateList ::= SEQUENCE {
tbsCertList TBSCertList,
signatureAlgorithm AlgorithmIdentifier,
signature BIT STRING }
CertificateList ::= SEQUENCE {
tbsCertList TBSCertList,
signatureAlgorithm AlgorithmIdentifier,
signature BIT STRING }
TBSCertList ::= SEQUENCE {
version Version OPTIONAL,
-- if present, shall be v2
signature AlgorithmIdentifier,
issuer Name,
thisUpdate Time,
nextUpdate Time OPTIONAL,
revokedCertificates SEQUENCE OF SEQUENCE {
userCertificate CertificateSerialNumber,
revocationDate Time,
crlEntryExtensions Extensions OPTIONAL
-- if present, shall be v2
} OPTIONAL,
crlExtensions [0] Extensions OPTIONAL
-- if present, shall be v2 -- }
TBSCertList ::= SEQUENCE {
version Version OPTIONAL,
-- if present, shall be v2
signature AlgorithmIdentifier,
issuer Name,
thisUpdate Time,
nextUpdate Time OPTIONAL,
revokedCertificates SEQUENCE OF SEQUENCE {
userCertificate CertificateSerialNumber,
revocationDate Time,
crlEntryExtensions Extensions OPTIONAL
-- if present, shall be v2
} OPTIONAL,
crlExtensions [0] Extensions OPTIONAL
-- if present, shall be v2 -- }
-- Version, Time, CertificateSerialNumber, and Extensions were
-- defined earlier for use in the certificate structure
-- Version, Time, CertificateSerialNumber, and Extensions were
-- defined earlier for use in the certificate structure
AlgorithmIdentifier ::= SEQUENCE {
AlgorithmIdentifier ::= SEQUENCE {
algorithm OBJECT IDENTIFIER,
parameters ANY DEFINED BY algorithm OPTIONAL }
-- contains a value of the type
-- registered for use with the
-- algorithm object identifier value
algorithm OBJECT IDENTIFIER,
parameters ANY DEFINED BY algorithm OPTIONAL }
-- contains a value of the type
-- registered for use with the
-- algorithm object identifier value
-- Algorithm OIDs and parameter structures
--算法和参数结构
pkcs-1 OBJECT IDENTIFIER ::= {
iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 1 }
pkcs-1 OBJECT IDENTIFIER ::= {
iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 1 }
rsaEncryption OBJECT IDENTIFIER ::= { pkcs-1 1 }
rsaEncryption OBJECT IDENTIFIER ::= { pkcs-1 1 }
md2WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 2 }
md2WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 2 }
md5WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 4 }
md5WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 4 }
sha1WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 5 }
sha1WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 5 }
id-dsa-with-sha1 OBJECT IDENTIFIER ::= {
iso(1) member-body(2) us(840) x9-57 (10040) x9algorithm(4) 3 }
id-dsa-with-sha1 OBJECT IDENTIFIER ::= {
iso(1) member-body(2) us(840) x9-57 (10040) x9algorithm(4) 3 }
Dss-Sig-Value ::= SEQUENCE {
r INTEGER,
s INTEGER }
Dss-Sig-Value ::= SEQUENCE {
r INTEGER,
s INTEGER }
dhpublicnumber OBJECT IDENTIFIER ::= {
iso(1) member-body(2) us(840) ansi-x942(10046) number-type(2) 1 }
dhpublicnumber OBJECT IDENTIFIER ::= {
iso(1) member-body(2) us(840) ansi-x942(10046) number-type(2) 1 }
DomainParameters ::= SEQUENCE {
p INTEGER, -- odd prime, p=jq +1
g INTEGER, -- generator, g
q INTEGER, -- factor of p-1
j INTEGER OPTIONAL, -- subgroup factor, j>= 2
validationParms ValidationParms OPTIONAL }
DomainParameters ::= SEQUENCE {
p INTEGER, -- odd prime, p=jq +1
g INTEGER, -- generator, g
q INTEGER, -- factor of p-1
j INTEGER OPTIONAL, -- subgroup factor, j>= 2
validationParms ValidationParms OPTIONAL }
ValidationParms ::= SEQUENCE {
seed BIT STRING,
pgenCounter INTEGER }
ValidationParms ::= SEQUENCE {
seed BIT STRING,
pgenCounter INTEGER }
id-dsa OBJECT IDENTIFIER ::= {
iso(1) member-body(2) us(840) x9-57(10040) x9algorithm(4) 1 }
id-dsa OBJECT IDENTIFIER ::= {
iso(1) member-body(2) us(840) x9-57(10040) x9algorithm(4) 1 }
Dss-Parms ::= SEQUENCE {
p INTEGER,
q INTEGER,
g INTEGER }
Dss-Parms ::= SEQUENCE {
p INTEGER,
q INTEGER,
g INTEGER }
-- x400 address syntax starts here
-- OR Names
-- x400 address syntax starts here
-- OR Names
ORAddress ::= SEQUENCE {
built-in-standard-attributes BuiltInStandardAttributes,
built-in-domain-defined-attributes
BuiltInDomainDefinedAttributes OPTIONAL,
-- see also teletex-domain-defined-attributes
extension-attributes ExtensionAttributes OPTIONAL }
-- The OR-address is semantically absent from the OR-name if the
-- built-in-standard-attribute sequence is empty and the
-- built-in-domain-defined-attributes and extension-attributes are
-- both omitted.
ORAddress ::= SEQUENCE {
built-in-standard-attributes BuiltInStandardAttributes,
built-in-domain-defined-attributes
BuiltInDomainDefinedAttributes OPTIONAL,
-- see also teletex-domain-defined-attributes
extension-attributes ExtensionAttributes OPTIONAL }
-- The OR-address is semantically absent from the OR-name if the
-- built-in-standard-attribute sequence is empty and the
-- built-in-domain-defined-attributes and extension-attributes are
-- both omitted.
-- Built-in Standard Attributes
--内置标准属性
BuiltInStandardAttributes ::= SEQUENCE {
country-name CountryName OPTIONAL,
administration-domain-name AdministrationDomainName OPTIONAL,
network-address [0] NetworkAddress OPTIONAL,
-- see also extended-network-address
terminal-identifier [1] TerminalIdentifier OPTIONAL,
private-domain-name [2] PrivateDomainName OPTIONAL,
organization-name [3] OrganizationName OPTIONAL,
-- see also teletex-organization-name
numeric-user-identifier [4] NumericUserIdentifier OPTIONAL,
personal-name [5] PersonalName OPTIONAL,
-- see also teletex-personal-name
organizational-unit-names [6] OrganizationalUnitNames OPTIONAL
-- see also teletex-organizational-unit-names -- }
BuiltInStandardAttributes ::= SEQUENCE {
country-name CountryName OPTIONAL,
administration-domain-name AdministrationDomainName OPTIONAL,
network-address [0] NetworkAddress OPTIONAL,
-- see also extended-network-address
terminal-identifier [1] TerminalIdentifier OPTIONAL,
private-domain-name [2] PrivateDomainName OPTIONAL,
organization-name [3] OrganizationName OPTIONAL,
-- see also teletex-organization-name
numeric-user-identifier [4] NumericUserIdentifier OPTIONAL,
personal-name [5] PersonalName OPTIONAL,
-- see also teletex-personal-name
organizational-unit-names [6] OrganizationalUnitNames OPTIONAL
-- see also teletex-organizational-unit-names -- }
CountryName ::= [APPLICATION 1] CHOICE {
x121-dcc-code NumericString
(SIZE (ub-country-name-numeric-length)),
iso-3166-alpha2-code PrintableString
(SIZE (ub-country-name-alpha-length)) }
CountryName ::= [APPLICATION 1] CHOICE {
x121-dcc-code NumericString
(SIZE (ub-country-name-numeric-length)),
iso-3166-alpha2-code PrintableString
(SIZE (ub-country-name-alpha-length)) }
AdministrationDomainName ::= [APPLICATION 2] CHOICE {
numeric NumericString (SIZE (0..ub-domain-name-length)),
printable PrintableString (SIZE (0..ub-domain-name-length)) }
AdministrationDomainName ::= [APPLICATION 2] CHOICE {
numeric NumericString (SIZE (0..ub-domain-name-length)),
printable PrintableString (SIZE (0..ub-domain-name-length)) }
NetworkAddress ::= X121Address -- see also extended-network-address
NetworkAddress ::= X121Address -- see also extended-network-address
X121Address ::= NumericString (SIZE (1..ub-x121-address-length))
X121Address ::= NumericString (SIZE (1..ub-x121-address-length))
TerminalIdentifier ::= PrintableString (SIZE (1..ub-terminal-id-length))
TerminalIdentifier ::= PrintableString (SIZE (1..ub-terminal-id-length))
PrivateDomainName ::= CHOICE {
PrivateDomainName ::= CHOICE {
numeric NumericString (SIZE (1..ub-domain-name-length)), printable PrintableString (SIZE (1..ub-domain-name-length)) }
数值字符串（大小（1..ub域名长度）），可打印可打印字符串（大小（1..ub域名长度））}
OrganizationName ::= PrintableString
(SIZE (1..ub-organization-name-length))
-- see also teletex-organization-name
OrganizationName ::= PrintableString
(SIZE (1..ub-organization-name-length))
-- see also teletex-organization-name
NumericUserIdentifier ::= NumericString
(SIZE (1..ub-numeric-user-id-length))
NumericUserIdentifier ::= NumericString
(SIZE (1..ub-numeric-user-id-length))
PersonalName ::= SET {
surname [0] PrintableString (SIZE (1..ub-surname-length)),
given-name [1] PrintableString
(SIZE (1..ub-given-name-length)) OPTIONAL,
initials [2] PrintableString (SIZE (1..ub-initials-length)) OPTIONAL,
generation-qualifier [3] PrintableString
(SIZE (1..ub-generation-qualifier-length)) OPTIONAL }
-- see also teletex-personal-name
PersonalName ::= SET {
surname [0] PrintableString (SIZE (1..ub-surname-length)),
given-name [1] PrintableString
(SIZE (1..ub-given-name-length)) OPTIONAL,
initials [2] PrintableString (SIZE (1..ub-initials-length)) OPTIONAL,
generation-qualifier [3] PrintableString
(SIZE (1..ub-generation-qualifier-length)) OPTIONAL }
-- see also teletex-personal-name
OrganizationalUnitNames ::= SEQUENCE SIZE (1..ub-organizational-units)
OF OrganizationalUnitName
-- see also teletex-organizational-unit-names
OrganizationalUnitNames ::= SEQUENCE SIZE (1..ub-organizational-units)
OF OrganizationalUnitName
-- see also teletex-organizational-unit-names
OrganizationalUnitName ::= PrintableString (SIZE
(1..ub-organizational-unit-name-length))
OrganizationalUnitName ::= PrintableString (SIZE
(1..ub-organizational-unit-name-length))
-- Built-in Domain-defined Attributes
--内置域定义属性
BuiltInDomainDefinedAttributes ::= SEQUENCE SIZE
(1..ub-domain-defined-attributes) OF
BuiltInDomainDefinedAttribute
BuiltInDomainDefinedAttributes ::= SEQUENCE SIZE
(1..ub-domain-defined-attributes) OF
BuiltInDomainDefinedAttribute
BuiltInDomainDefinedAttribute ::= SEQUENCE {
type PrintableString (SIZE
(1..ub-domain-defined-attribute-type-length)),
value PrintableString (SIZE
(1..ub-domain-defined-attribute-value-length))}
BuiltInDomainDefinedAttribute ::= SEQUENCE {
type PrintableString (SIZE
(1..ub-domain-defined-attribute-type-length)),
value PrintableString (SIZE
(1..ub-domain-defined-attribute-value-length))}
-- Extension Attributes
--扩展属性
ExtensionAttributes ::= SET SIZE (1..ub-extension-attributes) OF
ExtensionAttribute
ExtensionAttributes ::= SET SIZE (1..ub-extension-attributes) OF
ExtensionAttribute
ExtensionAttribute ::= SEQUENCE {
extension-attribute-type [0] INTEGER (0..ub-extension-attributes),
extension-attribute-value [1]
ANY DEFINED BY extension-attribute-type }
ExtensionAttribute ::= SEQUENCE {
extension-attribute-type [0] INTEGER (0..ub-extension-attributes),
extension-attribute-value [1]
ANY DEFINED BY extension-attribute-type }
-- Extension types and attribute values --
--扩展类型和属性值--
common-name INTEGER ::= 1
common-name INTEGER ::= 1
CommonName ::= PrintableString (SIZE (1..ub-common-name-length))
CommonName ::= PrintableString (SIZE (1..ub-common-name-length))
teletex-common-name INTEGER ::= 2
teletex-common-name INTEGER ::= 2
TeletexCommonName ::= TeletexString (SIZE (1..ub-common-name-length))
TeletexCommonName ::= TeletexString (SIZE (1..ub-common-name-length))
teletex-organization-name INTEGER ::= 3
teletex-organization-name INTEGER ::= 3
TeletexOrganizationName ::=
TeletexString (SIZE (1..ub-organization-name-length))
TeletexOrganizationName ::=
TeletexString (SIZE (1..ub-organization-name-length))
teletex-personal-name INTEGER ::= 4
teletex-personal-name INTEGER ::= 4
TeletexPersonalName ::= SET {
surname [0] TeletexString (SIZE (1..ub-surname-length)),
given-name [1] TeletexString
(SIZE (1..ub-given-name-length)) OPTIONAL,
initials [2] TeletexString (SIZE (1..ub-initials-length)) OPTIONAL,
generation-qualifier [3] TeletexString (SIZE
(1..ub-generation-qualifier-length)) OPTIONAL }
TeletexPersonalName ::= SET {
surname [0] TeletexString (SIZE (1..ub-surname-length)),
given-name [1] TeletexString
(SIZE (1..ub-given-name-length)) OPTIONAL,
initials [2] TeletexString (SIZE (1..ub-initials-length)) OPTIONAL,
generation-qualifier [3] TeletexString (SIZE
(1..ub-generation-qualifier-length)) OPTIONAL }
teletex-organizational-unit-names INTEGER ::= 5
teletex-organizational-unit-names INTEGER ::= 5
TeletexOrganizationalUnitNames ::= SEQUENCE SIZE
(1..ub-organizational-units) OF TeletexOrganizationalUnitName
TeletexOrganizationalUnitNames ::= SEQUENCE SIZE
(1..ub-organizational-units) OF TeletexOrganizationalUnitName
TeletexOrganizationalUnitName ::= TeletexString
(SIZE (1..ub-organizational-unit-name-length))
TeletexOrganizationalUnitName ::= TeletexString
(SIZE (1..ub-organizational-unit-name-length))
pds-name INTEGER ::= 7
pds-name INTEGER ::= 7
PDSName ::= PrintableString (SIZE (1..ub-pds-name-length))
PDSName ::= PrintableString (SIZE (1..ub-pds-name-length))
physical-delivery-country-name INTEGER ::= 8
physical-delivery-country-name INTEGER ::= 8
PhysicalDeliveryCountryName ::= CHOICE {
x121-dcc-code NumericString (SIZE (ub-country-name-numeric-length)),
iso-3166-alpha2-code PrintableString
(SIZE (ub-country-name-alpha-length)) }
PhysicalDeliveryCountryName ::= CHOICE {
x121-dcc-code NumericString (SIZE (ub-country-name-numeric-length)),
iso-3166-alpha2-code PrintableString
(SIZE (ub-country-name-alpha-length)) }
postal-code INTEGER ::= 9
postal-code INTEGER ::= 9
PostalCode ::= CHOICE {
PostalCode ::= CHOICE {
numeric-code NumericString (SIZE (1..ub-postal-code-length)), printable-code PrintableString (SIZE (1..ub-postal-code-length)) }
数字代码NumericString（大小（1..ub邮政编码长度）），可打印代码PrintableString（大小（1..ub邮政编码长度））}
physical-delivery-office-name INTEGER ::= 10
physical-delivery-office-name INTEGER ::= 10
PhysicalDeliveryOfficeName ::= PDSParameter
PhysicalDeliveryOfficeName ::= PDSParameter
physical-delivery-office-number INTEGER ::= 11
physical-delivery-office-number INTEGER ::= 11
PhysicalDeliveryOfficeNumber ::= PDSParameter
PhysicalDeliveryOfficeNumber ::= PDSParameter
extension-OR-address-components INTEGER ::= 12
extension-OR-address-components INTEGER ::= 12
ExtensionORAddressComponents ::= PDSParameter
ExtensionORAddressComponents ::= PDSParameter
physical-delivery-personal-name INTEGER ::= 13
physical-delivery-personal-name INTEGER ::= 13
PhysicalDeliveryPersonalName ::= PDSParameter
PhysicalDeliveryPersonalName ::= PDSParameter
physical-delivery-organization-name INTEGER ::= 14
physical-delivery-organization-name INTEGER ::= 14
PhysicalDeliveryOrganizationName ::= PDSParameter
PhysicalDeliveryOrganizationName ::= PDSParameter
extension-physical-delivery-address-components INTEGER ::= 15
extension-physical-delivery-address-components INTEGER ::= 15
ExtensionPhysicalDeliveryAddressComponents ::= PDSParameter
ExtensionPhysicalDeliveryAddressComponents ::= PDSParameter
unformatted-postal-address INTEGER ::= 16
unformatted-postal-address INTEGER ::= 16
UnformattedPostalAddress ::= SET {
printable-address SEQUENCE SIZE (1..ub-pds-physical-address-lines) OF
PrintableString (SIZE (1..ub-pds-parameter-length)) OPTIONAL,
teletex-string TeletexString
(SIZE (1..ub-unformatted-address-length)) OPTIONAL }
UnformattedPostalAddress ::= SET {
printable-address SEQUENCE SIZE (1..ub-pds-physical-address-lines) OF
PrintableString (SIZE (1..ub-pds-parameter-length)) OPTIONAL,
teletex-string TeletexString
(SIZE (1..ub-unformatted-address-length)) OPTIONAL }
street-address INTEGER ::= 17
street-address INTEGER ::= 17
StreetAddress ::= PDSParameter
StreetAddress ::= PDSParameter
post-office-box-address INTEGER ::= 18
post-office-box-address INTEGER ::= 18
PostOfficeBoxAddress ::= PDSParameter
PostOfficeBoxAddress ::= PDSParameter
poste-restante-address INTEGER ::= 19
poste-restante-address INTEGER ::= 19
PosteRestanteAddress ::= PDSParameter
PosteRestanteAddress ::= PDSParameter
unique-postal-name INTEGER ::= 20
unique-postal-name INTEGER ::= 20
UniquePostalName ::= PDSParameter
UniquePostalName ::= PDSParameter
local-postal-attributes INTEGER ::= 21
local-postal-attributes INTEGER ::= 21
LocalPostalAttributes ::= PDSParameter
LocalPostalAttributes ::= PDSParameter
PDSParameter ::= SET {
printable-string PrintableString
(SIZE(1..ub-pds-parameter-length)) OPTIONAL,
teletex-string TeletexString
(SIZE(1..ub-pds-parameter-length)) OPTIONAL }
PDSParameter ::= SET {
printable-string PrintableString
(SIZE(1..ub-pds-parameter-length)) OPTIONAL,
teletex-string TeletexString
(SIZE(1..ub-pds-parameter-length)) OPTIONAL }
extended-network-address INTEGER ::= 22
extended-network-address INTEGER ::= 22
ExtendedNetworkAddress ::= CHOICE {
e163-4-address SEQUENCE {
number [0] NumericString (SIZE (1..ub-e163-4-number-length)),
sub-address [1] NumericString
(SIZE (1..ub-e163-4-sub-address-length)) OPTIONAL },
psap-address [0] PresentationAddress }
ExtendedNetworkAddress ::= CHOICE {
e163-4-address SEQUENCE {
number [0] NumericString (SIZE (1..ub-e163-4-number-length)),
sub-address [1] NumericString
(SIZE (1..ub-e163-4-sub-address-length)) OPTIONAL },
psap-address [0] PresentationAddress }
PresentationAddress ::= SEQUENCE {
pSelector [0] EXPLICIT OCTET STRING OPTIONAL,
sSelector [1] EXPLICIT OCTET STRING OPTIONAL,
tSelector [2] EXPLICIT OCTET STRING OPTIONAL,
nAddresses [3] EXPLICIT SET SIZE (1..MAX) OF OCTET STRING }
PresentationAddress ::= SEQUENCE {
pSelector [0] EXPLICIT OCTET STRING OPTIONAL,
sSelector [1] EXPLICIT OCTET STRING OPTIONAL,
tSelector [2] EXPLICIT OCTET STRING OPTIONAL,
nAddresses [3] EXPLICIT SET SIZE (1..MAX) OF OCTET STRING }
terminal-type INTEGER ::= 23
terminal-type INTEGER ::= 23
TerminalType ::= INTEGER {
telex (3),
teletex (4),
g3-facsimile (5),
g4-facsimile (6),
ia5-terminal (7),
videotex (8) } (0..ub-integer-options)
TerminalType ::= INTEGER {
telex (3),
teletex (4),
g3-facsimile (5),
g4-facsimile (6),
ia5-terminal (7),
videotex (8) } (0..ub-integer-options)
-- Extension Domain-defined Attributes
--扩展域定义的属性
teletex-domain-defined-attributes INTEGER ::= 6
teletex-domain-defined-attributes INTEGER ::= 6
TeletexDomainDefinedAttributes ::= SEQUENCE SIZE
(1..ub-domain-defined-attributes) OF TeletexDomainDefinedAttribute
TeletexDomainDefinedAttributes ::= SEQUENCE SIZE
(1..ub-domain-defined-attributes) OF TeletexDomainDefinedAttribute
TeletexDomainDefinedAttribute ::= SEQUENCE {
type TeletexString
(SIZE (1..ub-domain-defined-attribute-type-length)),
value TeletexString
TeletexDomainDefinedAttribute ::= SEQUENCE {
type TeletexString
(SIZE (1..ub-domain-defined-attribute-type-length)),
value TeletexString
(SIZE (1..ub-domain-defined-attribute-value-length)) }
（大小（1..ub域定义的属性值长度））}
-- specifications of Upper Bounds shall be regarded as mandatory
-- from Annex B of ITU-T X.411 Reference Definition of MTS Parameter
-- Upper Bounds
-- specifications of Upper Bounds shall be regarded as mandatory
-- from Annex B of ITU-T X.411 Reference Definition of MTS Parameter
-- Upper Bounds
-- Upper Bounds
ub-name INTEGER ::= 32768
ub-common-name INTEGER ::= 64
ub-locality-name INTEGER ::= 128
ub-state-name INTEGER ::= 128
ub-organization-name INTEGER ::= 64
ub-organizational-unit-name INTEGER ::= 64
ub-title INTEGER ::= 64
ub-match INTEGER ::= 128
-- Upper Bounds
ub-name INTEGER ::= 32768
ub-common-name INTEGER ::= 64
ub-locality-name INTEGER ::= 128
ub-state-name INTEGER ::= 128
ub-organization-name INTEGER ::= 64
ub-organizational-unit-name INTEGER ::= 64
ub-title INTEGER ::= 64
ub-match INTEGER ::= 128
ub-emailaddress-length INTEGER ::= 128
ub-emailaddress-length INTEGER ::= 128
ub-common-name-length INTEGER ::= 64
ub-country-name-alpha-length INTEGER ::= 2
ub-country-name-numeric-length INTEGER ::= 3
ub-domain-defined-attributes INTEGER ::= 4
ub-domain-defined-attribute-type-length INTEGER ::= 8
ub-domain-defined-attribute-value-length INTEGER ::= 128
ub-domain-name-length INTEGER ::= 16
ub-extension-attributes INTEGER ::= 256
ub-e163-4-number-length INTEGER ::= 15
ub-e163-4-sub-address-length INTEGER ::= 40
ub-generation-qualifier-length INTEGER ::= 3
ub-given-name-length INTEGER ::= 16
ub-initials-length INTEGER ::= 5
ub-integer-options INTEGER ::= 256
ub-numeric-user-id-length INTEGER ::= 32
ub-organization-name-length INTEGER ::= 64
ub-organizational-unit-name-length INTEGER ::= 32
ub-organizational-units INTEGER ::= 4
ub-pds-name-length INTEGER ::= 16
ub-pds-parameter-length INTEGER ::= 30
ub-pds-physical-address-lines INTEGER ::= 6
ub-postal-code-length INTEGER ::= 16
ub-surname-length INTEGER ::= 40
ub-terminal-id-length INTEGER ::= 24
ub-unformatted-address-length INTEGER ::= 180
ub-x121-address-length INTEGER ::= 16
ub-common-name-length INTEGER ::= 64
ub-country-name-alpha-length INTEGER ::= 2
ub-country-name-numeric-length INTEGER ::= 3
ub-domain-defined-attributes INTEGER ::= 4
ub-domain-defined-attribute-type-length INTEGER ::= 8
ub-domain-defined-attribute-value-length INTEGER ::= 128
ub-domain-name-length INTEGER ::= 16
ub-extension-attributes INTEGER ::= 256
ub-e163-4-number-length INTEGER ::= 15
ub-e163-4-sub-address-length INTEGER ::= 40
ub-generation-qualifier-length INTEGER ::= 3
ub-given-name-length INTEGER ::= 16
ub-initials-length INTEGER ::= 5
ub-integer-options INTEGER ::= 256
ub-numeric-user-id-length INTEGER ::= 32
ub-organization-name-length INTEGER ::= 64
ub-organizational-unit-name-length INTEGER ::= 32
ub-organizational-units INTEGER ::= 4
ub-pds-name-length INTEGER ::= 16
ub-pds-parameter-length INTEGER ::= 30
ub-pds-physical-address-lines INTEGER ::= 6
ub-postal-code-length INTEGER ::= 16
ub-surname-length INTEGER ::= 40
ub-terminal-id-length INTEGER ::= 24
ub-unformatted-address-length INTEGER ::= 180
ub-x121-address-length INTEGER ::= 16
-- Note - upper bounds on string types, such as TeletexString, are
-- measured in characters. Excepting PrintableString or IA5String, a
-- significantly greater number of octets will be required to hold
-- Note - upper bounds on string types, such as TeletexString, are
-- measured in characters. Excepting PrintableString or IA5String, a
-- significantly greater number of octets will be required to hold
-- such a value. As a minimum, 16 octets, or twice the specified upper
-- bound, whichever is the larger, should be allowed for TeletexString.
