4.1.2.9 Extensions .............................................   24
   4.2  Certificate Extensions ....................................   24
   4.2.1  Standard Extensions .....................................   25
   4.2.1.1  Authority Key Identifier ..............................   25
   4.2.1.2  Subject Key Identifier ................................   26
   4.2.1.3  Key Usage .............................................   27
   4.2.1.4  Private Key Usage Period ..............................   29
   4.2.1.5  Certificate Policies ..................................   29
   4.2.1.6  Policy Mappings .......................................   31
   4.2.1.7  Subject