-- For UTF8String or UniversalString at least four times the upper
-- bound should be allowed.
-- such a value. As a minimum, 16 octets, or twice the specified upper
-- bound, whichever is the larger, should be allowed for TeletexString.
-- For UTF8String or UniversalString at least four times the upper
-- bound should be allowed.
END
终止
PKIX1Implicit88 {iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0) id-pkix1-implicit-88(2)}
PKIX1Implicit88 {iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0) id-pkix1-implicit-88(2)}
DEFINITIONS IMPLICIT TAGS ::=
DEFINITIONS IMPLICIT TAGS ::=
BEGIN
开始
-- EXPORTS ALL --
--全部出口--
IMPORTS
id-pkix, id-pe, id-qt, id-kp, id-qt-unotice, id-qt-cps,
id-ad, id-ad-ocsp, id-ad-caIssuers,
-- delete following line if "new" types are supported --
BMPString, UniversalString, UTF8String, -- end "new" types
ORAddress, Name, RelativeDistinguishedName,
CertificateSerialNumber,
CertificateList, AlgorithmIdentifier, ub-name,
Attribute, DirectoryString
FROM PKIX1Explicit88 {iso(1) identified-organization(3)
dod(6) internet(1) security(5) mechanisms(5) pkix(7)
id-mod(0) id-pkix1-explicit(1)};
IMPORTS
id-pkix, id-pe, id-qt, id-kp, id-qt-unotice, id-qt-cps,
id-ad, id-ad-ocsp, id-ad-caIssuers,
-- delete following line if "new" types are supported --
BMPString, UniversalString, UTF8String, -- end "new" types
ORAddress, Name, RelativeDistinguishedName,
CertificateSerialNumber,
CertificateList, AlgorithmIdentifier, ub-name,
Attribute, DirectoryString
FROM PKIX1Explicit88 {iso(1) identified-organization(3)
dod(6) internet(1) security(5) mechanisms(5) pkix(7)
id-mod(0) id-pkix1-explicit(1)};
-- ISO arc for standard certificate and CRL extensions
--标准证书和CRL扩展的ISO arc
id-ce OBJECT IDENTIFIER ::= {joint-iso-ccitt(2) ds(5) 29}
id-ce OBJECT IDENTIFIER ::= {joint-iso-ccitt(2) ds(5) 29}
-- authority key identifier OID and syntax
--授权密钥标识符OID和语法
id-ce-authorityKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 35 }
id-ce-authorityKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 35 }
AuthorityKeyIdentifier ::= SEQUENCE {
keyIdentifier [0] KeyIdentifier OPTIONAL,
authorityCertIssuer [1] GeneralNames OPTIONAL,
authorityCertSerialNumber [2] CertificateSerialNumber OPTIONAL }
-- authorityCertIssuer and authorityCertSerialNumber shall both
-- be present or both be absent
AuthorityKeyIdentifier ::= SEQUENCE {
keyIdentifier [0] KeyIdentifier OPTIONAL,
authorityCertIssuer [1] GeneralNames OPTIONAL,
authorityCertSerialNumber [2] CertificateSerialNumber OPTIONAL }
-- authorityCertIssuer and authorityCertSerialNumber shall both
-- be present or both be absent
KeyIdentifier ::= OCTET STRING
KeyIdentifier ::= OCTET STRING
-- subject key identifier OID and syntax
--主题键标识符OID和语法
id-ce-subjectKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 14 }
id-ce-subjectKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 14 }
SubjectKeyIdentifier ::= KeyIdentifier
SubjectKeyIdentifier ::= KeyIdentifier
-- key usage extension OID and syntax
--密钥使用扩展OID和语法
id-ce-keyUsage OBJECT IDENTIFIER ::= { id-ce 15 }
id-ce-keyUsage OBJECT IDENTIFIER ::= { id-ce 15 }
KeyUsage ::= BIT STRING {
digitalSignature (0),
nonRepudiation (1),
keyEncipherment (2),
dataEncipherment (3),
keyAgreement (4),
keyCertSign (5),
cRLSign (6),
encipherOnly (7),
decipherOnly (8) }
KeyUsage ::= BIT STRING {
digitalSignature (0),
nonRepudiation (1),
keyEncipherment (2),
dataEncipherment (3),
keyAgreement (4),
keyCertSign (5),
cRLSign (6),
encipherOnly (7),
decipherOnly (8) }
-- private key usage period extension OID and syntax
--私钥使用期限扩展OID和语法
id-ce-privateKeyUsagePeriod OBJECT IDENTIFIER ::= { id-ce 16 }
id-ce-privateKeyUsagePeriod OBJECT IDENTIFIER ::= { id-ce 16 }
PrivateKeyUsagePeriod ::= SEQUENCE {
notBefore [0] GeneralizedTime OPTIONAL,
notAfter [1] GeneralizedTime OPTIONAL }
-- either notBefore or notAfter shall be present
PrivateKeyUsagePeriod ::= SEQUENCE {
notBefore [0] GeneralizedTime OPTIONAL,
notAfter [1] GeneralizedTime OPTIONAL }
-- either notBefore or notAfter shall be present
-- certificate policies extension OID and syntax
--证书策略扩展OID和语法
id-ce-certificatePolicies OBJECT IDENTIFIER ::= { id-ce 32 }
id-ce-certificatePolicies OBJECT IDENTIFIER ::= { id-ce 32 }
CertificatePolicies ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation
CertificatePolicies ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation
PolicyInformation ::= SEQUENCE {
policyIdentifier CertPolicyId,
policyQualifiers SEQUENCE SIZE (1..MAX) OF
PolicyQualifierInfo OPTIONAL }
PolicyInformation ::= SEQUENCE {
policyIdentifier CertPolicyId,
policyQualifiers SEQUENCE SIZE (1..MAX) OF
PolicyQualifierInfo OPTIONAL }
CertPolicyId ::= OBJECT IDENTIFIER
CertPolicyId ::= OBJECT IDENTIFIER
PolicyQualifierInfo ::= SEQUENCE {
policyQualifierId PolicyQualifierId,
qualifier ANY DEFINED BY policyQualifierId }
PolicyQualifierInfo ::= SEQUENCE {
policyQualifierId PolicyQualifierId,
qualifier ANY DEFINED BY policyQualifierId }
-- Implementations that recognize additional policy qualifiers shall
-- augment the following definition for PolicyQualifierId
-- Implementations that recognize additional policy qualifiers shall
-- augment the following definition for PolicyQualifierId
PolicyQualifierId ::=
OBJECT IDENTIFIER ( id-qt-cps | id-qt-unotice )
PolicyQualifierId ::=
OBJECT IDENTIFIER ( id-qt-cps | id-qt-unotice )
-- CPS pointer qualifier
--指针限定符
CPSuri ::= IA5String
CPSuri ::= IA5String
-- user notice qualifier
--用户通知限定符
UserNotice ::= SEQUENCE {
noticeRef NoticeReference OPTIONAL,
explicitText DisplayText OPTIONAL}
UserNotice ::= SEQUENCE {
noticeRef NoticeReference OPTIONAL,
explicitText DisplayText OPTIONAL}
NoticeReference ::= SEQUENCE {
organization DisplayText,
noticeNumbers SEQUENCE OF INTEGER }
NoticeReference ::= SEQUENCE {
organization DisplayText,
noticeNumbers SEQUENCE OF INTEGER }
DisplayText ::= CHOICE {
visibleString VisibleString (SIZE (1..200)),
bmpString BMPString (SIZE (1..200)),
utf8String UTF8String (SIZE (1..200)) }
DisplayText ::= CHOICE {
visibleString VisibleString (SIZE (1..200)),
bmpString BMPString (SIZE (1..200)),
utf8String UTF8String (SIZE (1..200)) }
-- policy mapping extension OID and syntax
--策略映射扩展OID和语法
id-ce-policyMappings OBJECT IDENTIFIER ::= { id-ce 33 }
id-ce-policyMappings OBJECT IDENTIFIER ::= { id-ce 33 }
PolicyMappings ::= SEQUENCE SIZE (1..MAX) OF SEQUENCE {
issuerDomainPolicy CertPolicyId,
subjectDomainPolicy CertPolicyId }
PolicyMappings ::= SEQUENCE SIZE (1..MAX) OF SEQUENCE {
issuerDomainPolicy CertPolicyId,
subjectDomainPolicy CertPolicyId }
-- subject alternative name extension OID and syntax
--主题可选名称扩展OID和语法
id-ce-subjectAltName OBJECT IDENTIFIER ::= { id-ce 17 }
id-ce-subjectAltName OBJECT IDENTIFIER ::= { id-ce 17 }
SubjectAltName ::= GeneralNames
SubjectAltName ::= GeneralNames
GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
GeneralName ::= CHOICE {
otherName [0] AnotherName,
rfc822Name [1] IA5String,
dNSName [2] IA5String,
x400Address [3] ORAddress,
directoryName [4] Name,
ediPartyName [5] EDIPartyName,
uniformResourceIdentifier [6] IA5String,
iPAddress [7] OCTET STRING,
registeredID [8] OBJECT IDENTIFIER }
GeneralName ::= CHOICE {
otherName [0] AnotherName,
rfc822Name [1] IA5String,
dNSName [2] IA5String,
x400Address [3] ORAddress,
directoryName [4] Name,
ediPartyName [5] EDIPartyName,
uniformResourceIdentifier [6] IA5String,
iPAddress [7] OCTET STRING,
registeredID [8] OBJECT IDENTIFIER }
-- AnotherName replaces OTHER-NAME ::= TYPE-IDENTIFIER, as
-- TYPE-IDENTIFIER is not supported in the '88 ASN.1 syntax
-- AnotherName replaces OTHER-NAME ::= TYPE-IDENTIFIER, as
-- TYPE-IDENTIFIER is not supported in the '88 ASN.1 syntax
AnotherName ::= SEQUENCE {
AnotherName ::= SEQUENCE {
type-id OBJECT IDENTIFIER, value [0] EXPLICIT ANY DEFINED BY type-id }
类型id对象标识符，值[0]由类型id定义的任何显式值}
EDIPartyName ::= SEQUENCE {
nameAssigner [0] DirectoryString OPTIONAL,
partyName [1] DirectoryString }
EDIPartyName ::= SEQUENCE {
nameAssigner [0] DirectoryString OPTIONAL,
partyName [1] DirectoryString }
-- issuer alternative name extension OID and syntax
--发卡机构替代名称扩展OID和语法
id-ce-issuerAltName OBJECT IDENTIFIER ::= { id-ce 18 }
id-ce-issuerAltName OBJECT IDENTIFIER ::= { id-ce 18 }
IssuerAltName ::= GeneralNames
IssuerAltName ::= GeneralNames
id-ce-subjectDirectoryAttributes OBJECT IDENTIFIER ::= { id-ce 9 }
id-ce-subjectDirectoryAttributes OBJECT IDENTIFIER ::= { id-ce 9 }
SubjectDirectoryAttributes ::= SEQUENCE SIZE (1..MAX) OF Attribute
SubjectDirectoryAttributes ::= SEQUENCE SIZE (1..MAX) OF Attribute
-- basic constraints extension OID and syntax
--基本约束扩展OID和语法
id-ce-basicConstraints OBJECT IDENTIFIER ::= { id-ce 19 }
id-ce-basicConstraints OBJECT IDENTIFIER ::= { id-ce 19 }
BasicConstraints ::= SEQUENCE {
cA BOOLEAN DEFAULT FALSE,
pathLenConstraint INTEGER (0..MAX) OPTIONAL }
BasicConstraints ::= SEQUENCE {
cA BOOLEAN DEFAULT FALSE,
pathLenConstraint INTEGER (0..MAX) OPTIONAL }
-- name constraints extension OID and syntax
--名称约束扩展OID和语法
id-ce-nameConstraints OBJECT IDENTIFIER ::= { id-ce 30 }
id-ce-nameConstraints OBJECT IDENTIFIER ::= { id-ce 30 }
NameConstraints ::= SEQUENCE {
permittedSubtrees [0] GeneralSubtrees OPTIONAL,
excludedSubtrees [1] GeneralSubtrees OPTIONAL }
NameConstraints ::= SEQUENCE {
permittedSubtrees [0] GeneralSubtrees OPTIONAL,
excludedSubtrees [1] GeneralSubtrees OPTIONAL }
GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
GeneralSubtree ::= SEQUENCE {
base GeneralName,
minimum [0] BaseDistance DEFAULT 0,
maximum [1] BaseDistance OPTIONAL }
GeneralSubtree ::= SEQUENCE {
base GeneralName,
minimum [0] BaseDistance DEFAULT 0,
maximum [1] BaseDistance OPTIONAL }
BaseDistance ::= INTEGER (0..MAX)
BaseDistance ::= INTEGER (0..MAX)
-- policy constraints extension OID and syntax
--策略约束扩展OID和语法
id-ce-policyConstraints OBJECT IDENTIFIER ::= { id-ce 36 }
id-ce-policyConstraints OBJECT IDENTIFIER ::= { id-ce 36 }
PolicyConstraints ::= SEQUENCE {
requireExplicitPolicy [0] SkipCerts OPTIONAL,
PolicyConstraints ::= SEQUENCE {
requireExplicitPolicy [0] SkipCerts OPTIONAL,
inhibitPolicyMapping [1] SkipCerts OPTIONAL }
禁止策略映射[1]SkipCerts可选}
SkipCerts ::= INTEGER (0..MAX)
SkipCerts ::= INTEGER (0..MAX)
-- CRL distribution points extension OID and syntax
--CRL分发点扩展OID和语法
id-ce-cRLDistributionPoints OBJECT IDENTIFIER ::= {id-ce 31}
id-ce-cRLDistributionPoints OBJECT IDENTIFIER ::= {id-ce 31}
CRLDistPointsSyntax ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint
CRLDistPointsSyntax ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint
DistributionPoint ::= SEQUENCE {
distributionPoint [0] DistributionPointName OPTIONAL,
reasons [1] ReasonFlags OPTIONAL,
cRLIssuer [2] GeneralNames OPTIONAL }
DistributionPoint ::= SEQUENCE {
distributionPoint [0] DistributionPointName OPTIONAL,
reasons [1] ReasonFlags OPTIONAL,
cRLIssuer [2] GeneralNames OPTIONAL }
DistributionPointName ::= CHOICE {
fullName [0] GeneralNames,
nameRelativeToCRLIssuer [1] RelativeDistinguishedName }
DistributionPointName ::= CHOICE {
fullName [0] GeneralNames,
nameRelativeToCRLIssuer [1] RelativeDistinguishedName }
ReasonFlags ::= BIT STRING {
unused (0),
keyCompromise (1),
cACompromise (2),
affiliationChanged (3),
superseded (4),
cessationOfOperation (5),
certificateHold (6) }
ReasonFlags ::= BIT STRING {
unused (0),
keyCompromise (1),
cACompromise (2),
affiliationChanged (3),
superseded (4),
cessationOfOperation (5),
certificateHold (6) }
-- extended key usage extension OID and syntax
--扩展密钥用法扩展OID和语法
id-ce-extKeyUsage OBJECT IDENTIFIER ::= {id-ce 37}
id-ce-extKeyUsage OBJECT IDENTIFIER ::= {id-ce 37}
ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId
ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId
KeyPurposeId ::= OBJECT IDENTIFIER
KeyPurposeId ::= OBJECT IDENTIFIER
-- extended key purpose OIDs
id-kp-serverAuth OBJECT IDENTIFIER ::= { id-kp 1 }
id-kp-clientAuth OBJECT IDENTIFIER ::= { id-kp 2 }
id-kp-codeSigning OBJECT IDENTIFIER ::= { id-kp 3 }
id-kp-emailProtection OBJECT IDENTIFIER ::= { id-kp 4 }
id-kp-ipsecEndSystem OBJECT IDENTIFIER ::= { id-kp 5 }
id-kp-ipsecTunnel OBJECT IDENTIFIER ::= { id-kp 6 }
id-kp-ipsecUser OBJECT IDENTIFIER ::= { id-kp 7 }
id-kp-timeStamping OBJECT IDENTIFIER ::= { id-kp 8 }
-- extended key purpose OIDs
id-kp-serverAuth OBJECT IDENTIFIER ::= { id-kp 1 }
id-kp-clientAuth OBJECT IDENTIFIER ::= { id-kp 2 }
id-kp-codeSigning OBJECT IDENTIFIER ::= { id-kp 3 }
id-kp-emailProtection OBJECT IDENTIFIER ::= { id-kp 4 }
id-kp-ipsecEndSystem OBJECT IDENTIFIER ::= { id-kp 5 }
id-kp-ipsecTunnel OBJECT IDENTIFIER ::= { id-kp 6 }
id-kp-ipsecUser OBJECT IDENTIFIER ::= { id-kp 7 }
id-kp-timeStamping OBJECT IDENTIFIER ::= { id-kp 8 }
-- authority info access
--权限信息访问
id-pe-authorityInfoAccess OBJECT IDENTIFIER ::= { id-pe 1 }
id-pe-authorityInfoAccess OBJECT IDENTIFIER ::= { id-pe 1 }
AuthorityInfoAccessSyntax ::=
SEQUENCE SIZE (1..MAX) OF AccessDescription
AuthorityInfoAccessSyntax ::=
SEQUENCE SIZE (1..MAX) OF AccessDescription
AccessDescription ::= SEQUENCE {
accessMethod OBJECT IDENTIFIER,
accessLocation GeneralName }
AccessDescription ::= SEQUENCE {
accessMethod OBJECT IDENTIFIER,
accessLocation GeneralName }
-- CRL number extension OID and syntax
--CRL数字扩展OID和语法
id-ce-cRLNumber OBJECT IDENTIFIER ::= { id-ce 20 }
id-ce-cRLNumber OBJECT IDENTIFIER ::= { id-ce 20 }
CRLNumber ::= INTEGER (0..MAX)
CRLNumber ::= INTEGER (0..MAX)
-- issuing distribution point extension OID and syntax
--发布分发点扩展OID和语法
id-ce-issuingDistributionPoint OBJECT IDENTIFIER ::= { id-ce 28 }
id-ce-issuingDistributionPoint OBJECT IDENTIFIER ::= { id-ce 28 }
IssuingDistributionPoint ::= SEQUENCE {
distributionPoint [0] DistributionPointName OPTIONAL,
onlyContainsUserCerts [1] BOOLEAN DEFAULT FALSE,
onlyContainsCACerts [2] BOOLEAN DEFAULT FALSE,
onlySomeReasons [3] ReasonFlags OPTIONAL,
indirectCRL [4] BOOLEAN DEFAULT FALSE }
IssuingDistributionPoint ::= SEQUENCE {
distributionPoint [0] DistributionPointName OPTIONAL,
onlyContainsUserCerts [1] BOOLEAN DEFAULT FALSE,
onlyContainsCACerts [2] BOOLEAN DEFAULT FALSE,
onlySomeReasons [3] ReasonFlags OPTIONAL,
indirectCRL [4] BOOLEAN DEFAULT FALSE }
id-ce-deltaCRLIndicator OBJECT IDENTIFIER ::= { id-ce 27 }
id-ce-deltaCRLIndicator OBJECT IDENTIFIER ::= { id-ce 27 }
-- deltaCRLIndicator ::= BaseCRLNumber
-- deltaCRLIndicator ::= BaseCRLNumber
BaseCRLNumber ::= CRLNumber
BaseCRLNumber ::= CRLNumber
-- CRL reasons extension OID and syntax
--CRL原因扩展OID和语法
id-ce-cRLReasons OBJECT IDENTIFIER ::= { id-ce 21 }
id-ce-cRLReasons OBJECT IDENTIFIER ::= { id-ce 21 }
CRLReason ::= ENUMERATED {
unspecified (0),
keyCompromise (1),
cACompromise (2),
affiliationChanged (3),
superseded (4),
cessationOfOperation (5),
certificateHold (6),
removeFromCRL (8) }
CRLReason ::= ENUMERATED {
unspecified (0),
keyCompromise (1),
cACompromise (2),
affiliationChanged (3),
superseded (4),
cessationOfOperation (5),
certificateHold (6),
removeFromCRL (8) }
-- certificate issuer CRL entry extension OID and syntax
--证书颁发者CRL条目扩展OID和语法
id-ce-certificateIssuer OBJECT IDENTIFIER ::= { id-ce 29 }
id-ce-certificateIssuer OBJECT IDENTIFIER ::= { id-ce 29 }
CertificateIssuer ::= GeneralNames
CertificateIssuer ::= GeneralNames
-- hold instruction extension OID and syntax
--hold指令扩展OID和语法
id-ce-holdInstructionCode OBJECT IDENTIFIER ::= { id-ce 23 }
id-ce-holdInstructionCode OBJECT IDENTIFIER ::= { id-ce 23 }
HoldInstructionCode ::= OBJECT IDENTIFIER
HoldInstructionCode ::= OBJECT IDENTIFIER
-- ANSI x9 holdinstructions
--ANSI x9标准说明
-- ANSI x9 arc holdinstruction arc
holdInstruction OBJECT IDENTIFIER ::=
{joint-iso-itu-t(2) member-body(2) us(840) x9cm(10040) 2}
-- ANSI x9 arc holdinstruction arc
holdInstruction OBJECT IDENTIFIER ::=
{joint-iso-itu-t(2) member-body(2) us(840) x9cm(10040) 2}
-- ANSI X9 holdinstructions referenced by this standard
id-holdinstruction-none OBJECT IDENTIFIER ::=
{holdInstruction 1} -- deprecated
id-holdinstruction-callissuer OBJECT IDENTIFIER ::=
{holdInstruction 2}
id-holdinstruction-reject OBJECT IDENTIFIER ::=
{holdInstruction 3}
-- ANSI X9 holdinstructions referenced by this standard
id-holdinstruction-none OBJECT IDENTIFIER ::=
{holdInstruction 1} -- deprecated
id-holdinstruction-callissuer OBJECT IDENTIFIER ::=
{holdInstruction 2}
id-holdinstruction-reject OBJECT IDENTIFIER ::=
{holdInstruction 3}
-- invalidity date CRL entry extension OID and syntax
--无效日期CRL条目扩展OID和语法
id-ce-invalidityDate OBJECT IDENTIFIER ::= { id-ce 24 }
id-ce-invalidityDate OBJECT IDENTIFIER ::= { id-ce 24 }
InvalidityDate ::= GeneralizedTime
InvalidityDate ::= GeneralizedTime
END
终止
PKIX1Explicit93 {iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0) id-pkix1-explicit-93(3)}
PKIX1Explicit93 {iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0) id-pkix1-explicit-93(3)}
DEFINITIONS EXPLICIT TAGS ::=
DEFINITIONS EXPLICIT TAGS ::=
BEGIN
开始
-- EXPORTS ALL --
--全部出口--
IMPORTS authorityKeyIdentifier, subjectKeyIdentifier, keyUsage, extendedKeyUsage, privateKeyUsagePeriod, certificatePolicies, policyMappings, subjectAltName, issuerAltName, basicConstraints, nameConstraints, policyConstraints, cRLDistributionPoints, subjectDirectoryAttributes, cRLNumber, reasonCode, instructionCode, invalidityDate, issuingDistributionPoint, certificateIssuer, deltaCRLIndicator, authorityInfoAccess, id-ce FROM PKIX1Implicit93 {iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) id-mod(0) id-pkix1-implicit-93(4)} ;
导入authorityKeyIdentifier、subjectKeyIdentifier、keyUsage、extendedKeyUsage、privateKeyUsagePeriod、CertificatePolicy、PolicyMapping、subjectAltName、IssueralName、basicConstraints、nameConstraints、policyConstraints、cRLDistributionPoints、SubjectDirectoryAttribute、cRLNumber、reasonCode、instructionCode、invalidityDate、，从pkix1隐式93{iso（1）确定的组织（3）国防部（6）互联网（1）安全（5）机制（5）pkix（7）id mod（0）id-pkix1-implicit-93（4）}发布分发点、证书颁发者、Deltacrindicator、权威信息访问、id ce；
-- -- Locally defined OIDs --
----局部定义的OID--
id-pkix OBJECT IDENTIFIER ::=
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) }
id-pkix OBJECT IDENTIFIER ::=
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) }
-- PKIX arcs
-- arc for private certificate extensions
id-pe OBJECT IDENTIFIER ::= { id-pkix 1 }
-- arc for policy qualifier types
id-qt OBJECT IDENTIFIER ::= { id-pkix 2 }
-- arc for extended key purpose OIDS
id-kp OBJECT IDENTIFIER ::= { id-pkix 3 }
-- arc for access descriptors
id-ad OBJECT IDENTIFIER ::= { id-pkix 48 }
-- PKIX arcs
-- arc for private certificate extensions
id-pe OBJECT IDENTIFIER ::= { id-pkix 1 }
-- arc for policy qualifier types
id-qt OBJECT IDENTIFIER ::= { id-pkix 2 }
-- arc for extended key purpose OIDS
id-kp OBJECT IDENTIFIER ::= { id-pkix 3 }
-- arc for access descriptors
id-ad OBJECT IDENTIFIER ::= { id-pkix 48 }
-- policyQualifierIds for Internet policy qualifiers
id-qt-cps OBJECT IDENTIFIER ::= { id-qt 1 }
-- OID for CPS qualifier
-- policyQualifierIds for Internet policy qualifiers
id-qt-cps OBJECT IDENTIFIER ::= { id-qt 1 }
-- OID for CPS qualifier
id-qt-unotice OBJECT IDENTIFIER ::= { id-qt 2 }
-- OID for user notice qualifier
id-qt-unotice OBJECT IDENTIFIER ::= { id-qt 2 }
-- OID for user notice qualifier
-- based on excerpts from AuthenticationFramework
-- {joint-iso-ccitt ds(5) modules(1) authenticationFramework(7) 2}
-- based on excerpts from AuthenticationFramework
-- {joint-iso-ccitt ds(5) modules(1) authenticationFramework(7) 2}
-- Public Key Certificate --
--公钥证书--
Certificate ::= SIGNED { SEQUENCE {
version [0] Version DEFAULT v1,
serialNumber CertificateSerialNumber,
signature AlgorithmIdentifier,
issuer Name,
validity Validity,
subject Name,
subjectPublicKeyInfo SubjectPublicKeyInfo,
issuerUniqueIdentifier [1] IMPLICIT UniqueIdentifier OPTIONAL,
---if present, version shall be v2 or v3--
subjectUniqueIdentifier [2] IMPLICIT UniqueIdentifier OPTIONAL,
---if present, version shall be v2 or v3--
extensions [3] Extensions OPTIONAL
--if present, version shall be v3--} }
Certificate ::= SIGNED { SEQUENCE {
version [0] Version DEFAULT v1,
serialNumber CertificateSerialNumber,
signature AlgorithmIdentifier,
issuer Name,
validity Validity,
subject Name,
subjectPublicKeyInfo SubjectPublicKeyInfo,
issuerUniqueIdentifier [1] IMPLICIT UniqueIdentifier OPTIONAL,
---if present, version shall be v2 or v3--
subjectUniqueIdentifier [2] IMPLICIT UniqueIdentifier OPTIONAL,
---if present, version shall be v2 or v3--
extensions [3] Extensions OPTIONAL
--if present, version shall be v3--} }
UniqueIdentifier ::= BIT STRING
UniqueIdentifier ::= BIT STRING
Version ::= INTEGER { v1(0), v2(1), v3(2) }
Version ::= INTEGER { v1(0), v2(1), v3(2) }
CertificateSerialNumber ::= INTEGER
CertificateSerialNumber ::= INTEGER
Validity ::= SEQUENCE {
notBefore Time,
notAfter Time }
Validity ::= SEQUENCE {
notBefore Time,
notAfter Time }
Time ::= CHOICE {
utcTime UTCTime,
generalTime GeneralizedTime }
Time ::= CHOICE {
utcTime UTCTime,
generalTime GeneralizedTime }
SubjectPublicKeyInfo ::= SEQUENCE{
algorithm AlgorithmIdentifier,
subjectPublicKey BIT STRING}
SubjectPublicKeyInfo ::= SEQUENCE{
algorithm AlgorithmIdentifier,
subjectPublicKey BIT STRING}
Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
Extension ::= SEQUENCE {
extnId EXTENSION.&id ({ExtensionSet}),
critical BOOLEAN DEFAULT FALSE,
extnValue OCTET STRING }
-- contains a DER encoding of a value of type
Extension ::= SEQUENCE {
extnId EXTENSION.&id ({ExtensionSet}),
critical BOOLEAN DEFAULT FALSE,
extnValue OCTET STRING }
-- contains a DER encoding of a value of type
-- &ExtnType for the
-- extension object identified by extnId --
-- &ExtnType for the
-- extension object identified by extnId --
-- The following information object set is defined to constrain the
-- set of legal certificate extensions.
-- The following information object set is defined to constrain the
-- set of legal certificate extensions.
ExtensionSet EXTENSION ::= { authorityKeyIdentifier |
subjectKeyIdentifier |
keyUsage |
extendedKeyUsage |
privateKeyUsagePeriod |
certificatePolicies |
policyMappings |
subjectAltName |
issuerAltName |
basicConstraints |
nameConstraints |
policyConstraints |
cRLDistributionPoints |
subjectDirectoryAttributes |
authorityInfoAccess }
ExtensionSet EXTENSION ::= { authorityKeyIdentifier |
subjectKeyIdentifier |
keyUsage |
extendedKeyUsage |
privateKeyUsagePeriod |
certificatePolicies |
policyMappings |
subjectAltName |
issuerAltName |
basicConstraints |
nameConstraints |
policyConstraints |
cRLDistributionPoints |
subjectDirectoryAttributes |
authorityInfoAccess }
EXTENSION ::= CLASS {
&id OBJECT IDENTIFIER UNIQUE,
&ExtnType }
WITH SYNTAX {
SYNTAX &ExtnType
IDENTIFIED BY &id }
EXTENSION ::= CLASS {
&id OBJECT IDENTIFIER UNIQUE,
&ExtnType }
WITH SYNTAX {
SYNTAX &ExtnType
IDENTIFIED BY &id }
-- Certificate Revocation List --
--证书吊销列表--
CertificateList ::= SIGNED { SEQUENCE {
version Version OPTIONAL, -- if present, shall be v2
signature AlgorithmIdentifier,
issuer Name,
thisUpdate Time,
nextUpdate Time OPTIONAL,
revokedCertificates SEQUENCE OF SEQUENCE {
userCertificate CertificateSerialNumber,
revocationDate Time,
crlEntryExtensions EntryExtensions OPTIONAL } OPTIONAL,
crlExtensions [0] CRLExtensions OPTIONAL }}
CertificateList ::= SIGNED { SEQUENCE {
version Version OPTIONAL, -- if present, shall be v2
signature AlgorithmIdentifier,
issuer Name,
thisUpdate Time,
nextUpdate Time OPTIONAL,
revokedCertificates SEQUENCE OF SEQUENCE {
userCertificate CertificateSerialNumber,
revocationDate Time,
crlEntryExtensions EntryExtensions OPTIONAL } OPTIONAL,
crlExtensions [0] CRLExtensions OPTIONAL }}
CRLExtensions ::= SEQUENCE SIZE (1..MAX) OF CRLExtension
CRLExtensions ::= SEQUENCE SIZE (1..MAX) OF CRLExtension
CRLExtension ::= SEQUENCE {
extnId EXTENSION.&id ({CRLExtensionSet}),
critical BOOLEAN DEFAULT FALSE,
CRLExtension ::= SEQUENCE {
extnId EXTENSION.&id ({CRLExtensionSet}),
critical BOOLEAN DEFAULT FALSE,
extnValue OCTET STRING }
-- contains a DER encoding of a value of type
-- &ExtnType for the
-- extension object identified by extnId --
extnValue OCTET STRING }
-- contains a DER encoding of a value of type
-- &ExtnType for the
-- extension object identified by extnId --
-- The following information object set is defined to constrain the
-- set of legal CRL extensions.
-- The following information object set is defined to constrain the
-- set of legal CRL extensions.
CRLExtensionSet EXTENSION ::= { authorityKeyIdentifier |
issuerAltName |
cRLNumber |
deltaCRLIndicator |
issuingDistributionPoint }
CRLExtensionSet EXTENSION ::= { authorityKeyIdentifier |
issuerAltName |
cRLNumber |
deltaCRLIndicator |
issuingDistributionPoint }
-- EXTENSION defined above for certificates
--上面为证书定义的扩展
EntryExtensions ::= SEQUENCE SIZE (1..MAX) OF EntryExtension
EntryExtensions ::= SEQUENCE SIZE (1..MAX) OF EntryExtension
EntryExtension ::= SEQUENCE {
extnId EXTENSION.&id ({EntryExtensionSet}),
critical BOOLEAN DEFAULT FALSE,
extnValue OCTET STRING }
-- contains a DER encoding of a value of type
-- &ExtnType for the
-- extension object identified by extnId --
EntryExtension ::= SEQUENCE {
extnId EXTENSION.&id ({EntryExtensionSet}),
critical BOOLEAN DEFAULT FALSE,
extnValue OCTET STRING }
-- contains a DER encoding of a value of type
-- &ExtnType for the
-- extension object identified by extnId --
-- The following information object set is defined to constrain the
-- set of legal CRL entry extensions.
-- The following information object set is defined to constrain the
-- set of legal CRL entry extensions.
EntryExtensionSet EXTENSION ::= { reasonCode |
instructionCode |
invalidityDate |
certificateIssuer }
EntryExtensionSet EXTENSION ::= { reasonCode |
instructionCode |
invalidityDate |
certificateIssuer }
-- information object classes used in the defintion --
-- of certificates and CRLs --
-- information object classes used in the defintion --
-- of certificates and CRLs --
-- Parameterized Type SIGNED --
--参数化类型签名--
SIGNED { ToBeSigned } ::= SEQUENCE {
toBeSigned ToBeSigned,
algorithm AlgorithmIdentifier,
signature BIT STRING
}
SIGNED { ToBeSigned } ::= SEQUENCE {
toBeSigned ToBeSigned,
algorithm AlgorithmIdentifier,
signature BIT STRING
}
-- Definition of AlgorithmIdentifier
-- ISO definition was:
--
-- Definition of AlgorithmIdentifier
-- ISO definition was:
--
-- AlgorithmIdentifier ::= SEQUENCE {
-- algorithm ALGORITHM.&id({SupportedAlgorithms}),
-- parameters ALGORITHM.&Type({SupportedAlgorithms}
-- { @algorithm}) OPTIONAL }
-- Definition of ALGORITHM
-- ALGORITHM ::= TYPE-IDENTIFIER
-- AlgorithmIdentifier ::= SEQUENCE {
-- algorithm ALGORITHM.&id({SupportedAlgorithms}),
-- parameters ALGORITHM.&Type({SupportedAlgorithms}
-- { @algorithm}) OPTIONAL }
-- Definition of ALGORITHM
-- ALGORITHM ::= TYPE-IDENTIFIER
-- The following PKIX definition replaces the X.509 definition --
--以下PKIX定义取代了X.509定义--
AlgorithmIdentifier ::= SEQUENCE {
algorithm ALGORITHM-ID.&id({SupportedAlgorithms}),
parameters ALGORITHM-ID.&Type({SupportedAlgorithms}
{ @algorithm}) OPTIONAL }
AlgorithmIdentifier ::= SEQUENCE {
algorithm ALGORITHM-ID.&id({SupportedAlgorithms}),
parameters ALGORITHM-ID.&Type({SupportedAlgorithms}
{ @algorithm}) OPTIONAL }
-- Definition of ALGORITHM-ID
--算法ID的定义
ALGORITHM-ID ::= CLASS {
&id OBJECT IDENTIFIER UNIQUE,
&Type OPTIONAL
}
WITH SYNTAX { OID &id [PARMS &Type] }
ALGORITHM-ID ::= CLASS {
&id OBJECT IDENTIFIER UNIQUE,
&Type OPTIONAL
}
WITH SYNTAX { OID &id [PARMS &Type] }
-- The definition of SupportedAlgorithms may be modified as this
-- document does not specify a mandatory algorithm set. In addition,
-- the set is specified as extensible, since additional algorithms
-- may be supported
-- The definition of SupportedAlgorithms may be modified as this
-- document does not specify a mandatory algorithm set. In addition,
-- the set is specified as extensible, since additional algorithms
-- may be supported
SupportedAlgorithms ALGORITHM-ID ::= { ..., -- extensible
rsaPublicKey |
rsaSHA-1 |
rsaMD5 |
rsaMD2 |
dssPublicKey |
dsaSHA-1 |
dhPublicKey }
SupportedAlgorithms ALGORITHM-ID ::= { ..., -- extensible
rsaPublicKey |
rsaSHA-1 |
rsaMD5 |
rsaMD2 |
dssPublicKey |
dsaSHA-1 |
dhPublicKey }
-- OIDs and parameter structures for ALGORITHM-IDs used
-- in this specification
-- OIDs and parameter structures for ALGORITHM-IDs used
-- in this specification
rsaPublicKey ALGORITHM-ID ::= { OID rsaEncryption PARMS NULL }
rsaPublicKey ALGORITHM-ID ::= { OID rsaEncryption PARMS NULL }
rsaSHA-1 ALGORITHM-ID ::= { OID sha1WithRSAEncryption PARMS NULL }
rsaSHA-1 ALGORITHM-ID ::= { OID sha1WithRSAEncryption PARMS NULL }
rsaMD5 ALGORITHM-ID ::= { OID md5WithRSAEncryption PARMS NULL }
rsaMD5 ALGORITHM-ID ::= { OID md5WithRSAEncryption PARMS NULL }
rsaMD2 ALGORITHM-ID ::= { OID md2WithRSAEncryption PARMS NULL }
rsaMD2 ALGORITHM-ID ::= { OID md2WithRSAEncryption PARMS NULL }
dssPublicKey ALGORITHM-ID ::= { OID id-dsa PARMS Dss-Parms }
dssPublicKey ALGORITHM-ID ::= { OID id-dsa PARMS Dss-Parms }
dsaSHA-1 ALGORITHM-ID ::= { OID id-dsa-with-sha1 }
dsaSHA-1 ALGORITHM-ID ::= { OID id-dsa-with-sha1 }
dhPublicKey ALGORITHM-ID ::= {OID dhpublicnumber PARMS DomainParameters}
dhPublicKey ALGORITHM-ID ::= {OID dhpublicnumber PARMS DomainParameters}
-- algorithm identifiers and parameter structures
--算法标识符和参数结构
pkcs-1 OBJECT IDENTIFIER ::= {
iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 1 }
pkcs-1 OBJECT IDENTIFIER ::= {
iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 1 }
rsaEncryption OBJECT IDENTIFIER ::= { pkcs-1 1 }
rsaEncryption OBJECT IDENTIFIER ::= { pkcs-1 1 }
md2WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 2 }
md2WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 2 }
md5WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 4 }
md5WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 4 }
sha1WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 5 }
sha1WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 5 }
id-dsa-with-sha1 OBJECT IDENTIFIER ::= {
iso(1) member-body(2) us(840) x9-57 (10040) x9algorithm(4) 3 }
id-dsa-with-sha1 OBJECT IDENTIFIER ::= {
iso(1) member-body(2) us(840) x9-57 (10040) x9algorithm(4) 3 }
Dss-Sig-Value ::= SEQUENCE {
r INTEGER,
s INTEGER }
Dss-Sig-Value ::= SEQUENCE {
r INTEGER,
s INTEGER }
dhpublicnumber OBJECT IDENTIFIER ::= {
iso(1) member-body(2) us(840) ansi-x942(10046) number-type(2) 1 }
dhpublicnumber OBJECT IDENTIFIER ::= {
iso(1) member-body(2) us(840) ansi-x942(10046) number-type(2) 1 }
DomainParameters ::= SEQUENCE {
p INTEGER, -- odd prime, p=jq +1
g INTEGER, -- generator, g
q INTEGER, -- factor of p-1
j INTEGER OPTIONAL, -- subgroup factor, j>= 2
validationParms ValidationParms OPTIONAL }
DomainParameters ::= SEQUENCE {
p INTEGER, -- odd prime, p=jq +1
g INTEGER, -- generator, g
q INTEGER, -- factor of p-1
j INTEGER OPTIONAL, -- subgroup factor, j>= 2
validationParms ValidationParms OPTIONAL }
ValidationParms ::= SEQUENCE {
seed BIT STRING,
pgenCounter INTEGER }
ValidationParms ::= SEQUENCE {
seed BIT STRING,
pgenCounter INTEGER }
id-dsa OBJECT IDENTIFIER ::= {
iso(1) member-body(2) us(840) x9-57(10040) x9algorithm(4) 1 }
id-dsa OBJECT IDENTIFIER ::= {
iso(1) member-body(2) us(840) x9-57(10040) x9algorithm(4) 1 }
Dss-Parms ::= SEQUENCE {
p INTEGER,
q INTEGER,
g INTEGER }
Dss-Parms ::= SEQUENCE {
p INTEGER,
q INTEGER,
g INTEGER }
-- The ASN.1 in this section supports the Name type
-- and the directoryAttribute extension
-- The ASN.1 in this section supports the Name type
-- and the directoryAttribute extension
-- attribute data types --
--属性数据类型--
Attribute ::= SEQUENCE {
type ATTRIBUTE.&id ({SupportedAttributes}),
values SET SIZE (1 .. MAX) OF ATTRIBUTE.&Type
({SupportedAttributes}{@type})}
Attribute ::= SEQUENCE {
type ATTRIBUTE.&id ({SupportedAttributes}),
values SET SIZE (1 .. MAX) OF ATTRIBUTE.&Type
({SupportedAttributes}{@type})}
AttributeTypeAndValue ::= SEQUENCE {
type ATTRIBUTE.&id ({SupportedAttributes}),
value ATTRIBUTE.&Type ({SupportedAttributes}{@type})}
AttributeTypeAndValue ::= SEQUENCE {
type ATTRIBUTE.&id ({SupportedAttributes}),
value ATTRIBUTE.&Type ({SupportedAttributes}{@type})}
-- naming data types --
--命名数据类型--
Name ::= CHOICE { -- only one possibility for now --
rdnSequence RDNSequence }
Name ::= CHOICE { -- only one possibility for now --
rdnSequence RDNSequence }
RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
RelativeDistinguishedName ::=
SET SIZE (1 .. MAX) OF AttributeTypeAndValue
RelativeDistinguishedName ::=
SET SIZE (1 .. MAX) OF AttributeTypeAndValue
ID ::= OBJECT IDENTIFIER
ID ::= OBJECT IDENTIFIER
-- ATTRIBUTE information object class specification
-- Note: This has been greatly simplified for PKIX !!
-- ATTRIBUTE information object class specification
-- Note: This has been greatly simplified for PKIX !!
ATTRIBUTE ::= CLASS {
&Type,
&id OBJECT IDENTIFIER UNIQUE }
WITH SYNTAX {
WITH SYNTAX &Type ID &id }
ATTRIBUTE ::= CLASS {
&Type,
&id OBJECT IDENTIFIER UNIQUE }
WITH SYNTAX {
WITH SYNTAX &Type ID &id }
-- suggested naming attributes
-- Definition of the following information object set may be
-- augmented to meet local requirements. Note that deleting
-- members of the set may prevent interoperability with
-- conforming implementations.
-- suggested naming attributes
-- Definition of the following information object set may be
-- augmented to meet local requirements. Note that deleting
-- members of the set may prevent interoperability with
-- conforming implementations.
SupportedAttributes ATTRIBUTE ::= {
name | commonName | surname | givenName | initials |
generationQualifier | dnQualifier | countryName |
localityName | stateOrProvinceName | organizationName |
organizationalUnitName | title | pkcs9email }
SupportedAttributes ATTRIBUTE ::= {
name | commonName | surname | givenName | initials |
generationQualifier | dnQualifier | countryName |
localityName | stateOrProvinceName | organizationName |
organizationalUnitName | title | pkcs9email }
name ATTRIBUTE ::= {
name ATTRIBUTE ::= {
WITH SYNTAX DirectoryString { ub-name }
ID id-at-name }
WITH SYNTAX DirectoryString { ub-name }
ID id-at-name }
commonName ATTRIBUTE ::= {
WITH SYNTAX DirectoryString {ub-common-name}
ID id-at-commonName }
commonName ATTRIBUTE ::= {
WITH SYNTAX DirectoryString {ub-common-name}
ID id-at-commonName }
surname ATTRIBUTE ::= {
WITH SYNTAX DirectoryString {ub-name}
ID id-at-surname }
surname ATTRIBUTE ::= {
WITH SYNTAX DirectoryString {ub-name}
ID id-at-surname }
givenName ATTRIBUTE ::= {
WITH SYNTAX DirectoryString {ub-name}
ID id-at-givenName }
givenName ATTRIBUTE ::= {
WITH SYNTAX DirectoryString {ub-name}
ID id-at-givenName }
initials ATTRIBUTE ::= {
WITH SYNTAX DirectoryString {ub-name}
ID id-at-initials }
initials ATTRIBUTE ::= {
WITH SYNTAX DirectoryString {ub-name}
ID id-at-initials }
generationQualifier ATTRIBUTE ::= {
WITH SYNTAX DirectoryString {ub-name}
ID id-at-generationQualifier}
generationQualifier ATTRIBUTE ::= {
WITH SYNTAX DirectoryString {ub-name}
ID id-at-generationQualifier}
dnQualifier ATTRIBUTE ::= {
WITH SYNTAX PrintableString
ID id-at-dnQualifier }
dnQualifier ATTRIBUTE ::= {
WITH SYNTAX PrintableString
ID id-at-dnQualifier }
countryName ATTRIBUTE ::= {
WITH SYNTAX PrintableString (SIZE (2))
-- IS 3166 codes only
ID id-at-countryName }
countryName ATTRIBUTE ::= {
WITH SYNTAX PrintableString (SIZE (2))
-- IS 3166 codes only
ID id-at-countryName }
localityName ATTRIBUTE ::= {
WITH SYNTAX DirectoryString {ub-locality-name}
ID id-at-localityName }
localityName ATTRIBUTE ::= {
WITH SYNTAX DirectoryString {ub-locality-name}
ID id-at-localityName }
stateOrProvinceName ATTRIBUTE ::= {
WITH SYNTAX DirectoryString {ub-state-name}
ID id-at-stateOrProvinceName }
stateOrProvinceName ATTRIBUTE ::= {
WITH SYNTAX DirectoryString {ub-state-name}
ID id-at-stateOrProvinceName }
organizationName ATTRIBUTE ::= {
WITH SYNTAX DirectoryString {ub-organization-name}
ID id-at-organizationName }
organizationName ATTRIBUTE ::= {
WITH SYNTAX DirectoryString {ub-organization-name}
ID id-at-organizationName }
organizationalUnitName ATTRIBUTE ::= {
WITH SYNTAX DirectoryString {ub-organizational-unit-name}
ID id-at-organizationalUnitName }
organizationalUnitName ATTRIBUTE ::= {
WITH SYNTAX DirectoryString {ub-organizational-unit-name}
ID id-at-organizationalUnitName }
title ATTRIBUTE ::= {
WITH SYNTAX DirectoryString {ub-title}
ID id-at-title }
title ATTRIBUTE ::= {
WITH SYNTAX DirectoryString {ub-title}
ID id-at-title }
-- Legacy attributes
--遗留属性
pkcs9email ATTRIBUTE ::= {
WITH SYNTAX PHGString,
ID emailAddress }
pkcs9email ATTRIBUTE ::= {
WITH SYNTAX PHGString,
ID emailAddress }
PHGString ::= IA5String (SIZE(1..ub-emailaddress-length))
PHGString ::= IA5String (SIZE(1..ub-emailaddress-length))
pkcs-9 OBJECT IDENTIFIER ::=
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 9 }
pkcs-9 OBJECT IDENTIFIER ::=
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 9 }
emailAddress OBJECT IDENTIFIER ::= { pkcs-9 1 }
emailAddress OBJECT IDENTIFIER ::= { pkcs-9 1 }
-- object identifiers for Name type and directory attribute support
--名称类型和目录属性支持的对象标识符
-- Object identifier assignments --
--对象标识符分配--
id-at OBJECT IDENTIFIER ::= {joint-iso-ccitt(2) ds(5) 4}
id-at OBJECT IDENTIFIER ::= {joint-iso-ccitt(2) ds(5) 4}
-- Attributes --
--属性--
id-at-commonName OBJECT IDENTIFIER ::= {id-at 3}
id-at-surname OBJECT IDENTIFIER ::= {id-at 4}
id-at-countryName OBJECT IDENTIFIER ::= {id-at 6}
id-at-localityName OBJECT IDENTIFIER ::= {id-at 7}
id-at-stateOrProvinceName OBJECT IDENTIFIER ::= {id-at 8}
id-at-organizationName OBJECT IDENTIFIER ::= {id-at 10}
id-at-organizationalUnitName OBJECT IDENTIFIER ::= {id-at 11}
id-at-title OBJECT IDENTIFIER ::= {id-at 12}
id-at-name OBJECT IDENTIFIER ::= {id-at 41}
id-at-givenName OBJECT IDENTIFIER ::= {id-at 42}
id-at-initials OBJECT IDENTIFIER ::= {id-at 43}
id-at-generationQualifier OBJECT IDENTIFIER ::= {id-at 44}
id-at-dnQualifier OBJECT IDENTIFIER ::= {id-at 46}
id-at-commonName OBJECT IDENTIFIER ::= {id-at 3}
id-at-surname OBJECT IDENTIFIER ::= {id-at 4}
id-at-countryName OBJECT IDENTIFIER ::= {id-at 6}
id-at-localityName OBJECT IDENTIFIER ::= {id-at 7}
id-at-stateOrProvinceName OBJECT IDENTIFIER ::= {id-at 8}
id-at-organizationName OBJECT IDENTIFIER ::= {id-at 10}
id-at-organizationalUnitName OBJECT IDENTIFIER ::= {id-at 11}
id-at-title OBJECT IDENTIFIER ::= {id-at 12}
id-at-name OBJECT IDENTIFIER ::= {id-at 41}
id-at-givenName OBJECT IDENTIFIER ::= {id-at 42}
id-at-initials OBJECT IDENTIFIER ::= {id-at 43}
id-at-generationQualifier OBJECT IDENTIFIER ::= {id-at 44}
id-at-dnQualifier OBJECT IDENTIFIER ::= {id-at 46}
-- Directory string type, used extensively in Name types --
--目录字符串类型，广泛用于名称类型--
DirectoryString { INTEGER:maxSize } ::= CHOICE {
teletexString TeletexString (SIZE (1..maxSize)),
printableString PrintableString (SIZE (1..maxSize)),
universalString UniversalString (SIZE (1..maxSize)),
bmpString BMPString (SIZE(1..maxSize)),
utf8String UTF8String (SIZE(1..maxSize))
}
DirectoryString { INTEGER:maxSize } ::= CHOICE {
teletexString TeletexString (SIZE (1..maxSize)),
printableString PrintableString (SIZE (1..maxSize)),
universalString UniversalString (SIZE (1..maxSize)),
bmpString BMPString (SIZE(1..maxSize)),
utf8String UTF8String (SIZE(1..maxSize))
}
-- End of ASN.1 for Name type and directory attribute support --
--名称类型和目录属性支持的ASN.1结束--
-- The ASN.1 in this section supports X.400 style names --
-- for implementations that use the x400Address component --
-- of GeneralName. --
-- The ASN.1 in this section supports X.400 style names --
-- for implementations that use the x400Address component --
-- of GeneralName. --
ORAddress ::= SEQUENCE {
built-in-standard-attributes BuiltInStandardAttributes,
built-in-domain-defined-attributes
BuiltInDomainDefinedAttributes OPTIONAL,
-- see also teletex-domain-defined-attributes
extension-attributes ExtensionAttributes OPTIONAL }
ORAddress ::= SEQUENCE {
built-in-standard-attributes BuiltInStandardAttributes,
built-in-domain-defined-attributes
BuiltInDomainDefinedAttributes OPTIONAL,
-- see also teletex-domain-defined-attributes
extension-attributes ExtensionAttributes OPTIONAL }
-- The OR-address is semantically absent from the OR-name if the
-- built-in-standard-attribute sequence is empty and the
-- built-in-domain-defined-attributes and extension-attributes are
-- both omitted.
-- The OR-address is semantically absent from the OR-name if the
-- built-in-standard-attribute sequence is empty and the
-- built-in-domain-defined-attributes and extension-attributes are
-- both omitted.
-- Built-in Standard Attributes
--内置标准属性
BuiltInStandardAttributes ::= SEQUENCE {
country-name CountryName OPTIONAL,
administration-domain-name AdministrationDomainName OPTIONAL,
network-address [0] NetworkAddress OPTIONAL,
-- see also extended-network-address
terminal-identifier [1] TerminalIdentifier OPTIONAL,
private-domain-name [2] PrivateDomainName OPTIONAL,
organization-name [3] OrganizationName OPTIONAL,
-- see also teletex-organization-name
numeric-user-identifier [4] NumericUserIdentifier OPTIONAL,
personal-name [5] PersonalName OPTIONAL,
-- see also teletex-personal-name
organizational-unit-names [6] OrganizationalUnitNames OPTIONAL
-- see also teletex-organizational-unit-names -- }
BuiltInStandardAttributes ::= SEQUENCE {
country-name CountryName OPTIONAL,
administration-domain-name AdministrationDomainName OPTIONAL,
network-address [0] NetworkAddress OPTIONAL,
-- see also extended-network-address
terminal-identifier [1] TerminalIdentifier OPTIONAL,
private-domain-name [2] PrivateDomainName OPTIONAL,
organization-name [3] OrganizationName OPTIONAL,
-- see also teletex-organization-name
numeric-user-identifier [4] NumericUserIdentifier OPTIONAL,
personal-name [5] PersonalName OPTIONAL,
-- see also teletex-personal-name
organizational-unit-names [6] OrganizationalUnitNames OPTIONAL
-- see also teletex-organizational-unit-names -- }
CountryName ::= [APPLICATION 1] CHOICE {
x121-dcc-code NumericString
(SIZE (ub-country-name-numeric-length)),
iso-3166-alpha2-code PrintableString
(SIZE (ub-country-name-alpha-length)) }
CountryName ::= [APPLICATION 1] CHOICE {
x121-dcc-code NumericString
(SIZE (ub-country-name-numeric-length)),
iso-3166-alpha2-code PrintableString
(SIZE (ub-country-name-alpha-length)) }
AdministrationDomainName ::= [APPLICATION 2] CHOICE {
numeric NumericString (SIZE (0..ub-domain-name-length)),
printable PrintableString (SIZE (0..ub-domain-name-length)) }
AdministrationDomainName ::= [APPLICATION 2] CHOICE {
numeric NumericString (SIZE (0..ub-domain-name-length)),
printable PrintableString (SIZE (0..ub-domain-name-length)) }
NetworkAddress ::= X121Address
-- see also extended-network-address
NetworkAddress ::= X121Address
-- see also extended-network-address
X121Address ::= NumericString (SIZE (1..ub-x121-address-length))
X121Address ::= NumericString (SIZE (1..ub-x121-address-length))
TerminalIdentifier ::= PrintableString (SIZE (1..ub-terminal-id-length))
TerminalIdentifier ::= PrintableString (SIZE (1..ub-terminal-id-length))
PrivateDomainName ::= CHOICE {
numeric NumericString (SIZE (1..ub-domain-name-length)),
printable PrintableString (SIZE (1..ub-domain-name-length)) }
PrivateDomainName ::= CHOICE {
numeric NumericString (SIZE (1..ub-domain-name-length)),
printable PrintableString (SIZE (1..ub-domain-name-length)) }
OrganizationName ::= PrintableString
(SIZE (1..ub-organization-name-length))
-- see also teletex-organization-name
OrganizationName ::= PrintableString
(SIZE (1..ub-organization-name-length))
-- see also teletex-organization-name
NumericUserIdentifier ::= NumericString
(SIZE (1..ub-numeric-user-id-length))
NumericUserIdentifier ::= NumericString
(SIZE (1..ub-numeric-user-id-length))
PersonalName ::= SET {
surname [0] PrintableString (SIZE (1..ub-surname-length)),
given-name [1] PrintableString
(SIZE (1..ub-given-name-length)) OPTIONAL,
initials [2] PrintableString
(SIZE (1..ub-initials-length)) OPTIONAL,
generation-qualifier [3] PrintableString
(SIZE (1..ub-generation-qualifier-length)) OPTIONAL}
-- see also teletex-personal-name
PersonalName ::= SET {
surname [0] PrintableString (SIZE (1..ub-surname-length)),
given-name [1] PrintableString
(SIZE (1..ub-given-name-length)) OPTIONAL,
initials [2] PrintableString
(SIZE (1..ub-initials-length)) OPTIONAL,
generation-qualifier [3] PrintableString
(SIZE (1..ub-generation-qualifier-length)) OPTIONAL}
-- see also teletex-personal-name
OrganizationalUnitNames ::= SEQUENCE SIZE (1..ub-organizational-units)
OF OrganizationalUnitName
-- see also teletex-organizational-unit-names
OrganizationalUnitNames ::= SEQUENCE SIZE (1..ub-organizational-units)
OF OrganizationalUnitName
-- see also teletex-organizational-unit-names
OrganizationalUnitName ::= PrintableString (SIZE
(1..ub-organizational-unit-name-length))
OrganizationalUnitName ::= PrintableString (SIZE
(1..ub-organizational-unit-name-length))
-- Built-in Domain-defined Attributes
BuiltInDomainDefinedAttributes ::= SEQUENCE SIZE
(1..ub-domain-defined-attributes) OF
BuiltInDomainDefinedAttribute
-- Built-in Domain-defined Attributes
BuiltInDomainDefinedAttributes ::= SEQUENCE SIZE
(1..ub-domain-defined-attributes) OF
BuiltInDomainDefinedAttribute
BuiltInDomainDefinedAttribute ::= SEQUENCE {
type PrintableString (SIZE
(1..ub-domain-defined-attribute-type-length)),
value PrintableString (SIZE
(1..ub-domain-defined-attribute-value-length)) }
BuiltInDomainDefinedAttribute ::= SEQUENCE {
type PrintableString (SIZE
(1..ub-domain-defined-attribute-type-length)),
value PrintableString (SIZE
(1..ub-domain-defined-attribute-value-length)) }
-- Extension Attributes
--扩展属性
ExtensionAttributes ::= SET SIZE (1..ub-extension-attributes)
OF ExtensionAttribute
ExtensionAttribute ::= SEQUENCE {
ExtensionAttributes ::= SET SIZE (1..ub-extension-attributes)
OF ExtensionAttribute
ExtensionAttribute ::= SEQUENCE {
extension-attribute-type [0] EXTENSION-ATTRIBUTE.&id
({ExtensionAttributeTable}),
extension-attribute-value [1] EXTENSION-ATTRIBUTE.&Type
({ExtensionAttributeTable} {@extension-attribute-type}) }
extension-attribute-type [0] EXTENSION-ATTRIBUTE.&id
({ExtensionAttributeTable}),
extension-attribute-value [1] EXTENSION-ATTRIBUTE.&Type
({ExtensionAttributeTable} {@extension-attribute-type}) }
EXTENSION-ATTRIBUTE ::= CLASS {
&id INTEGER (0..ub-extension-attributes) UNIQUE,
&Type }
WITH SYNTAX {&Type IDENTIFIED BY &id}
EXTENSION-ATTRIBUTE ::= CLASS {
&id INTEGER (0..ub-extension-attributes) UNIQUE,
&Type }
WITH SYNTAX {&Type IDENTIFIED BY &id}
ExtensionAttributeTable EXTENSION-ATTRIBUTE ::= {
common-name |
teletex-common-name |
teletex-organization-name |
teletex-personal-name |
teletex-organizational-unit-names |
teletex-domain-defined-attributes |
pds-name |
physical-delivery-country-name |
postal-code |
physical-delivery-office-name |
physical-delivery-office-number |
extension-OR-address-components |
physical-delivery-personal-name |
physical-delivery-organization-name |
extension-physical-delivery-address-components |
unformatted-postal-address |
street-address |
post-office-box-address |
poste-restante-address |
unique-postal-name |
local-postal-attributes |
extended-network-address |
terminal-type }
ExtensionAttributeTable EXTENSION-ATTRIBUTE ::= {
common-name |
teletex-common-name |
teletex-organization-name |
teletex-personal-name |
teletex-organizational-unit-names |
teletex-domain-defined-attributes |
pds-name |
physical-delivery-country-name |
postal-code |
physical-delivery-office-name |
physical-delivery-office-number |
extension-OR-address-components |
physical-delivery-personal-name |
physical-delivery-organization-name |
extension-physical-delivery-address-components |
unformatted-postal-address |
street-address |
post-office-box-address |
poste-restante-address |
unique-postal-name |
local-postal-attributes |
extended-network-address |
terminal-type }
-- Extension Standard Attributes
--扩展标准属性
common-name EXTENSION-ATTRIBUTE ::= {CommonName IDENTIFIED BY 1}
common-name EXTENSION-ATTRIBUTE ::= {CommonName IDENTIFIED BY 1}
CommonName ::= PrintableString (SIZE (1..ub-common-name-length))
CommonName ::= PrintableString (SIZE (1..ub-common-name-length))
teletex-common-name EXTENSION-ATTRIBUTE ::=
{TeletexCommonName IDENTIFIED BY 2}
teletex-common-name EXTENSION-ATTRIBUTE ::=
{TeletexCommonName IDENTIFIED BY 2}
TeletexCommonName ::= TeletexString (SIZE (1..ub-common-name-length))
TeletexCommonName ::= TeletexString (SIZE (1..ub-common-name-length))
teletex-organization-name EXTENSION-ATTRIBUTE ::=
{TeletexOrganizationName IDENTIFIED BY 3}
teletex-organization-name EXTENSION-ATTRIBUTE ::=
{TeletexOrganizationName IDENTIFIED BY 3}
TeletexOrganizationName ::=
TeletexString (SIZE (1..ub-organization-name-length))
TeletexOrganizationName ::=
TeletexString (SIZE (1..ub-organization-name-length))
teletex-personal-name EXTENSION-ATTRIBUTE ::=
{TeletexPersonalName IDENTIFIED BY 4}
teletex-personal-name EXTENSION-ATTRIBUTE ::=
{TeletexPersonalName IDENTIFIED BY 4}
TeletexPersonalName ::= SET {
surname [0] TeletexString (SIZE (1..ub-surname-length)),
given-name [1] TeletexString
(SIZE (1..ub-given-name-length)) OPTIONAL,
initials [2] TeletexString (SIZE (1..ub-initials-length)) OPTIONAL,
generation-qualifier [3] TeletexString (SIZE
(1..ub-generation-qualifier-length)) OPTIONAL }
TeletexPersonalName ::= SET {
surname [0] TeletexString (SIZE (1..ub-surname-length)),
given-name [1] TeletexString
(SIZE (1..ub-given-name-length)) OPTIONAL,
initials [2] TeletexString (SIZE (1..ub-initials-length)) OPTIONAL,
generation-qualifier [3] TeletexString (SIZE
(1..ub-generation-qualifier-length)) OPTIONAL }
teletex-organizational-unit-names EXTENSION-ATTRIBUTE ::=
{TeletexOrganizationalUnitNames IDENTIFIED BY 5}
teletex-organizational-unit-names EXTENSION-ATTRIBUTE ::=
{TeletexOrganizationalUnitNames IDENTIFIED BY 5}
TeletexOrganizationalUnitNames ::= SEQUENCE SIZE
(1..ub-organizational-units) OF TeletexOrganizationalUnitName
TeletexOrganizationalUnitNames ::= SEQUENCE SIZE
(1..ub-organizational-units) OF TeletexOrganizationalUnitName
TeletexOrganizationalUnitName ::= TeletexString
(SIZE (1..ub-organizational-unit-name-length))
TeletexOrganizationalUnitName ::= TeletexString
(SIZE (1..ub-organizational-unit-name-length))
pds-name EXTENSION-ATTRIBUTE ::= {PDSName IDENTIFIED BY 7}
pds-name EXTENSION-ATTRIBUTE ::= {PDSName IDENTIFIED BY 7}
PDSName ::= PrintableString (SIZE (1..ub-pds-name-length))
PDSName ::= PrintableString (SIZE (1..ub-pds-name-length))
physical-delivery-country-name EXTENSION-ATTRIBUTE ::=
{PhysicalDeliveryCountryName IDENTIFIED BY 8}
physical-delivery-country-name EXTENSION-ATTRIBUTE ::=
{PhysicalDeliveryCountryName IDENTIFIED BY 8}
PhysicalDeliveryCountryName ::= CHOICE {
x121-dcc-code NumericString (SIZE (ub-country-name-numeric-length)),
iso-3166-alpha2-code PrintableString
(SIZE (ub-country-name-alpha-length)) }
PhysicalDeliveryCountryName ::= CHOICE {
x121-dcc-code NumericString (SIZE (ub-country-name-numeric-length)),
iso-3166-alpha2-code PrintableString
(SIZE (ub-country-name-alpha-length)) }
postal-code EXTENSION-ATTRIBUTE ::= {PostalCode IDENTIFIED BY 9}
postal-code EXTENSION-ATTRIBUTE ::= {PostalCode IDENTIFIED BY 9}
PostalCode ::= CHOICE {
numeric-code NumericString (SIZE (1..ub-postal-code-length)),
printable-code PrintableString (SIZE (1..ub-postal-code-length)) }
PostalCode ::= CHOICE {
numeric-code NumericString (SIZE (1..ub-postal-code-length)),
printable-code PrintableString (SIZE (1..ub-postal-code-length)) }
physical-delivery-office-name EXTENSION-ATTRIBUTE ::=
{PhysicalDeliveryOfficeName IDENTIFIED BY 10}
physical-delivery-office-name EXTENSION-ATTRIBUTE ::=
{PhysicalDeliveryOfficeName IDENTIFIED BY 10}
PhysicalDeliveryOfficeName ::= PDSParameter
PhysicalDeliveryOfficeName ::= PDSParameter
physical-delivery-office-number EXTENSION-ATTRIBUTE ::=
{PhysicalDeliveryOfficeNumber IDENTIFIED BY 11}
physical-delivery-office-number EXTENSION-ATTRIBUTE ::=
{PhysicalDeliveryOfficeNumber IDENTIFIED BY 11}
PhysicalDeliveryOfficeNumber ::= PDSParameter
PhysicalDeliveryOfficeNumber ::= PDSParameter
extension-OR-address-components EXTENSION-ATTRIBUTE ::=
{ExtensionORAddressComponents IDENTIFIED BY 12}
extension-OR-address-components EXTENSION-ATTRIBUTE ::=
{ExtensionORAddressComponents IDENTIFIED BY 12}
ExtensionORAddressComponents ::= PDSParameter
ExtensionORAddressComponents ::= PDSParameter
physical-delivery-personal-name EXTENSION-ATTRIBUTE ::=
{PhysicalDeliveryPersonalName IDENTIFIED BY 13}
physical-delivery-personal-name EXTENSION-ATTRIBUTE ::=
{PhysicalDeliveryPersonalName IDENTIFIED BY 13}
PhysicalDeliveryPersonalName ::= PDSParameter
PhysicalDeliveryPersonalName ::= PDSParameter
physical-delivery-organization-name EXTENSION-ATTRIBUTE ::=
{PhysicalDeliveryOrganizationName IDENTIFIED BY 14}
physical-delivery-organization-name EXTENSION-ATTRIBUTE ::=
{PhysicalDeliveryOrganizationName IDENTIFIED BY 14}
PhysicalDeliveryOrganizationName ::= PDSParameter
PhysicalDeliveryOrganizationName ::= PDSParameter
extension-physical-delivery-address-components EXTENSION-ATTRIBUTE ::=
{ExtensionPhysicalDeliveryAddressComponents IDENTIFIED BY 15}
extension-physical-delivery-address-components EXTENSION-ATTRIBUTE ::=
{ExtensionPhysicalDeliveryAddressComponents IDENTIFIED BY 15}
ExtensionPhysicalDeliveryAddressComponents ::= PDSParameter
ExtensionPhysicalDeliveryAddressComponents ::= PDSParameter
unformatted-postal-address EXTENSION-ATTRIBUTE ::=
{UnformattedPostalAddress IDENTIFIED BY 16}
unformatted-postal-address EXTENSION-ATTRIBUTE ::=
{UnformattedPostalAddress IDENTIFIED BY 16}
UnformattedPostalAddress ::= SET {
printable-address SEQUENCE SIZE (1..ub-pds-physical-address-lines) OF
PrintableString (SIZE (1..ub-pds-parameter-length)) OPTIONAL,
teletex-string TeletexString (SIZE
(1..ub-unformatted-address-length)) OPTIONAL }
UnformattedPostalAddress ::= SET {
printable-address SEQUENCE SIZE (1..ub-pds-physical-address-lines) OF
PrintableString (SIZE (1..ub-pds-parameter-length)) OPTIONAL,
teletex-string TeletexString (SIZE
(1..ub-unformatted-address-length)) OPTIONAL }
street-address EXTENSION-ATTRIBUTE ::=
{StreetAddress IDENTIFIED BY 17}
street-address EXTENSION-ATTRIBUTE ::=
{StreetAddress IDENTIFIED BY 17}
StreetAddress ::= PDSParameter
StreetAddress ::= PDSParameter
post-office-box-address EXTENSION-ATTRIBUTE ::=
{PostOfficeBoxAddress IDENTIFIED BY 18}
post-office-box-address EXTENSION-ATTRIBUTE ::=
{PostOfficeBoxAddress IDENTIFIED BY 18}
PostOfficeBoxAddress ::= PDSParameter
PostOfficeBoxAddress ::= PDSParameter
poste-restante-address EXTENSION-ATTRIBUTE ::=
{PosteRestanteAddress IDENTIFIED BY 19}
poste-restante-address EXTENSION-ATTRIBUTE ::=
{PosteRestanteAddress IDENTIFIED BY 19}
PosteRestanteAddress ::= PDSParameter
PosteRestanteAddress ::= PDSParameter
unique-postal-name EXTENSION-ATTRIBUTE ::=
{UniquePostalName IDENTIFIED BY 20}
unique-postal-name EXTENSION-ATTRIBUTE ::=
{UniquePostalName IDENTIFIED BY 20}
UniquePostalName ::= PDSParameter
UniquePostalName ::= PDSParameter
local-postal-attributes EXTENSION-ATTRIBUTE ::=
{LocalPostalAttributes IDENTIFIED BY 21}
local-postal-attributes EXTENSION-ATTRIBUTE ::=
{LocalPostalAttributes IDENTIFIED BY 21}
LocalPostalAttributes ::= PDSParameter
LocalPostalAttributes ::= PDSParameter
PDSParameter ::= SET {
printable-string PrintableString
(SIZE(1..ub-pds-parameter-length)) OPTIONAL,
teletex-string TeletexString
(SIZE(1..ub-pds-parameter-length)) OPTIONAL }
PDSParameter ::= SET {
printable-string PrintableString
(SIZE(1..ub-pds-parameter-length)) OPTIONAL,
teletex-string TeletexString
(SIZE(1..ub-pds-parameter-length)) OPTIONAL }
extended-network-address EXTENSION-ATTRIBUTE ::=
{ExtendedNetworkAddress IDENTIFIED BY 22}
extended-network-address EXTENSION-ATTRIBUTE ::=
{ExtendedNetworkAddress IDENTIFIED BY 22}
ExtendedNetworkAddress ::= CHOICE {
e163-4-address SEQUENCE {
number [0] NumericString
(SIZE (1..ub-e163-4-number-length)),
sub-address [1] NumericString
(SIZE (1..ub-e163-4-sub-address-length)) OPTIONAL},
psap-address [0] PresentationAddress }
ExtendedNetworkAddress ::= CHOICE {
e163-4-address SEQUENCE {
number [0] NumericString
(SIZE (1..ub-e163-4-number-length)),
sub-address [1] NumericString
(SIZE (1..ub-e163-4-sub-address-length)) OPTIONAL},
psap-address [0] PresentationAddress }
PresentationAddress ::= SEQUENCE {
pSelector [0] EXPLICIT OCTET STRING OPTIONAL,
sSelector [1] EXPLICIT OCTET STRING OPTIONAL,
tSelector [2] EXPLICIT OCTET STRING OPTIONAL,
nAddresses [3] EXPLICIT SET SIZE (1..MAX) OF OCTET STRING}
PresentationAddress ::= SEQUENCE {
pSelector [0] EXPLICIT OCTET STRING OPTIONAL,
sSelector [1] EXPLICIT OCTET STRING OPTIONAL,
tSelector [2] EXPLICIT OCTET STRING OPTIONAL,
nAddresses [3] EXPLICIT SET SIZE (1..MAX) OF OCTET STRING}
terminal-type EXTENSION-ATTRIBUTE ::= {TerminalType IDENTIFIED BY 23}
terminal-type EXTENSION-ATTRIBUTE ::= {TerminalType IDENTIFIED BY 23}
TerminalType ::= INTEGER {
telex (3),
teletex (4),
g3-facsimile (5),
g4-facsimile (6),
ia5-terminal (7),
videotex (8) } (0..ub-integer-options)
TerminalType ::= INTEGER {
telex (3),
teletex (4),
g3-facsimile (5),
g4-facsimile (6),
ia5-terminal (7),
videotex (8) } (0..ub-integer-options)
-- Extension Domain-defined Attributes
--扩展域定义的属性
teletex-domain-defined-attributes EXTENSION-ATTRIBUTE ::=
{TeletexDomainDefinedAttributes IDENTIFIED BY 6}
teletex-domain-defined-attributes EXTENSION-ATTRIBUTE ::=
{TeletexDomainDefinedAttributes IDENTIFIED BY 6}
TeletexDomainDefinedAttributes ::= SEQUENCE SIZE
(1..ub-domain-defined-attributes) OF TeletexDomainDefinedAttribute
TeletexDomainDefinedAttributes ::= SEQUENCE SIZE
(1..ub-domain-defined-attributes) OF TeletexDomainDefinedAttribute
TeletexDomainDefinedAttribute ::= SEQUENCE {
type TeletexString
(SIZE (1..ub-domain-defined-attribute-type-length)),
value TeletexString
(SIZE (1..ub-domain-defined-attribute-value-length)) }
TeletexDomainDefinedAttribute ::= SEQUENCE {
type TeletexString
(SIZE (1..ub-domain-defined-attribute-type-length)),
value TeletexString
(SIZE (1..ub-domain-defined-attribute-value-length)) }
-- specifications of Upper Bounds
-- shall be regarded as mandatory
-- from Annex B of ITU-T X.411
-- Reference Definition of MTS Parameter Upper Bounds
-- specifications of Upper Bounds
-- shall be regarded as mandatory
-- from Annex B of ITU-T X.411
-- Reference Definition of MTS Parameter Upper Bounds
-- Upper Bounds
ub-name INTEGER ::= 32768
ub-common-name INTEGER ::= 64
ub-locality-name INTEGER ::= 128
ub-state-name INTEGER ::= 128
ub-organization-name INTEGER ::= 64
ub-organizational-unit-name INTEGER ::= 64
ub-title INTEGER ::= 64
ub-match INTEGER ::= 128
-- Upper Bounds
ub-name INTEGER ::= 32768
ub-common-name INTEGER ::= 64
ub-locality-name INTEGER ::= 128
ub-state-name INTEGER ::= 128
ub-organization-name INTEGER ::= 64
ub-organizational-unit-name INTEGER ::= 64
ub-title INTEGER ::= 64
ub-match INTEGER ::= 128
ub-emailaddress-length INTEGER ::= 128
ub-emailaddress-length INTEGER ::= 128
ub-common-name-length INTEGER ::= 64
ub-country-name-alpha-length INTEGER ::= 2
ub-country-name-numeric-length INTEGER ::= 3
ub-domain-defined-attributes INTEGER ::= 4
ub-domain-defined-attribute-type-length INTEGER ::= 8
ub-domain-defined-attribute-value-length INTEGER ::= 128
ub-domain-name-length INTEGER ::= 16
ub-extension-attributes INTEGER ::= 256
ub-e163-4-number-length INTEGER ::= 15
ub-e163-4-sub-address-length INTEGER ::= 40
ub-generation-qualifier-length INTEGER ::= 3
ub-given-name-length INTEGER ::= 16
ub-initials-length INTEGER ::= 5
ub-integer-options INTEGER ::= 256
ub-numeric-user-id-length INTEGER ::= 32
ub-organization-name-length INTEGER ::= 64
ub-organizational-unit-name-length INTEGER ::= 32
ub-organizational-units INTEGER ::= 4
ub-pds-name-length INTEGER ::= 16
ub-pds-parameter-length INTEGER ::= 30
ub-pds-physical-address-lines INTEGER ::= 6
ub-postal-code-length INTEGER ::= 16
ub-surname-length INTEGER ::= 40
ub-terminal-id-length INTEGER ::= 24
ub-unformatted-address-length INTEGER ::= 180
ub-common-name-length INTEGER ::= 64
ub-country-name-alpha-length INTEGER ::= 2
ub-country-name-numeric-length INTEGER ::= 3
ub-domain-defined-attributes INTEGER ::= 4
ub-domain-defined-attribute-type-length INTEGER ::= 8
ub-domain-defined-attribute-value-length INTEGER ::= 128
ub-domain-name-length INTEGER ::= 16
ub-extension-attributes INTEGER ::= 256
ub-e163-4-number-length INTEGER ::= 15
ub-e163-4-sub-address-length INTEGER ::= 40
ub-generation-qualifier-length INTEGER ::= 3
ub-given-name-length INTEGER ::= 16
ub-initials-length INTEGER ::= 5
ub-integer-options INTEGER ::= 256
ub-numeric-user-id-length INTEGER ::= 32
ub-organization-name-length INTEGER ::= 64
ub-organizational-unit-name-length INTEGER ::= 32
ub-organizational-units INTEGER ::= 4
ub-pds-name-length INTEGER ::= 16
ub-pds-parameter-length INTEGER ::= 30
ub-pds-physical-address-lines INTEGER ::= 6
ub-postal-code-length INTEGER ::= 16
ub-surname-length INTEGER ::= 40
ub-terminal-id-length INTEGER ::= 24
ub-unformatted-address-length INTEGER ::= 180
ub-x121-address-length INTEGER ::= 16
ub-x121-address-length INTEGER ::= 16
-- Note - upper bounds on TeletexString are measured in characters.
-- A significantly greater number of octets will be required to hold
-- such a value. As a minimum, 16 octets, or twice the specified upper
-- bound, whichever is the larger, should be allowed.
-- Note - upper bounds on TeletexString are measured in characters.
-- A significantly greater number of octets will be required to hold
-- such a value. As a minimum, 16 octets, or twice the specified upper
-- bound, whichever is the larger, should be allowed.
END
终止
PKIX1Implicit93 {iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0) id-pkix1-implicit-93(4)}
PKIX1Implicit93 {iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0) id-pkix1-implicit-93(4)}
DEFINITIONS IMPLICIT TAGS::=
DEFINITIONS IMPLICIT TAGS::=
BEGIN
开始
--EXPORTS ALL --
--全部出口--
IMPORTS
id-pe, id-qt, id-kp, id-ad, id-qt-unotice,
ORAddress, Name, RelativeDistinguishedName,
CertificateSerialNumber, CertificateList,
AlgorithmIdentifier, ub-name, DirectoryString,
Attribute, EXTENSION
FROM PKIX1Explicit93 {iso(1) identified-organization(3)
dod(6) internet(1) security(5) mechanisms(5) pkix(7)
id-mod(0) id-pkix1-explicit-93(3)};
IMPORTS
id-pe, id-qt, id-kp, id-ad, id-qt-unotice,
ORAddress, Name, RelativeDistinguishedName,
CertificateSerialNumber, CertificateList,
AlgorithmIdentifier, ub-name, DirectoryString,
Attribute, EXTENSION
FROM PKIX1Explicit93 {iso(1) identified-organization(3)
dod(6) internet(1) security(5) mechanisms(5) pkix(7)
id-mod(0) id-pkix1-explicit-93(3)};
-- Key and policy information extensions --
--关键和策略信息扩展--
authorityKeyIdentifier EXTENSION ::= {
SYNTAX AuthorityKeyIdentifier
IDENTIFIED BY id-ce-authorityKeyIdentifier }
authorityKeyIdentifier EXTENSION ::= {
SYNTAX AuthorityKeyIdentifier
IDENTIFIED BY id-ce-authorityKeyIdentifier }
AuthorityKeyIdentifier ::= SEQUENCE {
keyIdentifier [0] KeyIdentifier OPTIONAL,
authorityCertIssuer [1] GeneralNames OPTIONAL,
authorityCertSerialNumber [2] CertificateSerialNumber OPTIONAL }
( WITH COMPONENTS {..., authorityCertIssuer PRESENT,
authorityCertSerialNumber PRESENT} |
WITH COMPONENTS {..., authorityCertIssuer ABSENT,
authorityCertSerialNumber ABSENT} )
AuthorityKeyIdentifier ::= SEQUENCE {
keyIdentifier [0] KeyIdentifier OPTIONAL,
authorityCertIssuer [1] GeneralNames OPTIONAL,
authorityCertSerialNumber [2] CertificateSerialNumber OPTIONAL }
( WITH COMPONENTS {..., authorityCertIssuer PRESENT,
authorityCertSerialNumber PRESENT} |
WITH COMPONENTS {..., authorityCertIssuer ABSENT,
authorityCertSerialNumber ABSENT} )
KeyIdentifier ::= OCTET STRING
KeyIdentifier ::= OCTET STRING
subjectKeyIdentifier EXTENSION ::= {
SYNTAX SubjectKeyIdentifier
IDENTIFIED BY id-ce-subjectKeyIdentifier }
subjectKeyIdentifier EXTENSION ::= {
SYNTAX SubjectKeyIdentifier
IDENTIFIED BY id-ce-subjectKeyIdentifier }
SubjectKeyIdentifier ::= KeyIdentifier
SubjectKeyIdentifier ::= KeyIdentifier
keyUsage EXTENSION ::= {
SYNTAX KeyUsage
IDENTIFIED BY id-ce-keyUsage }
keyUsage EXTENSION ::= {
SYNTAX KeyUsage
IDENTIFIED BY id-ce-keyUsage }
KeyUsage ::= BIT STRING {
digitalSignature (0),
nonRepudiation (1),
keyEncipherment (2),
dataEncipherment (3),
keyAgreement (4),
keyCertSign (5),
cRLSign (6),
encipherOnly (7),
decipherOnly (8) }
KeyUsage ::= BIT STRING {
digitalSignature (0),
nonRepudiation (1),
keyEncipherment (2),
dataEncipherment (3),
keyAgreement (4),
keyCertSign (5),
cRLSign (6),
encipherOnly (7),
decipherOnly (8) }
extendedKeyUsage EXTENSION ::= {
SYNTAX SEQUENCE SIZE (1..MAX) OF KeyPurposeId
IDENTIFIED BY id-ce-extKeyUsage }
extendedKeyUsage EXTENSION ::= {
SYNTAX SEQUENCE SIZE (1..MAX) OF KeyPurposeId
IDENTIFIED BY id-ce-extKeyUsage }
KeyPurposeId ::= OBJECT IDENTIFIER
KeyPurposeId ::= OBJECT IDENTIFIER
-- PKIX-defined extended key purpose OIDs
id-kp-serverAuth OBJECT IDENTIFIER ::= { id-kp 1 }
id-kp-clientAuth OBJECT IDENTIFIER ::= { id-kp 2 }
id-kp-codeSigning OBJECT IDENTIFIER ::= { id-kp 3 }
id-kp-emailProtection OBJECT IDENTIFIER ::= { id-kp 4 }
id-kp-ipsecEndSystem OBJECT IDENTIFIER ::= { id-kp 5 }
id-kp-ipsecTunnel OBJECT IDENTIFIER ::= { id-kp 6 }
id-kp-ipsecUser OBJECT IDENTIFIER ::= { id-kp 7 }
id-kp-timeStamping OBJECT IDENTIFIER ::= { id-kp 8 }
-- PKIX-defined extended key purpose OIDs
id-kp-serverAuth OBJECT IDENTIFIER ::= { id-kp 1 }
id-kp-clientAuth OBJECT IDENTIFIER ::= { id-kp 2 }
id-kp-codeSigning OBJECT IDENTIFIER ::= { id-kp 3 }
id-kp-emailProtection OBJECT IDENTIFIER ::= { id-kp 4 }
id-kp-ipsecEndSystem OBJECT IDENTIFIER ::= { id-kp 5 }
id-kp-ipsecTunnel OBJECT IDENTIFIER ::= { id-kp 6 }
id-kp-ipsecUser OBJECT IDENTIFIER ::= { id-kp 7 }
id-kp-timeStamping OBJECT IDENTIFIER ::= { id-kp 8 }
privateKeyUsagePeriod EXTENSION ::= {
SYNTAX PrivateKeyUsagePeriod
IDENTIFIED BY { id-ce-privateKeyUsagePeriod } }
privateKeyUsagePeriod EXTENSION ::= {
SYNTAX PrivateKeyUsagePeriod
IDENTIFIED BY { id-ce-privateKeyUsagePeriod } }
PrivateKeyUsagePeriod ::= SEQUENCE {
notBefore [0] GeneralizedTime OPTIONAL,
notAfter [1] GeneralizedTime OPTIONAL }
( WITH COMPONENTS {..., notBefore PRESENT} |
WITH COMPONENTS {..., notAfter PRESENT} )
PrivateKeyUsagePeriod ::= SEQUENCE {
notBefore [0] GeneralizedTime OPTIONAL,
notAfter [1] GeneralizedTime OPTIONAL }
( WITH COMPONENTS {..., notBefore PRESENT} |
WITH COMPONENTS {..., notAfter PRESENT} )
certificatePolicies EXTENSION ::= {
SYNTAX CertificatePoliciesSyntax
IDENTIFIED BY id-ce-certificatePolicies }
certificatePolicies EXTENSION ::= {
SYNTAX CertificatePoliciesSyntax
IDENTIFIED BY id-ce-certificatePolicies }
CertificatePoliciesSyntax ::=
SEQUENCE SIZE (1..MAX) OF PolicyInformation
CertificatePoliciesSyntax ::=
SEQUENCE SIZE (1..MAX) OF PolicyInformation
PolicyInformation ::= SEQUENCE {
policyIdentifier CertPolicyId,
policyQualifiers SEQUENCE SIZE (1..MAX) OF
PolicyQualifierInfo OPTIONAL }
PolicyInformation ::= SEQUENCE {
policyIdentifier CertPolicyId,
policyQualifiers SEQUENCE SIZE (1..MAX) OF
PolicyQualifierInfo OPTIONAL }
CertPolicyId ::= OBJECT IDENTIFIER
CertPolicyId ::= OBJECT IDENTIFIER
PolicyQualifierInfo ::= SEQUENCE {
policyQualifierId CERT-POLICY-QUALIFIER.&id
({SupportedPolicyQualifiers}),
qualifier CERT-POLICY-QUALIFIER.&Qualifier
({SupportedPolicyQualifiers}
{@policyQualifierId})OPTIONAL }
PolicyQualifierInfo ::= SEQUENCE {
policyQualifierId CERT-POLICY-QUALIFIER.&id
({SupportedPolicyQualifiers}),
qualifier CERT-POLICY-QUALIFIER.&Qualifier
({SupportedPolicyQualifiers}
{@policyQualifierId})OPTIONAL }
SupportedPolicyQualifiers CERT-POLICY-QUALIFIER ::= { noticeToUser |
pointerToCPS }
SupportedPolicyQualifiers CERT-POLICY-QUALIFIER ::= { noticeToUser |
pointerToCPS }
CERT-POLICY-QUALIFIER ::= CLASS {
&id OBJECT IDENTIFIER UNIQUE,
&Qualifier OPTIONAL }
WITH SYNTAX {
POLICY-QUALIFIER-ID &id
[QUALIFIER-TYPE &Qualifier] }
CERT-POLICY-QUALIFIER ::= CLASS {
&id OBJECT IDENTIFIER UNIQUE,
&Qualifier OPTIONAL }
WITH SYNTAX {
POLICY-QUALIFIER-ID &id
[QUALIFIER-TYPE &Qualifier] }
policyMappings EXTENSION ::= {
SYNTAX PolicyMappingsSyntax
IDENTIFIED BY id-ce-policyMappings }
policyMappings EXTENSION ::= {
SYNTAX PolicyMappingsSyntax
IDENTIFIED BY id-ce-policyMappings }
PolicyMappingsSyntax ::= SEQUENCE SIZE (1..MAX) OF SEQUENCE {
issuerDomainPolicy CertPolicyId,
subjectDomainPolicy CertPolicyId }
PolicyMappingsSyntax ::= SEQUENCE SIZE (1..MAX) OF SEQUENCE {
issuerDomainPolicy CertPolicyId,
subjectDomainPolicy CertPolicyId }
-- Certificate subject and certificate issuer attributes extensions --
--证书主题和证书颁发者属性扩展--
subjectAltName EXTENSION ::= {
SYNTAX GeneralNames
IDENTIFIED BY id-ce-subjectAltName }
subjectAltName EXTENSION ::= {
SYNTAX GeneralNames
IDENTIFIED BY id-ce-subjectAltName }
GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
GeneralName ::= CHOICE {
otherName [0] INSTANCE OF OTHER-NAME,
rfc822Name [1] IA5String,
dNSName [2] IA5String,
x400Address [3] ORAddress,
directoryName [4] Name,
ediPartyName [5] EDIPartyName,
uniformResourceIdentifier [6] IA5String,
iPAddress [7] OCTET STRING,
registeredID [8] OBJECT IDENTIFIER }
GeneralName ::= CHOICE {
otherName [0] INSTANCE OF OTHER-NAME,
rfc822Name [1] IA5String,
dNSName [2] IA5String,
x400Address [3] ORAddress,
directoryName [4] Name,
ediPartyName [5] EDIPartyName,
uniformResourceIdentifier [6] IA5String,
iPAddress [7] OCTET STRING,
registeredID [8] OBJECT IDENTIFIER }
OTHER-NAME ::= TYPE-IDENTIFIER
OTHER-NAME ::= TYPE-IDENTIFIER
EDIPartyName ::= SEQUENCE {
nameAssigner [0] DirectoryString {ub-name} OPTIONAL,
partyName [1] DirectoryString {ub-name} }
EDIPartyName ::= SEQUENCE {
nameAssigner [0] DirectoryString {ub-name} OPTIONAL,
partyName [1] DirectoryString {ub-name} }
issuerAltName EXTENSION ::= {
SYNTAX GeneralNames
IDENTIFIED BY id-ce-issuerAltName }
issuerAltName EXTENSION ::= {
SYNTAX GeneralNames
IDENTIFIED BY id-ce-issuerAltName }
subjectDirectoryAttributes EXTENSION ::= {
SYNTAX AttributesSyntax
IDENTIFIED BY id-ce-subjectDirectoryAttributes }
subjectDirectoryAttributes EXTENSION ::= {
SYNTAX AttributesSyntax
IDENTIFIED BY id-ce-subjectDirectoryAttributes }
AttributesSyntax ::= SEQUENCE SIZE (1..MAX) OF Attribute
AttributesSyntax ::= SEQUENCE SIZE (1..MAX) OF Attribute
-- Certification path constraints extensions --
--证书路径约束扩展--
basicConstraints EXTENSION ::= {
SYNTAX BasicConstraintsSyntax
IDENTIFIED BY id-ce-basicConstraints }
basicConstraints EXTENSION ::= {
SYNTAX BasicConstraintsSyntax
IDENTIFIED BY id-ce-basicConstraints }
BasicConstraintsSyntax ::= SEQUENCE {
cA BOOLEAN DEFAULT FALSE,
pathLenConstraint INTEGER (0..MAX) OPTIONAL }
BasicConstraintsSyntax ::= SEQUENCE {
cA BOOLEAN DEFAULT FALSE,
pathLenConstraint INTEGER (0..MAX) OPTIONAL }
nameConstraints EXTENSION ::= {
SYNTAX NameConstraintsSyntax
IDENTIFIED BY id-ce-nameConstraints }
nameConstraints EXTENSION ::= {
SYNTAX NameConstraintsSyntax
IDENTIFIED BY id-ce-nameConstraints }
NameConstraintsSyntax ::= SEQUENCE {
permittedSubtrees [0] GeneralSubtrees OPTIONAL,
excludedSubtrees [1] GeneralSubtrees OPTIONAL }
NameConstraintsSyntax ::= SEQUENCE {
permittedSubtrees [0] GeneralSubtrees OPTIONAL,
excludedSubtrees [1] GeneralSubtrees OPTIONAL }
GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
GeneralSubtree ::= SEQUENCE {
base GeneralName,
minimum [0] BaseDistance DEFAULT 0,
maximum [1] BaseDistance OPTIONAL }
GeneralSubtree ::= SEQUENCE {
base GeneralName,
minimum [0] BaseDistance DEFAULT 0,
maximum [1] BaseDistance OPTIONAL }
BaseDistance ::= INTEGER (0..MAX)
BaseDistance ::= INTEGER (0..MAX)
policyConstraints EXTENSION ::= {
SYNTAX PolicyConstraintsSyntax
IDENTIFIED BY id-ce-policyConstraints }
policyConstraints EXTENSION ::= {
SYNTAX PolicyConstraintsSyntax
IDENTIFIED BY id-ce-policyConstraints }
PolicyConstraintsSyntax ::= SEQUENCE {
requireExplicitPolicy [0] SkipCerts OPTIONAL,
inhibitPolicyMapping [1] SkipCerts OPTIONAL }
PolicyConstraintsSyntax ::= SEQUENCE {
requireExplicitPolicy [0] SkipCerts OPTIONAL,
inhibitPolicyMapping [1] SkipCerts OPTIONAL }
SkipCerts ::= INTEGER (0..MAX)
SkipCerts ::= INTEGER (0..MAX)
-- Basic CRL extensions --
--基本CRL扩展--
cRLNumber EXTENSION ::= {
SYNTAX CRLNumber
IDENTIFIED BY id-ce-cRLNumber }
cRLNumber EXTENSION ::= {
SYNTAX CRLNumber
IDENTIFIED BY id-ce-cRLNumber }
CRLNumber ::= INTEGER (0..MAX)
CRLNumber ::= INTEGER (0..MAX)
reasonCode EXTENSION ::= {
SYNTAX CRLReason
IDENTIFIED BY id-ce-reasonCode }
reasonCode EXTENSION ::= {
SYNTAX CRLReason
IDENTIFIED BY id-ce-reasonCode }
CRLReason ::= ENUMERATED {
unspecified (0),
keyCompromise (1),
cACompromise (2),
affiliationChanged (3),
superseded (4),
cessationOfOperation (5),
certificateHold (6),
removeFromCRL (8) }
CRLReason ::= ENUMERATED {
unspecified (0),
keyCompromise (1),
cACompromise (2),
affiliationChanged (3),
superseded (4),
cessationOfOperation (5),
certificateHold (6),
removeFromCRL (8) }
instructionCode EXTENSION ::= {
SYNTAX HoldInstruction
IDENTIFIED BY id-ce-instructionCode }
instructionCode EXTENSION ::= {
SYNTAX HoldInstruction
IDENTIFIED BY id-ce-instructionCode }
HoldInstruction ::= OBJECT IDENTIFIER
HoldInstruction ::= OBJECT IDENTIFIER
-- holdinstructions described in this specification, from ANSI x9
--根据ANSI x9，保存本规范中所述的说明
-- ANSI x9 arc holdinstruction arc
holdInstruction OBJECT IDENTIFIER ::= {
joint-iso-ccitt(2) member-body(2) us(840) x9cm(10040) 2}
-- ANSI x9 arc holdinstruction arc
holdInstruction OBJECT IDENTIFIER ::= {
joint-iso-ccitt(2) member-body(2) us(840) x9cm(10040) 2}
-- ANSI X9 holdinstructions referenced by this standard
id-holdinstruction-none OBJECT IDENTIFIER ::= {holdInstruction 1}
id-holdinstruction-callissuer OBJECT IDENTIFIER ::= {holdInstruction 2}
id-holdinstruction-reject OBJECT IDENTIFIER ::= {holdInstruction 3}
-- ANSI X9 holdinstructions referenced by this standard
id-holdinstruction-none OBJECT IDENTIFIER ::= {holdInstruction 1}
id-holdinstruction-callissuer OBJECT IDENTIFIER ::= {holdInstruction 2}
id-holdinstruction-reject OBJECT IDENTIFIER ::= {holdInstruction 3}
invalidityDate EXTENSION ::= {
SYNTAX GeneralizedTime
IDENTIFIED BY id-ce-invalidityDate }
invalidityDate EXTENSION ::= {
SYNTAX GeneralizedTime
IDENTIFIED BY id-ce-invalidityDate }
-- CRL distribution points and delta-CRL extensions --
--CRL分发点和增量CRL扩展--
cRLDistributionPoints EXTENSION ::= {
cRLDistributionPoints EXTENSION ::= {
SYNTAX CRLDistPointsSyntax IDENTIFIED BY id-ce-cRLDistributionPoints }
由id ce cRLDistributionPoints}标识的语法CRLDISPOINTSSSYNTAX
CRLDistPointsSyntax ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint
CRLDistPointsSyntax ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint
DistributionPoint ::= SEQUENCE {
distributionPoint [0] DistributionPointName OPTIONAL,
reasons [1] ReasonFlags OPTIONAL,
cRLIssuer [2] GeneralNames OPTIONAL }
DistributionPoint ::= SEQUENCE {
distributionPoint [0] DistributionPointName OPTIONAL,
reasons [1] ReasonFlags OPTIONAL,
cRLIssuer [2] GeneralNames OPTIONAL }
DistributionPointName ::= CHOICE {
fullName [0] GeneralNames,
nameRelativeToCRLIssuer [1] RelativeDistinguishedName }
DistributionPointName ::= CHOICE {
fullName [0] GeneralNames,
nameRelativeToCRLIssuer [1] RelativeDistinguishedName }
ReasonFlags ::= BIT STRING {
unused (0),
keyCompromise (1),
caCompromise (2),
affiliationChanged (3),
superseded (4),
cessationOfOperation (5),
certificateHold (6) }
ReasonFlags ::= BIT STRING {
unused (0),
keyCompromise (1),
caCompromise (2),
affiliationChanged (3),
superseded (4),
cessationOfOperation (5),
certificateHold (6) }
issuingDistributionPoint EXTENSION ::= {
SYNTAX IssuingDistPointSyntax
IDENTIFIED BY id-ce-issuingDistributionPoint }
issuingDistributionPoint EXTENSION ::= {
SYNTAX IssuingDistPointSyntax
IDENTIFIED BY id-ce-issuingDistributionPoint }
IssuingDistPointSyntax ::= SEQUENCE {
distributionPoint [0] DistributionPointName OPTIONAL,
onlyContainsUserCerts [1] BOOLEAN DEFAULT FALSE,
onlyContainsCACerts [2] BOOLEAN DEFAULT FALSE,
onlySomeReasons [3] ReasonFlags OPTIONAL,
indirectCRL [4] BOOLEAN DEFAULT FALSE }
IssuingDistPointSyntax ::= SEQUENCE {
distributionPoint [0] DistributionPointName OPTIONAL,
onlyContainsUserCerts [1] BOOLEAN DEFAULT FALSE,
onlyContainsCACerts [2] BOOLEAN DEFAULT FALSE,
onlySomeReasons [3] ReasonFlags OPTIONAL,
indirectCRL [4] BOOLEAN DEFAULT FALSE }
certificateIssuer EXTENSION ::= {
SYNTAX GeneralNames
IDENTIFIED BY id-ce-certificateIssuer }
certificateIssuer EXTENSION ::= {
SYNTAX GeneralNames
IDENTIFIED BY id-ce-certificateIssuer }
deltaCRLIndicator EXTENSION ::= {
SYNTAX BaseCRLNumber
IDENTIFIED BY id-ce-deltaCRLIndicator }
deltaCRLIndicator EXTENSION ::= {
SYNTAX BaseCRLNumber
IDENTIFIED BY id-ce-deltaCRLIndicator }
BaseCRLNumber ::= CRLNumber
BaseCRLNumber ::= CRLNumber
-- Object identifier assignments for ISO certificate extensions --
id-ce OBJECT IDENTIFIER ::= {joint-iso-ccitt(2) ds(5) 29}
-- Object identifier assignments for ISO certificate extensions --
id-ce OBJECT IDENTIFIER ::= {joint-iso-ccitt(2) ds(5) 29}
id-ce-subjectDirectoryAttributes OBJECT IDENTIFIER ::= {id-ce 9}
id-ce-subjectDirectoryAttributes OBJECT IDENTIFIER ::= {id-ce 9}
id-ce-subjectKeyIdentifier OBJECT IDENTIFIER ::= {id-ce 14}
id-ce-keyUsage OBJECT IDENTIFIER ::= {id-ce 15}
id-ce-privateKeyUsagePeriod OBJECT IDENTIFIER ::= {id-ce 16}
id-ce-subjectAltName OBJECT IDENTIFIER ::= {id-ce 17}
id-ce-issuerAltName OBJECT IDENTIFIER ::= {id-ce 18}
id-ce-basicConstraints OBJECT IDENTIFIER ::= {id-ce 19}
id-ce-cRLNumber OBJECT IDENTIFIER ::= {id-ce 20}
id-ce-reasonCode OBJECT IDENTIFIER ::= {id-ce 21}
id-ce-instructionCode OBJECT IDENTIFIER ::= {id-ce 23}
id-ce-invalidityDate OBJECT IDENTIFIER ::= {id-ce 24}
id-ce-deltaCRLIndicator OBJECT IDENTIFIER ::= {id-ce 27}
id-ce-issuingDistributionPoint OBJECT IDENTIFIER ::= {id-ce 28}
id-ce-certificateIssuer OBJECT IDENTIFIER ::= {id-ce 29}
id-ce-nameConstraints OBJECT IDENTIFIER ::= {id-ce 30}
id-ce-cRLDistributionPoints OBJECT IDENTIFIER ::= {id-ce 31}
id-ce-certificatePolicies OBJECT IDENTIFIER ::= {id-ce 32}
id-ce-policyMappings OBJECT IDENTIFIER ::= {id-ce 33}
id-ce-policyConstraints OBJECT IDENTIFIER ::= {id-ce 36}
id-ce-authorityKeyIdentifier OBJECT IDENTIFIER ::= {id-ce 35}
id-ce-extKeyUsage OBJECT IDENTIFIER ::= {id-ce 37}
id-ce-subjectKeyIdentifier OBJECT IDENTIFIER ::= {id-ce 14}
id-ce-keyUsage OBJECT IDENTIFIER ::= {id-ce 15}
id-ce-privateKeyUsagePeriod OBJECT IDENTIFIER ::= {id-ce 16}
id-ce-subjectAltName OBJECT IDENTIFIER ::= {id-ce 17}
id-ce-issuerAltName OBJECT IDENTIFIER ::= {id-ce 18}
id-ce-basicConstraints OBJECT IDENTIFIER ::= {id-ce 19}
id-ce-cRLNumber OBJECT IDENTIFIER ::= {id-ce 20}
id-ce-reasonCode OBJECT IDENTIFIER ::= {id-ce 21}
id-ce-instructionCode OBJECT IDENTIFIER ::= {id-ce 23}
id-ce-invalidityDate OBJECT IDENTIFIER ::= {id-ce 24}
id-ce-deltaCRLIndicator OBJECT IDENTIFIER ::= {id-ce 27}
id-ce-issuingDistributionPoint OBJECT IDENTIFIER ::= {id-ce 28}
id-ce-certificateIssuer OBJECT IDENTIFIER ::= {id-ce 29}
id-ce-nameConstraints OBJECT IDENTIFIER ::= {id-ce 30}
id-ce-cRLDistributionPoints OBJECT IDENTIFIER ::= {id-ce 31}
id-ce-certificatePolicies OBJECT IDENTIFIER ::= {id-ce 32}
id-ce-policyMappings OBJECT IDENTIFIER ::= {id-ce 33}
id-ce-policyConstraints OBJECT IDENTIFIER ::= {id-ce 36}
id-ce-authorityKeyIdentifier OBJECT IDENTIFIER ::= {id-ce 35}
id-ce-extKeyUsage OBJECT IDENTIFIER ::= {id-ce 37}
-- PKIX 1 extensions
--PKIX 1扩展
authorityInfoAccess EXTENSION ::= {
SYNTAX AuthorityInfoAccessSyntax
IDENTIFIED BY id-pe-authorityInfoAccess }
authorityInfoAccess EXTENSION ::= {
SYNTAX AuthorityInfoAccessSyntax
IDENTIFIED BY id-pe-authorityInfoAccess }
AuthorityInfoAccessSyntax ::=
SEQUENCE SIZE (1..MAX) OF AccessDescription
AuthorityInfoAccessSyntax ::=
SEQUENCE SIZE (1..MAX) OF AccessDescription
AccessDescription ::= SEQUENCE {
accessMethod OBJECT IDENTIFIER,
accessLocation GeneralName }
AccessDescription ::= SEQUENCE {
accessMethod OBJECT IDENTIFIER,
accessLocation GeneralName }
id-pe-authorityInfoAccess OBJECT IDENTIFIER ::= { id-pe 1 }
id-pe-authorityInfoAccess OBJECT IDENTIFIER ::= { id-pe 1 }
id-ad-ocsp OBJECT IDENTIFIER ::= { id-ad 1 }
id-ad-caIssuers OBJECT IDENTIFIER ::= { id-ad 2 }
id-ad-ocsp OBJECT IDENTIFIER ::= { id-ad 1 }
id-ad-caIssuers OBJECT IDENTIFIER ::= { id-ad 2 }
-- PKIX policy qualifier definitions
--PKIX策略限定符定义
noticeToUser CERT-POLICY-QUALIFIER ::= {
POLICY-QUALIFIER-ID id-qt-cps QUALIFIER-TYPE CPSuri}
noticeToUser CERT-POLICY-QUALIFIER ::= {
POLICY-QUALIFIER-ID id-qt-cps QUALIFIER-TYPE CPSuri}
pointerToCPS CERT-POLICY-QUALIFIER ::= {
POLICY-QUALIFIER-ID id-qt-unotice QUALIFIER-TYPE UserNotice}
pointerToCPS CERT-POLICY-QUALIFIER ::= {
POLICY-QUALIFIER-ID id-qt-unotice QUALIFIER-TYPE UserNotice}
id-qt-cps OBJECT IDENTIFIER ::= { id-qt 1 }
id-qt-cps OBJECT IDENTIFIER ::= { id-qt 1 }
id-qt-unotice OBJECT IDENTIFIER ::= { id-qt 2 }
id-qt-unotice OBJECT IDENTIFIER ::= { id-qt 2 }
CPSuri ::= IA5String
CPSuri ::= IA5String
UserNotice ::= SEQUENCE {
noticeRef NoticeReference OPTIONAL,
explicitText DisplayText OPTIONAL}
UserNotice ::= SEQUENCE {
noticeRef NoticeReference OPTIONAL,
explicitText DisplayText OPTIONAL}
NoticeReference ::= SEQUENCE {
organization DisplayText,
noticeNumbers SEQUENCE OF INTEGER }
NoticeReference ::= SEQUENCE {
organization DisplayText,
noticeNumbers SEQUENCE OF INTEGER }
DisplayText ::= CHOICE {
visibleString VisibleString (SIZE (1..200)),
bmpString BMPString (SIZE (1..200)),
utf8String UTF8String (SIZE (1..200)) }
DisplayText ::= CHOICE {
visibleString VisibleString (SIZE (1..200)),
bmpString BMPString (SIZE (1..200)),
utf8String UTF8String (SIZE (1..200)) }
END
终止
The construct "SEQUENCE SIZE (1..MAX) OF" appears in several ASN.1 constructs. A valid ASN.1 sequence will have zero or more entries. The SIZE (1..MAX) construct constrains the sequence to have at least one entry. MAX indicates the upper bound is unspecified. Implementations are free to choose an upper bound that suits their environment.
构造“序列大小（1..MAX）”出现在几个ASN.1构造中。一个有效的ASN.1序列将有零个或多个条目。SIZE（1..MAX）构造将序列约束为至少有一个条目。MAX表示未指定上限。实现可以自由选择适合其环境的上限。
The construct "positiveInt ::= INTEGER (0..MAX)" defines positiveInt
as a subtype of INTEGER containing integers greater than or equal to
zero. The upper bound is unspecified. Implementations are free to
select an upper bound that suits their environment.
The construct "positiveInt ::= INTEGER (0..MAX)" defines positiveInt
as a subtype of INTEGER containing integers greater than or equal to
zero. The upper bound is unspecified. Implementations are free to
select an upper bound that suits their environment.
The character string type PrintableString supports a very basic Latin character set: the lower case letters 'a' through 'z', upper case letters 'A' through 'Z', the digits '0' through '9', eleven special characters ' " ( ) + , - . / : ? and space.
字符串类型PrintableString支持一个非常基本的拉丁字符集：小写字母“a”到“z”、大写字母“a”到“z”、数字“0”到“9”、十一个特殊字符“（+）、-./：”和空格。
The character string type TeletexString is a superset of PrintableString. TeletexString supports a fairly standard (ascii-like) Latin character set, Latin characters with non-spacing accents and Japanese characters.
字符串类型的电传字符串是可打印字符串的超集。TeletextString支持相当标准（类似ascii）的拉丁字符集、带有非空格重音符号的拉丁字符和日语字符。
The character string type UniversalString supports any of the characters allowed by ISO 10646-1. ISO 10646 is the Universal multiple-octet coded Character Set (UCS). ISO 10646-1 specifes the architecture and the "basic multilingual plane" - a large standard character set which includes all major world character standards.
字符串类型UniversalString支持ISO 10646-1允许的任何字符。ISO10646是通用的多八位编码字符集（UCS）。ISO10646-1规定了体系结构和“基本多语言平面”——一个包含所有主要世界字符标准的大型标准字符集。
The character string type UTF8String will be introduced in the 1998 version of ASN.1. UTF8String is a universal type and has been assigned tag number 12. The content of UTF8String was defined by RFC 2044 and updated in RFC 2279, "UTF-8, a transformation Format of ISP 10646." ISO is expected to formally add UTF8String to the list of choices for DirectoryString in 1998 as well.
字符串类型UTF8String将在1998年版本的ASN.1中引入。UTF8String是一种通用类型，已分配标签号12。UTF8String的内容由RFC 2044定义，并在RFC 2279“UTF-8，ISP 10646的转换格式”中更新。预计ISO也将在1998年正式将UTF8String添加到DirectoryString的选择列表中。
In anticipation of these changes, and in conformance with IETF Best Practices codified in RFC 2277, IETF Policy on Character Sets and Languages, this document includes UTF8String as a choice in DirectoryString and the CPS qualifier extensions.
为应对这些变化，并符合RFC 2277《IETF字符集和语言政策》中编纂的IETF最佳实践，本文档将UTF8String作为DirectoryString和CPS限定符扩展中的一个选项。
This section contains four examples: three certificates and a CRL. The first two certificates and the CRL comprise a minimal certification path.
本节包含四个示例：三个证书和一个CRL。前两个证书和CRL包含一个最小的证书路径。
Section D.1 contains an annotated hex dump of a "self-signed" certificate issued by a CA whose distinguished name is cn=us,o=gov,ou=nist. The certificate contains a DSA public key with parameters, and is signed by the corresponding DSA private key.
第D.1节包含由CA颁发的“自签名”证书的带注释的十六进制转储，其可分辨名称为cn=us、o=gov、ou=nist。证书包含带参数的DSA公钥，并由相应的DSA私钥签名。
Section D.2 contains an annotated hex dump of an end-entity certificate. The end entity certificate contains a DSA public key, and is signed by the private key corresponding to the "self-signed" certificate in section D.1.
第D.2节包含终端实体证书的带注释的十六进制转储。终端实体证书包含一个DSA公钥，并由第D.1节中“自签名”证书对应的私钥签名。
Section D.3 contains a dump of an end entity certificate which contains an RSA public key and is signed with RSA and MD5. This certificate is not part of the minimal certification path.
第D.3节包含包含RSA公钥并使用RSA和MD5签名的最终实体证书的转储。此证书不是最小证书路径的一部分。
Section D.4 contains an annotated hex dump of a CRL. The CRL is issued by the CA whose distinguished name is cn=us,o=gov,ou=nist and the list of revoked certificates includes the end entity certificate presented in D.2.
第D.4节包含CRL的带注释的十六进制转储。CRL由CA颁发，其可分辨名称为cn=us、o=gov、ou=nist，已撤销证书列表包括D.2中给出的最终实体证书。
This section contains an annotated hex dump of a 699 byte version 3
certificate. The certificate contains the following information:
(a) the serial number is 17 (11 hex);
(b) the certificate is signed with DSA and the SHA-1 hash algorithm;
(c) the issuer's distinguished name is OU=nist; O=gov; C=US
(d) and the subject's distinguished name is OU=nist; O=gov; C=US
(e) the certificate was issued on June 30, 1997 and will expire on
December 31, 1997;
(f) the certificate contains a 1024 bit DSA public key with
parameters;
(g) the certificate contains a subject key identifier extension; and
(h) the certificate is a CA certificate (as indicated through the
basic constraints extension.)
This section contains an annotated hex dump of a 699 byte version 3
certificate. The certificate contains the following information:
(a) the serial number is 17 (11 hex);
(b) the certificate is signed with DSA and the SHA-1 hash algorithm;
(c) the issuer's distinguished name is OU=nist; O=gov; C=US
(d) and the subject's distinguished name is OU=nist; O=gov; C=US
(e) the certificate was issued on June 30, 1997 and will expire on
December 31, 1997;
(f) the certificate contains a 1024 bit DSA public key with
parameters;
(g) the certificate contains a subject key identifier extension; and
(h) the certificate is a CA certificate (as indicated through the
basic constraints extension.)
0000 30 82 02 b7 695: SEQUENCE 0004 30 82 02 77 631: . SEQUENCE tbscertificate 0008 a0 03 3: . . [0] 0010 02 01 1: . . . INTEGER 2 : 02 0013 02 01 1: . . INTEGER 17 : 11
0000 30 82 02 b7 695:序列0004 30 82 02 77 631:。序列tbscertificate 0008 a0 03 3:。[0] 0010 02 01 1: . . . 整数2:02 0013 02 01 1:。整数17:11
0016 30 09 9: . . SEQUENCE
0018 06 07 7: . . . OID 1.2.840.10040.4.3: dsa-with-sha
: 2a 86 48 ce 38 04 03
0027 30 2a 42: . . SEQUENCE
0029 31 0b 11: . . . SET
0031 30 09 9: . . . . SEQUENCE
0033 06 03 3: . . . . . OID 2.5.4.6: C
: 55 04 06
0038 13 02 2: . . . . . PrintableString 'US'
: 55 53
0042 31 0c 12: . . . SET
0044 30 0a 10: . . . . SEQUENCE
0046 06 03 3: . . . . . OID 2.5.4.10: O
: 55 04 0a
0051 13 03 3: . . . . . PrintableString 'gov'
: 67 6f 76
0056 31 0d 13: . . . SET
0058 30 0b 11: . . . . SEQUENCE
0060 06 03 3: . . . . . OID 2.5.4.11: OU
: 55 04 0b
0065 13 04 4: . . . . . PrintableString 'nist'
: 6e 69 73 74
0071 30 1e 30: . . SEQUENCE
0073 17 0d 13: . . . UTCTime '970630000000Z'
: 39 37 30 36 33 30 30 30 30 30 30 30 5a
0088 17 0d 13: . . . UTCTime '971231000000Z'
: 39 37 31 32 33 31 30 30 30 30 30 30 5a
0103 30 2a 42: . . SEQUENCE
0105 31 0b 11: . . . SET
0107 30 09 9: . . . . SEQUENCE
0109 06 03 3: . . . . . OID 2.5.4.6: C
: 55 04 06
0114 13 02 2: . . . . . PrintableString 'US'
: 55 53
0118 31 0c 12: . . . SET
0120 30 0a 10: . . . . SEQUENCE
0122 06 03 3: . . . . . OID 2.5.4.10: O
: 55 04 0a
0127 13 03 3: . . . . . PrintableString 'gov'
: 67 6f 76
0132 31 0d 13: . . . SET
0134 30 0b 11: . . . . SEQUENCE
0136 06 03 3: . . . . . OID 2.5.4.11: OU
: 55 04 0b
0141 13 04 4: . . . . . PrintableString 'nist'
: 6e 69 73 74
0147 30 82 01 b4 436: . . SEQUENCE
0151 30 82 01 29 297: . . . SEQUENCE
0016 30 09 9: . . SEQUENCE
0018 06 07 7: . . . OID 1.2.840.10040.4.3: dsa-with-sha
: 2a 86 48 ce 38 04 03
0027 30 2a 42: . . SEQUENCE
0029 31 0b 11: . . . SET
0031 30 09 9: . . . . SEQUENCE
0033 06 03 3: . . . . . OID 2.5.4.6: C
: 55 04 06
0038 13 02 2: . . . . . PrintableString 'US'
: 55 53
0042 31 0c 12: . . . SET
0044 30 0a 10: . . . . SEQUENCE
0046 06 03 3: . . . . . OID 2.5.4.10: O
: 55 04 0a
0051 13 03 3: . . . . . PrintableString 'gov'
: 67 6f 76
0056 31 0d 13: . . . SET
0058 30 0b 11: . . . . SEQUENCE
0060 06 03 3: . . . . . OID 2.5.4.11: OU
: 55 04 0b
0065 13 04 4: . . . . . PrintableString 'nist'
: 6e 69 73 74
0071 30 1e 30: . . SEQUENCE
0073 17 0d 13: . . . UTCTime '970630000000Z'
: 39 37 30 36 33 30 30 30 30 30 30 30 5a
0088 17 0d 13: . . . UTCTime '971231000000Z'
: 39 37 31 32 33 31 30 30 30 30 30 30 5a
0103 30 2a 42: . . SEQUENCE
0105 31 0b 11: . . . SET
0107 30 09 9: . . . . SEQUENCE
0109 06 03 3: . . . . . OID 2.5.4.6: C
: 55 04 06
0114 13 02 2: . . . . . PrintableString 'US'
: 55 53
0118 31 0c 12: . . . SET
0120 30 0a 10: . . . . SEQUENCE
0122 06 03 3: . . . . . OID 2.5.4.10: O
: 55 04 0a
0127 13 03 3: . . . . . PrintableString 'gov'
: 67 6f 76
0132 31 0d 13: . . . SET
0134 30 0b 11: . . . . SEQUENCE
0136 06 03 3: . . . . . OID 2.5.4.11: OU
: 55 04 0b
0141 13 04 4: . . . . . PrintableString 'nist'
: 6e 69 73 74
0147 30 82 01 b4 436: . . SEQUENCE
0151 30 82 01 29 297: . . . SEQUENCE
0155 06 07 7: . . . . OID 1.2.840.10040.4.1: dsa
: 2a 86 48 ce 38 04 01
0164 30 82 01 1c 284: . . . . SEQUENCE
0168 02 81 80 128: . . . . . INTEGER
: d4 38 02 c5 35 7b d5 0b a1 7e 5d 72 59 63 55 d3
: 45 56 ea e2 25 1a 6b c5 a4 ab aa 0b d4 62 b4 d2
: 21 b1 95 a2 c6 01 c9 c3 fa 01 6f 79 86 83 3d 03
: 61 e1 f1 92 ac bc 03 4e 89 a3 c9 53 4a f7 e2 a6
: 48 cf 42 1e 21 b1 5c 2b 3a 7f ba be 6b 5a f7 0a
: 26 d8 8e 1b eb ec bf 1e 5a 3f 45 c0 bd 31 23 be
: 69 71 a7 c2 90 fe a5 d6 80 b5 24 dc 44 9c eb 4d
: f9 da f0 c8 e8 a2 4c 99 07 5c 8e 35 2b 7d 57 8d
0299 02 14 20: . . . . . INTEGER
: a7 83 9b f3 bd 2c 20 07 fc 4c e7 e8 9f f3 39 83
: 51 0d dc dd
0321 02 81 80 128: . . . . . INTEGER
: 0e 3b 46 31 8a 0a 58 86 40 84 e3 a1 22 0d 88 ca
: 90 88 57 64 9f 01 21 e0 15 05 94 24 82 e2 10 90
: d9 e1 4e 10 5c e7 54 6b d4 0c 2b 1b 59 0a a0 b5
: a1 7d b5 07 e3 65 7c ea 90 d8 8e 30 42 e4 85 bb
: ac fa 4e 76 4b 78 0e df 6c e5 a6 e1 bd 59 77 7d
: a6 97 59 c5 29 a7 b3 3f 95 3e 9d f1 59 2d f7 42
: 87 62 3f f1 b8 6f c7 3d 4b b8 8d 74 c4 ca 44 90
: cf 67 db de 14 60 97 4a d1 f7 6d 9e 09 94 c4 0d
0452 03 81 84 132: . . . BIT STRING (0 unused bits)
: 02 81 80 aa 98 ea 13 94 a2 db f1 5b 7f 98 2f 78
: e7 d8 e3 b9 71 86 f6 80 2f 40 39 c3 da 3b 4b 13
: 46 26 ee 0d 56 c5 a3 3a 39 b7 7d 33 c2 6b 5c 77
: 92 f2 55 65 90 39 cd 1a 3c 86 e1 32 eb 25 bc 91
: c4 ff 80 4f 36 61 bd cc e2 61 04 e0 7e 60 13 ca
: c0 9c dd e0 ea 41 de 33 c1 f1 44 a9 bc 71 de cf
: 59 d4 6e da 44 99 3c 21 64 e4 78 54 9d d0 7b ba
: 4e f5 18 4d 5e 39 30 bf e0 d1 f6 f4 83 25 4f 14
: aa 71 e1
0587 a3 32 50: . . [3]
0589 30 30 48: . . . SEQUENCE
0591 30 0f 9: . . . . SEQUENCE
0593 06 03 3: . . . . . OID 2.5.29.19: basicConstraints
: 55 1d 13
0598 01 01 1: . . . . . TRUE
: ff
0601 04 05 5: . . . . . OCTET STRING
: 30 03 01 01 ff
0608 30 1d 29: . SEQUENCE
0610 06 03 3: . . . . . OID 2.5.29.14: subjectKeyIdentifier
: 55 1d 0e
0615 04 16 22: . . . . . OCTET STRING
: 04 14 e7 26 c5 54 cd 5b a3 6f 35 68 95 aa d5 ff
0155 06 07 7: . . . . OID 1.2.840.10040.4.1: dsa
: 2a 86 48 ce 38 04 01
0164 30 82 01 1c 284: . . . . SEQUENCE
0168 02 81 80 128: . . . . . INTEGER
: d4 38 02 c5 35 7b d5 0b a1 7e 5d 72 59 63 55 d3
: 45 56 ea e2 25 1a 6b c5 a4 ab aa 0b d4 62 b4 d2
: 21 b1 95 a2 c6 01 c9 c3 fa 01 6f 79 86 83 3d 03
: 61 e1 f1 92 ac bc 03 4e 89 a3 c9 53 4a f7 e2 a6
: 48 cf 42 1e 21 b1 5c 2b 3a 7f ba be 6b 5a f7 0a
: 26 d8 8e 1b eb ec bf 1e 5a 3f 45 c0 bd 31 23 be
: 69 71 a7 c2 90 fe a5 d6 80 b5 24 dc 44 9c eb 4d
: f9 da f0 c8 e8 a2 4c 99 07 5c 8e 35 2b 7d 57 8d
0299 02 14 20: . . . . . INTEGER
: a7 83 9b f3 bd 2c 20 07 fc 4c e7 e8 9f f3 39 83
: 51 0d dc dd
0321 02 81 80 128: . . . . . INTEGER
: 0e 3b 46 31 8a 0a 58 86 40 84 e3 a1 22 0d 88 ca
: 90 88 57 64 9f 01 21 e0 15 05 94 24 82 e2 10 90
: d9 e1 4e 10 5c e7 54 6b d4 0c 2b 1b 59 0a a0 b5
: a1 7d b5 07 e3 65 7c ea 90 d8 8e 30 42 e4 85 bb
: ac fa 4e 76 4b 78 0e df 6c e5 a6 e1 bd 59 77 7d
: a6 97 59 c5 29 a7 b3 3f 95 3e 9d f1 59 2d f7 42
: 87 62 3f f1 b8 6f c7 3d 4b b8 8d 74 c4 ca 44 90
: cf 67 db de 14 60 97 4a d1 f7 6d 9e 09 94 c4 0d
0452 03 81 84 132: . . . BIT STRING (0 unused bits)
: 02 81 80 aa 98 ea 13 94 a2 db f1 5b 7f 98 2f 78
: e7 d8 e3 b9 71 86 f6 80 2f 40 39 c3 da 3b 4b 13
: 46 26 ee 0d 56 c5 a3 3a 39 b7 7d 33 c2 6b 5c 77
: 92 f2 55 65 90 39 cd 1a 3c 86 e1 32 eb 25 bc 91
: c4 ff 80 4f 36 61 bd cc e2 61 04 e0 7e 60 13 ca
: c0 9c dd e0 ea 41 de 33 c1 f1 44 a9 bc 71 de cf
: 59 d4 6e da 44 99 3c 21 64 e4 78 54 9d d0 7b ba
: 4e f5 18 4d 5e 39 30 bf e0 d1 f6 f4 83 25 4f 14
: aa 71 e1
0587 a3 32 50: . . [3]
0589 30 30 48: . . . SEQUENCE
0591 30 0f 9: . . . . SEQUENCE
0593 06 03 3: . . . . . OID 2.5.29.19: basicConstraints
: 55 1d 13
0598 01 01 1: . . . . . TRUE
: ff
0601 04 05 5: . . . . . OCTET STRING
: 30 03 01 01 ff
0608 30 1d 29: . SEQUENCE
0610 06 03 3: . . . . . OID 2.5.29.14: subjectKeyIdentifier
: 55 1d 0e
0615 04 16 22: . . . . . OCTET STRING
: 04 14 e7 26 c5 54 cd 5b a3 6f 35 68 95 aa d5 ff
: 1c 21 e4 22 75 d6
0639 30 09 9: . SEQUENCE
0641 06 07 7: . . OID 1.2.840.10040.4.3: dsa-with-sha
: 2a 86 48 ce 38 04 03
0650 03 2f 47: . BIT STRING (0 unused bits)
: 30 2c 02 14 a0 66 c1 76 33 99 13 51 8d 93 64 2f
: ca 13 73 de 79 1a 7d 33 02 14 5d 90 f6 ce 92 4a
: bf 29 11 24 80 28 a6 5a 8e 73 b6 76 02 68
: 1c 21 e4 22 75 d6
0639 30 09 9: . SEQUENCE
0641 06 07 7: . . OID 1.2.840.10040.4.3: dsa-with-sha
: 2a 86 48 ce 38 04 03
0650 03 2f 47: . BIT STRING (0 unused bits)
: 30 2c 02 14 a0 66 c1 76 33 99 13 51 8d 93 64 2f
: ca 13 73 de 79 1a 7d 33 02 14 5d 90 f6 ce 92 4a
: bf 29 11 24 80 28 a6 5a 8e 73 b6 76 02 68
This section contains an annotated hex dump of a 730 byte version 3
certificate. The certificate contains the following information:
(a) the serial number is 18 (12 hex);
(b) the certificate is signed with DSA and the SHA-1 hash algorithm;
(c) the issuer's distinguished name is OU=nist; O=gov; C=US
(d) and the subject's distinguished name is CN=Tim Polk; OU=nist;
O=gov; C=US
(e) the certificate was valid from July 30, 1997 through December 1,
1997;
(f) the certificate contains a 1024 bit DSA public key;
(g) the certificate is an end entity certificate, as the basic
constraints extension is not present;
(h) the certificate contains an authority key identifier extension;
and
(i) the certificate includes one alternative name - an RFC 822
address.
This section contains an annotated hex dump of a 730 byte version 3
certificate. The certificate contains the following information:
(a) the serial number is 18 (12 hex);
(b) the certificate is signed with DSA and the SHA-1 hash algorithm;
(c) the issuer's distinguished name is OU=nist; O=gov; C=US
(d) and the subject's distinguished name is CN=Tim Polk; OU=nist;
O=gov; C=US
(e) the certificate was valid from July 30, 1997 through December 1,
1997;
(f) the certificate contains a 1024 bit DSA public key;
(g) the certificate is an end entity certificate, as the basic
constraints extension is not present;
(h) the certificate contains an authority key identifier extension;
and
(i) the certificate includes one alternative name - an RFC 822
address.
0000 30 82 02 d6 726: SEQUENCE
0004 30 82 02 96 662: . SEQUENCE
0008 a0 03 3: . . [0]
0010 02 01 1: . . . INTEGER 2
: 02
0013 02 01 1: . . INTEGER 18
: 12
0016 30 09 9: . . SEQUENCE
0018 06 07 7: . . . OID 1.2.840.10040.4.3: dsa-with-sha
: 2a 86 48 ce 38 04 03
0027 30 2a 42: . . SEQUENCE
0029 31 0b 11: . . . SET
0031 30 09 9: . . . . SEQUENCE
0033 06 03 3: . . . . . OID 2.5.4.6: C
: 55 04 06
0038 13 02 2: . . . . . PrintableString 'US'
: 55 53
0042 31 0c 12: . . . SET
0044 30 0a 10: . . . . SEQUENCE
0046 06 03 3: . . . . . OID 2.5.4.10: O
0000 30 82 02 d6 726: SEQUENCE
0004 30 82 02 96 662: . SEQUENCE
0008 a0 03 3: . . [0]
0010 02 01 1: . . . INTEGER 2
: 02
0013 02 01 1: . . INTEGER 18
: 12
0016 30 09 9: . . SEQUENCE
0018 06 07 7: . . . OID 1.2.840.10040.4.3: dsa-with-sha
: 2a 86 48 ce 38 04 03
0027 30 2a 42: . . SEQUENCE
0029 31 0b 11: . . . SET
0031 30 09 9: . . . . SEQUENCE
0033 06 03 3: . . . . . OID 2.5.4.6: C
: 55 04 06
0038 13 02 2: . . . . . PrintableString 'US'
: 55 53
0042 31 0c 12: . . . SET
0044 30 0a 10: . . . . SEQUENCE
0046 06 03 3: . . . . . OID 2.5.4.10: O
: 55 04 0a
0051 13 03 3: . . . . . PrintableString 'gov'
: 67 6f 76
0056 31 0d 13: . . . SET
0058 30 0b 11: . . . . SEQUENCE
0060 06 03 3: . . . . . OID 2.5.4.11: OU
: 55 04 0b
0065 13 04 4: . . . . . PrintableString 'nist'
: 6e 69 73 74
0071 30 1e 30: . . SEQUENCE
0073 17 0d 13: . . . UTCTime '970730000000Z'
: 39 37 30 37 33 30 30 30 30 30 30 30 5a
0088 17 0d 13: . . . UTCTime '971201000000Z'
: 39 37 31 32 30 31 30 30 30 30 30 30 5a
0103 30 3d 61: . . SEQUENCE
0105 31 0b 11: . . . SET
0107 30 09 9: . . . . SEQUENCE
0109 06 03 3: . . . . . OID 2.5.4.6: C
: 55 04 06
0114 13 02 2: . . . . . PrintableString 'US'
: 55 53
0118 31 0c 12: . . . SET
0120 30 0a 10: . . . . SEQUENCE
0122 06 03 3: . . . . . OID 2.5.4.10: O
: 55 04 0a
0127 13 03 3: . . . . . PrintableString 'gov'
: 67 6f 76
0132 31 0d 13: . . . SET
0134 30 0b 11: . . . . SEQUENCE
0136 06 03 3: . . . . . OID 2.5.4.11: OU
: 55 04 0b
0141 13 04 4: . . . . . PrintableString 'nist'
: 6e 69 73 74
0147 31 11 17: . . . SET
0149 30 0f 15: . . . . SEQUENCE
0151 06 03 3: . . . . . OID 2.5.4.3: CN
: 55 04 03
0156 13 08 8: . . . . . PrintableString 'Tim Polk'
: 54 69 6d 20 50 6f 6c 6b
0166 30 82 01 b4 436: . . SEQUENCE
0170 30 82 01 29 297: . . . SEQUENCE
0174 06 07 7: . . . . OID 1.2.840.10040.4.1: dsa
: 2a 86 48 ce 38 04 01
0183 30 82 01 1c 284: . . . . SEQUENCE
0187 02 81 80 128: . . . . . INTEGER
: d4 38 02 c5 35 7b d5 0b a1 7e 5d 72 59 63 55 d3
: 45 56 ea e2 25 1a 6b c5 a4 ab aa 0b d4 62 b4 d2
: 21 b1 95 a2 c6 01 c9 c3 fa 01 6f 79 86 83 3d 03
: 55 04 0a
0051 13 03 3: . . . . . PrintableString 'gov'
: 67 6f 76
0056 31 0d 13: . . . SET
0058 30 0b 11: . . . . SEQUENCE
0060 06 03 3: . . . . . OID 2.5.4.11: OU
: 55 04 0b
0065 13 04 4: . . . . . PrintableString 'nist'
: 6e 69 73 74
0071 30 1e 30: . . SEQUENCE
0073 17 0d 13: . . . UTCTime '970730000000Z'
: 39 37 30 37 33 30 30 30 30 30 30 30 5a
0088 17 0d 13: . . . UTCTime '971201000000Z'
: 39 37 31 32 30 31 30 30 30 30 30 30 5a
0103 30 3d 61: . . SEQUENCE
0105 31 0b 11: . . . SET
0107 30 09 9: . . . . SEQUENCE
0109 06 03 3: . . . . . OID 2.5.4.6: C
: 55 04 06
0114 13 02 2: . . . . . PrintableString 'US'
: 55 53
0118 31 0c 12: . . . SET
0120 30 0a 10: . . . . SEQUENCE
0122 06 03 3: . . . . . OID 2.5.4.10: O
: 55 04 0a
0127 13 03 3: . . . . . PrintableString 'gov'
: 67 6f 76
0132 31 0d 13: . . . SET
0134 30 0b 11: . . . . SEQUENCE
0136 06 03 3: . . . . . OID 2.5.4.11: OU
: 55 04 0b
0141 13 04 4: . . . . . PrintableString 'nist'
: 6e 69 73 74
0147 31 11 17: . . . SET
0149 30 0f 15: . . . . SEQUENCE
0151 06 03 3: . . . . . OID 2.5.4.3: CN
: 55 04 03
0156 13 08 8: . . . . . PrintableString 'Tim Polk'
: 54 69 6d 20 50 6f 6c 6b
0166 30 82 01 b4 436: . . SEQUENCE
0170 30 82 01 29 297: . . . SEQUENCE
0174 06 07 7: . . . . OID 1.2.840.10040.4.1: dsa
: 2a 86 48 ce 38 04 01
0183 30 82 01 1c 284: . . . . SEQUENCE
0187 02 81 80 128: . . . . . INTEGER
: d4 38 02 c5 35 7b d5 0b a1 7e 5d 72 59 63 55 d3
: 45 56 ea e2 25 1a 6b c5 a4 ab aa 0b d4 62 b4 d2
: 21 b1 95 a2 c6 01 c9 c3 fa 01 6f 79 86 83 3d 03
: 61 e1 f1 92 ac bc 03 4e 89 a3 c9 53 4a f7 e2 a6
: 48 cf 42 1e 21 b1 5c 2b 3a 7f ba be 6b 5a f7 0a
: 26 d8 8e 1b eb ec bf 1e 5a 3f 45 c0 bd 31 23 be
: 69 71 a7 c2 90 fe a5 d6 80 b5 24 dc 44 9c eb 4d
: f9 da f0 c8 e8 a2 4c 99 07 5c 8e 35 2b 7d 57 8d
0318 02 14 20: . . . . . INTEGER
: a7 83 9b f3 bd 2c 20 07 fc 4c e7 e8 9f f3 39 83
: 51 0d dc dd
0340 02 81 80 128: . . . . . INTEGER
: 0e 3b 46 31 8a 0a 58 86 40 84 e3 a1 22 0d 88 ca
: 90 88 57 64 9f 01 21 e0 15 05 94 24 82 e2 10 90
: d9 e1 4e 10 5c e7 54 6b d4 0c 2b 1b 59 0a a0 b5
: a1 7d b5 07 e3 65 7c ea 90 d8 8e 30 42 e4 85 bb
: ac fa 4e 76 4b 78 0e df 6c e5 a6 e1 bd 59 77 7d
: a6 97 59 c5 29 a7 b3 3f 95 3e 9d f1 59 2d f7 42
: 87 62 3f f1 b8 6f c7 3d 4b b8 8d 74 c4 ca 44 90
: cf 67 db de 14 60 97 4a d1 f7 6d 9e 09 94 c4 0d
0471 03 81 84 132: . . . BIT STRING (0 unused bits)
: 02 81 80 a8 63 b1 60 70 94 7e 0b 86 08 93 0c 0d
: 08 12 4a 58 a9 af 9a 09 38 54 3b 46 82 fb 85 0d
: 18 8b 2a 77 f7 58 e8 f0 1d d2 18 df fe e7 e9 35
: c8 a6 1a db 8d 3d 3d f8 73 14 a9 0b 39 c7 95 f6
: 52 7d 2d 13 8c ae 03 29 3c 4e 8c b0 26 18 b6 d8
: 11 1f d4 12 0c 13 ce 3f f1 c7 05 4e df e1 fc 44
: fd 25 34 19 4a 81 0d dd 98 42 ac d3 b6 91 0c 7f
: 16 72 a3 a0 8a d7 01 7f fb 9c 93 e8 99 92 c8 42
: 47 c6 43
0606 a3 3e 62: . . [3]
0608 30 3c 60: . . . SEQUENCE
0610 30 19 25: . . . . SEQUENCE
0612 06 03 3: . . . . . OID 2.5.29.17: subjectAltName
: 55 1d 11
0617 04 12 18: . . . . . OCTET STRING
: 30 10 81 0e 77 70 6f 6c 6b 40 6e 69 73 74 2e 67
: 6f 76
0637 30 1f 31: . . . . SEQUENCE
0639 06 03 3: . . . . . OID 2.5.29.35: subjectAltName
: 55 1d 23
0644 04 18 24: . . . . . OCTET STRING
: 30 16 80 14 e7 26 c5 54 cd 5b a3 6f 35 68 95 aa
: d5 ff 1c 21 e4 22 75 d6
0670 30 09 9: . SEQUENCE
0672 06 07 7: . . OID 1.2.840.10040.4.3: dsa-with-sha
: 2a 86 48 ce 38 04 03
0681 03 2f 47: . BIT STRING (0 unused bits)
: 30 2c 02 14 3c 02 e0 ab d9 5d 05 77 75 15 71 58
: 92 29 48 c4 1c 54 df fc 02 14 5b da 53 98 7f c5
: 33 df c6 09 b2 7a e3 6f 97 70 1e 14 ed 94
: 61 e1 f1 92 ac bc 03 4e 89 a3 c9 53 4a f7 e2 a6
: 48 cf 42 1e 21 b1 5c 2b 3a 7f ba be 6b 5a f7 0a
: 26 d8 8e 1b eb ec bf 1e 5a 3f 45 c0 bd 31 23 be
: 69 71 a7 c2 90 fe a5 d6 80 b5 24 dc 44 9c eb 4d
: f9 da f0 c8 e8 a2 4c 99 07 5c 8e 35 2b 7d 57 8d
0318 02 14 20: . . . . . INTEGER
: a7 83 9b f3 bd 2c 20 07 fc 4c e7 e8 9f f3 39 83
: 51 0d dc dd
0340 02 81 80 128: . . . . . INTEGER
: 0e 3b 46 31 8a 0a 58 86 40 84 e3 a1 22 0d 88 ca
: 90 88 57 64 9f 01 21 e0 15 05 94 24 82 e2 10 90
: d9 e1 4e 10 5c e7 54 6b d4 0c 2b 1b 59 0a a0 b5
: a1 7d b5 07 e3 65 7c ea 90 d8 8e 30 42 e4 85 bb
: ac fa 4e 76 4b 78 0e df 6c e5 a6 e1 bd 59 77 7d
: a6 97 59 c5 29 a7 b3 3f 95 3e 9d f1 59 2d f7 42
: 87 62 3f f1 b8 6f c7 3d 4b b8 8d 74 c4 ca 44 90
: cf 67 db de 14 60 97 4a d1 f7 6d 9e 09 94 c4 0d
0471 03 81 84 132: . . . BIT STRING (0 unused bits)
: 02 81 80 a8 63 b1 60 70 94 7e 0b 86 08 93 0c 0d
: 08 12 4a 58 a9 af 9a 09 38 54 3b 46 82 fb 85 0d
: 18 8b 2a 77 f7 58 e8 f0 1d d2 18 df fe e7 e9 35
: c8 a6 1a db 8d 3d 3d f8 73 14 a9 0b 39 c7 95 f6
: 52 7d 2d 13 8c ae 03 29 3c 4e 8c b0 26 18 b6 d8
: 11 1f d4 12 0c 13 ce 3f f1 c7 05 4e df e1 fc 44
: fd 25 34 19 4a 81 0d dd 98 42 ac d3 b6 91 0c 7f
: 16 72 a3 a0 8a d7 01 7f fb 9c 93 e8 99 92 c8 42
: 47 c6 43
0606 a3 3e 62: . . [3]
0608 30 3c 60: . . . SEQUENCE
0610 30 19 25: . . . . SEQUENCE
0612 06 03 3: . . . . . OID 2.5.29.17: subjectAltName
: 55 1d 11
0617 04 12 18: . . . . . OCTET STRING
: 30 10 81 0e 77 70 6f 6c 6b 40 6e 69 73 74 2e 67
: 6f 76
0637 30 1f 31: . . . . SEQUENCE
0639 06 03 3: . . . . . OID 2.5.29.35: subjectAltName
: 55 1d 23
0644 04 18 24: . . . . . OCTET STRING
: 30 16 80 14 e7 26 c5 54 cd 5b a3 6f 35 68 95 aa
: d5 ff 1c 21 e4 22 75 d6
0670 30 09 9: . SEQUENCE
0672 06 07 7: . . OID 1.2.840.10040.4.3: dsa-with-sha
: 2a 86 48 ce 38 04 03
0681 03 2f 47: . BIT STRING (0 unused bits)
: 30 2c 02 14 3c 02 e0 ab d9 5d 05 77 75 15 71 58
: 92 29 48 c4 1c 54 df fc 02 14 5b da 53 98 7f c5
: 33 df c6 09 b2 7a e3 6f 97 70 1e 14 ed 94
This section contains an annotated hex dump of a 675 byte version 3
certificate. The certificate contains the following information:
(a) the serial number is 256;
(b) the certificate is signed with RSA and the MD2 hash algorithm;
(c) the issuer's distinguished name is OU=Dept. Arquitectura de
Computadors; O=Universitat Politecnica de Catalunya; C=ES
(d) and the subject's distinguished name is CN=Francisco Jordan;
OU=Dept. Arquitectura de Computadors; O=Universitat Politecnica de
Catalunya; C=ES
(e) the certificate was issued on May 21, 1996 and expired on May 21,
1997;
(f) the certificate contains a 768 bit RSA public key;
(g) the certificate is an end entity certificate (not a CA
certificate);
(h) the certificate includes an alternative subject name and an
alternative issuer name - bothe are URLs;
(i) the certificate include an authority key identifier and
certificate policies extensions; and
(j) the certificate includes a critical key usage extension
specifying the public is intended for generation of digital
signatures.
This section contains an annotated hex dump of a 675 byte version 3
certificate. The certificate contains the following information:
(a) the serial number is 256;
(b) the certificate is signed with RSA and the MD2 hash algorithm;
(c) the issuer's distinguished name is OU=Dept. Arquitectura de
Computadors; O=Universitat Politecnica de Catalunya; C=ES
(d) and the subject's distinguished name is CN=Francisco Jordan;
OU=Dept. Arquitectura de Computadors; O=Universitat Politecnica de
Catalunya; C=ES
(e) the certificate was issued on May 21, 1996 and expired on May 21,
1997;
(f) the certificate contains a 768 bit RSA public key;
(g) the certificate is an end entity certificate (not a CA
certificate);
(h) the certificate includes an alternative subject name and an
alternative issuer name - bothe are URLs;
(i) the certificate include an authority key identifier and
certificate policies extensions; and
(j) the certificate includes a critical key usage extension
specifying the public is intended for generation of digital
signatures.
0000 30 80 : SEQUENCE (size undefined)
0002 30 82 02 40 576: . SEQUENCE
0006 a0 03 3: . . [0]
0008 02 01 1: . . . INTEGER 2
: 02
0011 02 02 2: . . INTEGER 256
: 01 00
0015 30 0d 13: . . SEQUENCE
0017 06 09 9: . . . OID 1.2.840.113549.1.1.2:
MD2WithRSAEncryption
: 2a 86 48 86 f7 0d 01 01 02
0028 05 00 0: . . . NULL
0030 30 68 88: . . SEQUENCE
0032 31 0b 11: . . . SET
0034 30 09 9: . . . . SEQUENCE
0036 06 03 3: . . . . . OID 2.5.4.6: C
: 55 04 06
0041 13 02 2: . . . . . PrintableString 'ES'
: 45 53
0045 31 2d 45: . . . SET
0047 30 2b 43: . . . . SEQUENCE
0049 06 03 3: . . . . . OID 2.5.4.10: O
: 55 04 0a
0054 13 24 36: . . . . . PrintableString
0000 30 80 : SEQUENCE (size undefined)
0002 30 82 02 40 576: . SEQUENCE
0006 a0 03 3: . . [0]
0008 02 01 1: . . . INTEGER 2
: 02
0011 02 02 2: . . INTEGER 256
: 01 00
0015 30 0d 13: . . SEQUENCE
0017 06 09 9: . . . OID 1.2.840.113549.1.1.2:
MD2WithRSAEncryption
: 2a 86 48 86 f7 0d 01 01 02
0028 05 00 0: . . . NULL
0030 30 68 88: . . SEQUENCE
0032 31 0b 11: . . . SET
0034 30 09 9: . . . . SEQUENCE
0036 06 03 3: . . . . . OID 2.5.4.6: C
: 55 04 06
0041 13 02 2: . . . . . PrintableString 'ES'
: 45 53
0045 31 2d 45: . . . SET
0047 30 2b 43: . . . . SEQUENCE
0049 06 03 3: . . . . . OID 2.5.4.10: O
: 55 04 0a
0054 13 24 36: . . . . . PrintableString
'Universitat Politecnica de Catalunya'
: 55 6e 69 76 65 72 73 69 74 61 74 20 50 6f 6c 69
: 74 65 63 6e 69 63 61 20 64 65 20 43 61 74 61 6c
: 75 6e 79 61
0092 31 2a 42: . . . SET
0094 30 28 40: . . . . SEQUENCE
0096 06 03 3: . . . . . OID 2.5.4.11: OU
: 55 04 0b
0101 13 21 33: . . . . . PrintableString
'OU=Dept. Arquitectura de Computadors'
: 44 65 70 74 2e 20 41 72 71 75 69 74 65 63 74 75
: 72 61 20 64 65 20 43 6f 6d 70 75 74 61 64 6f 72
: 73
0136 30 1e 30: . . SEQUENCE
0138 17 0d 13: . . . UTCTime '960521095826Z'
: 39 36 30 37 32 32 31 37 33 38 30 32 5a
0153 17 0d 13: . . . UTCTime '979521095826Z'
: 39 37 30 37 32 32 31 37 33 38 30 32 5a
0168 30 81 83 112: . . SEQUENCE
0171 31 0b 11: . . . SET
0173 30 09 9: . . . . SEQUENCE
0175 06 03 3: . . . . . OID 2.5.4.6: C
: 55 04 06
0180 13 02 2: . . . . . PrintableString 'ES'
: 45 53
0184 31 2d 12: . . . SET
0186 30 2b 16: . . . . SEQUENCE
0188 06 03 3: . . . . . OID 2.5.4.10: O
: 55 04 0a
0193 13 24 36: . . . . . PrintableString
'Universitat Politecnica de Catalunya'
: 55 6e 69 76 65 72 73 69 74 61 74 20 50 6f 6c 69
: 74 65 63 6e 69 63 61 20 64 65 20 43 61 74 61 6c
: 75 6e 79 61
0231 31 2a 42: . . . SET
0233 30 28 40: . . . . SEQUENCE
0235 06 03 3: . . . . . OID 2.5.4.11: OU
: 55 04 0b
0240 13 21 33: . . . . . PrintableString
'Dept. Arquitectura de Computadors'
: 44 65 70 74 2e 20 41 72 71 75 69 74 65 63 74 75
: 72 61 20 64 65 20 43 6f 6d 70 75 74 61 64 6f 72
: 73
0275 31 19 22: . . . SET
0277 30 17 20: . . . . SEQUENCE
0279 06 03 3: . . . . . OID 2.5.4.3: CN
: 55 04 03
0284 13 10 16: . . . . . PrintableString 'Francisco Jordan'
'Universitat Politecnica de Catalunya'
: 55 6e 69 76 65 72 73 69 74 61 74 20 50 6f 6c 69
: 74 65 63 6e 69 63 61 20 64 65 20 43 61 74 61 6c
: 75 6e 79 61
0092 31 2a 42: . . . SET
0094 30 28 40: . . . . SEQUENCE
0096 06 03 3: . . . . . OID 2.5.4.11: OU
: 55 04 0b
0101 13 21 33: . . . . . PrintableString
'OU=Dept. Arquitectura de Computadors'
: 44 65 70 74 2e 20 41 72 71 75 69 74 65 63 74 75
: 72 61 20 64 65 20 43 6f 6d 70 75 74 61 64 6f 72
: 73
0136 30 1e 30: . . SEQUENCE
0138 17 0d 13: . . . UTCTime '960521095826Z'
: 39 36 30 37 32 32 31 37 33 38 30 32 5a
0153 17 0d 13: . . . UTCTime '979521095826Z'
: 39 37 30 37 32 32 31 37 33 38 30 32 5a
0168 30 81 83 112: . . SEQUENCE
0171 31 0b 11: . . . SET
0173 30 09 9: . . . . SEQUENCE
0175 06 03 3: . . . . . OID 2.5.4.6: C
: 55 04 06
0180 13 02 2: . . . . . PrintableString 'ES'
: 45 53
0184 31 2d 12: . . . SET
0186 30 2b 16: . . . . SEQUENCE
0188 06 03 3: . . . . . OID 2.5.4.10: O
: 55 04 0a
0193 13 24 36: . . . . . PrintableString
'Universitat Politecnica de Catalunya'
: 55 6e 69 76 65 72 73 69 74 61 74 20 50 6f 6c 69
: 74 65 63 6e 69 63 61 20 64 65 20 43 61 74 61 6c
: 75 6e 79 61
0231 31 2a 42: . . . SET
0233 30 28 40: . . . . SEQUENCE
0235 06 03 3: . . . . . OID 2.5.4.11: OU
: 55 04 0b
0240 13 21 33: . . . . . PrintableString
'Dept. Arquitectura de Computadors'
: 44 65 70 74 2e 20 41 72 71 75 69 74 65 63 74 75
: 72 61 20 64 65 20 43 6f 6d 70 75 74 61 64 6f 72
: 73
0275 31 19 22: . . . SET
0277 30 17 20: . . . . SEQUENCE
0279 06 03 3: . . . . . OID 2.5.4.3: CN
: 55 04 03
0284 13 10 16: . . . . . PrintableString 'Francisco Jordan'
: 46 72 61 6e 63 69 73 63 6f 20 4a 6f 72 64 61 6e
0302 30 7c 2: . . SEQUENCE
0304 30 0d 13: . . . SEQUENCE
0306 06 09 9: . . . . OID 1.2.840.113549.1.1.1: RSAEncryption
: 2a 86 48 86 f7 0d 01 01 01
0317 05 00 0: . . . . NULL
0319 03 6b 107: . . . BIT STRING
: 00 (0 unused bits)
: 30 68 02 61 00 be aa 8b 77 54 a3 af ca 77 9f 2f
: b0 cf 43 88 ff a6 6d 79 55 5b 61 8c 68 ec 48 1e
: 8a 86 38 a4 fe 19 b8 62 17 1d 9d 0f 47 2c ff 63
: 8f 29 91 04 d1 52 bc 7f 67 b6 b2 8f 74 55 c1 33
: 21 6c 8f ab 01 95 24 c8 b2 73 93 9d 22 61 50 a9
: 35 fb 9d 57 50 32 ef 56 52 50 93 ab b1 88 94 78
: 56 15 c6 1c 8b 02 03 01 00 01
0428 a3 81 97 151: . . [3]
0431 30 3c 60: . . . SEQUENCE
0433 30 1f 31: . . . . SEQUENCE
0435 06 03 3: . . . . . OID 2.5.29.35: authorityKeyIdentifier
: 55 1d 23
0440 04 14 22: . . . . . OCTET STRING
: 30 12 80 10 0e 6b 3a bf 04 ea 04 c3 0e 6b 3a bf
: 04 ea 04 c3
0464 30 19 25: . . . . SEQUENCE
0466 06 03 3: . . . . . OID 2.5.29.15: keyUsage
: 55 1d 0f
0471 01 01 1: . . . . . TRUE
0474 04 04 4: . . . . . OCTET STRING
: 03 02 07 80
0480 30 19 25: . . . . SEQUENCE
0482 06 03 3: . . . . . OID 2.5.29.32: certificatePolicies
: 55 1d 20
0487 04 21 33: . . . . . OCTET STRING
: 30 1f 30 1d 06 04 2a 84 80 00 30 15 30 07 06 05
: 2a 84 80 00 01 30 0a 06 05 2a 84 80 00 02 02 01
: 0a
0522 30 1c 28: . . . . SEQUENCE
0524 06 03 3: . . . . . OID 2.5.29.17: subjectAltName
: 55 1d 11
0529 04 15 21: . . . . . OCTET STRING
: 30 13 86 11 68 74 74 70 3a 2f 2f 61 63 2e 75 70
: 63 2e 65 73 2f
0552 30 19 25: . . . . SEQUENCE
0554 06 03 3: . . . . . OID 2.5.29.18: issuerAltName
: 55 1d 12
0559 04 12 18: . . . . . OCTET STRING
: 30 14 86 12 68 74 74 70 3a 2f 2f 77 77 77 2e 75
: 70 63 2e 65
: 46 72 61 6e 63 69 73 63 6f 20 4a 6f 72 64 61 6e
0302 30 7c 2: . . SEQUENCE
0304 30 0d 13: . . . SEQUENCE
0306 06 09 9: . . . . OID 1.2.840.113549.1.1.1: RSAEncryption
: 2a 86 48 86 f7 0d 01 01 01
0317 05 00 0: . . . . NULL
0319 03 6b 107: . . . BIT STRING
: 00 (0 unused bits)
: 30 68 02 61 00 be aa 8b 77 54 a3 af ca 77 9f 2f
: b0 cf 43 88 ff a6 6d 79 55 5b 61 8c 68 ec 48 1e
: 8a 86 38 a4 fe 19 b8 62 17 1d 9d 0f 47 2c ff 63
: 8f 29 91 04 d1 52 bc 7f 67 b6 b2 8f 74 55 c1 33
: 21 6c 8f ab 01 95 24 c8 b2 73 93 9d 22 61 50 a9
: 35 fb 9d 57 50 32 ef 56 52 50 93 ab b1 88 94 78
: 56 15 c6 1c 8b 02 03 01 00 01
0428 a3 81 97 151: . . [3]
0431 30 3c 60: . . . SEQUENCE
0433 30 1f 31: . . . . SEQUENCE
0435 06 03 3: . . . . . OID 2.5.29.35: authorityKeyIdentifier
: 55 1d 23
0440 04 14 22: . . . . . OCTET STRING
: 30 12 80 10 0e 6b 3a bf 04 ea 04 c3 0e 6b 3a bf
: 04 ea 04 c3
0464 30 19 25: . . . . SEQUENCE
0466 06 03 3: . . . . . OID 2.5.29.15: keyUsage
: 55 1d 0f
0471 01 01 1: . . . . . TRUE
0474 04 04 4: . . . . . OCTET STRING
: 03 02 07 80
0480 30 19 25: . . . . SEQUENCE
0482 06 03 3: . . . . . OID 2.5.29.32: certificatePolicies
: 55 1d 20
0487 04 21 33: . . . . . OCTET STRING
: 30 1f 30 1d 06 04 2a 84 80 00 30 15 30 07 06 05
: 2a 84 80 00 01 30 0a 06 05 2a 84 80 00 02 02 01
: 0a
0522 30 1c 28: . . . . SEQUENCE
0524 06 03 3: . . . . . OID 2.5.29.17: subjectAltName
: 55 1d 11
0529 04 15 21: . . . . . OCTET STRING
: 30 13 86 11 68 74 74 70 3a 2f 2f 61 63 2e 75 70
: 63 2e 65 73 2f
0552 30 19 25: . . . . SEQUENCE
0554 06 03 3: . . . . . OID 2.5.29.18: issuerAltName
: 55 1d 12
0559 04 12 18: . . . . . OCTET STRING
: 30 14 86 12 68 74 74 70 3a 2f 2f 77 77 77 2e 75
: 70 63 2e 65
0579 30 80 : . SEQUENCE (indefinite length)
0581 06 07 7: . . OID
0583 05 00 0: . . NULL
0585 00 00 0: . . end of contents marker
0587 03 81 81 47: . BIT STRING
: 00 (0 unused bits)
: 5c 01 bd b5 41 88 87 7a 0e d3 0e 6b 3a bf 04 ea
: 04 cb 5f 61 72 3c a3 bd 78 f5 66 17 fe 37 3a ab
: eb 67 bf b7 da a8 38 f6 33 15 71 75 2f b9 8c 91
: a0 e4 87 ba 4b 43 a0 22 8f d3 a9 86 43 89 e6 50
: 5c 01 bd b5 41 88 87 7a 0e d3 0e 6b 3a bf 04 ea
: 04 cb 5f 61 72 3c a3 bd 78 f5 66 17 fe 37 3a ab
: eb 67 bf b7 da a8 38 f6 33 15 71 75 2f b9 8c 91
: a0 e4 87 ba 4b 43 a0 22 8f d3 a9 86 43 89 e6 50
0637 00 00 0: . . end of contents marker
0579 30 80 : . SEQUENCE (indefinite length)
0581 06 07 7: . . OID
0583 05 00 0: . . NULL
0585 00 00 0: . . end of contents marker
0587 03 81 81 47: . BIT STRING
: 00 (0 unused bits)
: 5c 01 bd b5 41 88 87 7a 0e d3 0e 6b 3a bf 04 ea
: 04 cb 5f 61 72 3c a3 bd 78 f5 66 17 fe 37 3a ab
: eb 67 bf b7 da a8 38 f6 33 15 71 75 2f b9 8c 91
: a0 e4 87 ba 4b 43 a0 22 8f d3 a9 86 43 89 e6 50
: 5c 01 bd b5 41 88 87 7a 0e d3 0e 6b 3a bf 04 ea
: 04 cb 5f 61 72 3c a3 bd 78 f5 66 17 fe 37 3a ab
: eb 67 bf b7 da a8 38 f6 33 15 71 75 2f b9 8c 91
: a0 e4 87 ba 4b 43 a0 22 8f d3 a9 86 43 89 e6 50
0637 00 00 0: . . end of contents marker
This section contains an annotated hex dump of a version 2 CRL with one extension (cRLNumber). The CRL was issued by OU=nist;O=gov;C=us on July 7, 1996; the next scheduled issuance was August 7, 1996. The CRL includes one revoked certificates: serial number 18 (12 hex). The CRL itself is number 18, and it was signed with DSA and SHA-1.
本节包含带有一个扩展名（cRLNumber）的版本2 CRL的带注释的十六进制转储。CRL由OU=nist发布；O=政府；C=1996年7月7日的美国；下一次预定发行日期为1996年8月7日。CRL包括一个已撤销的证书：序列号18（12十六进制）。CRL本身是18号，由DSA和SHA-1签署。
0000 30 81 ba 186: SEQUENCE
0003 30 7c 124: . SEQUENCE
0005 02 01 1: . . INTEGER 1
: 01
0008 30 09 9: . . SEQUENCE
0010 06 07 7: . . . OID 1.2.840.10040.4.3: dsa-with-sha
: 2a 86 48 ce 38 04 03
0019 30 2a 42: . . SEQUENCE
0021 31 0b 11: . . . SET
0023 30 09 9: . . . . SEQUENCE
0025 06 03 3: . . . . . OID 2.5.4.6: C
: 55 04 06
0030 13 02 2: . . . . . PrintableString 'US'
: 55 53
0034 31 0c 12: . . . SET
0036 30 0a 10: . . . . SEQUENCE
0038 06 03 3: . . . . . OID 2.5.4.10: O
: 55 04 0a
0043 13 03 3: . . . . . PrintableString 'gov'
: 67 6f 76
0048 31 0d 13: . . . SET
0050 30 0b 11: . . . . SEQUENCE
0052 06 03 3: . . . . . OID 2.5.4.11: OU
: 55 04 0b
0000 30 81 ba 186: SEQUENCE
0003 30 7c 124: . SEQUENCE
0005 02 01 1: . . INTEGER 1
: 01
0008 30 09 9: . . SEQUENCE
0010 06 07 7: . . . OID 1.2.840.10040.4.3: dsa-with-sha
: 2a 86 48 ce 38 04 03
0019 30 2a 42: . . SEQUENCE
0021 31 0b 11: . . . SET
0023 30 09 9: . . . . SEQUENCE
0025 06 03 3: . . . . . OID 2.5.4.6: C
: 55 04 06
0030 13 02 2: . . . . . PrintableString 'US'
: 55 53
0034 31 0c 12: . . . SET
0036 30 0a 10: . . . . SEQUENCE
0038 06 03 3: . . . . . OID 2.5.4.10: O
: 55 04 0a
0043 13 03 3: . . . . . PrintableString 'gov'
: 67 6f 76
0048 31 0d 13: . . . SET
0050 30 0b 11: . . . . SEQUENCE
0052 06 03 3: . . . . . OID 2.5.4.11: OU
: 55 04 0b
0057 13 04 4: . . . . . PrintableString 'nist'
: 6e 69 73 74
0063 17 0d 13: . . UTCTime '970801000000Z'
: 39 37 30 38 30 31 30 30 30 30 30 30 5a
0078 17 0d 13: . . UTCTime '970808000000Z'
: 39 37 30 38 30 38 30 30 30 30 30 30 5a
0093 30 22 34: . . SEQUENCE
0095 30 20 32: . . . SEQUENCE
0097 02 01 1: . . . . INTEGER 18
: 12
0100 17 0d 13: . . . . UTCTime '970731000000Z'
: 39 37 30 37 33 31 30 30 30 30 30 30 5a
0115 30 0c 12: . . . . SEQUENCE
0117 30 0a 10: . . . . . SEQUENCE
0119 06 03 3: . . . . . . OID 2.5.29.21: reasonCode
: 55 1d 15
0124 04 03 3: . . . . . . OCTET STRING
: 0a 01 01
0129 30 09 9: . SEQUENCE
0131 06 07 7: . . OID 1.2.840.10040.4.3: dsa-with-sha
: 2a 86 48 ce 38 04 03
0140 03 2f 47: . BIT STRING (0 unused bits)
: 30 2c 02 14 9e d8 6b c1 7d c2 c4 02 f5 17 84 f9
: 9f 46 7a ca cf b7 05 8a 02 14 9e 43 39 85 dc ea
: 14 13 72 93 54 5d 44 44 e5 05 fe 73 9a b2
0057 13 04 4: . . . . . PrintableString 'nist'
: 6e 69 73 74
0063 17 0d 13: . . UTCTime '970801000000Z'
: 39 37 30 38 30 31 30 30 30 30 30 30 5a
0078 17 0d 13: . . UTCTime '970808000000Z'
: 39 37 30 38 30 38 30 30 30 30 30 30 5a
0093 30 22 34: . . SEQUENCE
0095 30 20 32: . . . SEQUENCE
0097 02 01 1: . . . . INTEGER 18
: 12
0100 17 0d 13: . . . . UTCTime '970731000000Z'
: 39 37 30 37 33 31 30 30 30 30 30 30 5a
0115 30 0c 12: . . . . SEQUENCE
0117 30 0a 10: . . . . . SEQUENCE
0119 06 03 3: . . . . . . OID 2.5.29.21: reasonCode
: 55 1d 15
0124 04 03 3: . . . . . . OCTET STRING
: 0a 01 01
0129 30 09 9: . SEQUENCE
0131 06 07 7: . . OID 1.2.840.10040.4.3: dsa-with-sha
: 2a 86 48 ce 38 04 03
0140 03 2f 47: . BIT STRING (0 unused bits)
: 30 2c 02 14 9e d8 6b c1 7d c2 c4 02 f5 17 84 f9
: 9f 46 7a ca cf b7 05 8a 02 14 9e 43 39 85 dc ea
: 14 13 72 93 54 5d 44 44 e5 05 fe 73 9a b2
Russell Housley SPYRUS 381 Elden Street Suite 1120 Herndon, VA 20170 USA
拉塞尔·霍斯利·斯皮罗斯美国弗吉尼亚州赫恩登市埃尔登街381号1120室，邮编20170
EMail: housley@spyrus.com
EMail: housley@spyrus.com
Warwick Ford VeriSign, Inc. One Alewife Center Cambridge, MA 02140 USA
美国马萨诸塞州剑桥市沃里克福特威瑞信一号中心邮编：02140
EMail: wford@verisign.com
EMail: wford@verisign.com
Tim Polk NIST Building 820, Room 426 Gaithersburg, MD 20899 USA
美国马里兰州盖瑟斯堡426室820号NIST大楼Tim Polk 20899
EMail: wpolk@nist.gov
EMail: wpolk@nist.gov
David Solo Citicorp 666 Fifth Ave, 3rd Floor New York, NY 10103 USA
美国纽约州纽约市第五大道666号三楼大卫·索洛花旗集团10103
EMail: david.solo@citicorp.com
EMail: david.solo@citicorp.com
Copyright (C) The Internet Society (1999). All Rights Reserved.
版权所有（C）互联网协会（1999年）。版权所有。
This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.
本文件及其译本可复制并提供给他人，对其进行评论或解释或协助其实施的衍生作品可全部或部分编制、复制、出版和分发，不受任何限制，前提是上述版权声明和本段包含在所有此类副本和衍生作品中。但是，不得以任何方式修改本文件本身，例如删除版权通知或对互联网协会或其他互联网组织的引用，除非出于制定互联网标准的需要，在这种情况下，必须遵循互联网标准过程中定义的版权程序，或根据需要将其翻译成英语以外的其他语言。
The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.
上述授予的有限许可是永久性的，互联网协会或其继承人或受让人不会撤销。
This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
本文件和其中包含的信息是按“原样”提供的，互联网协会和互联网工程任务组否认所有明示或暗示的保证，包括但不限于任何保证，即使用本文中的信息不会侵犯任何权利，或对适销性或特定用途适用性的任何默示保证。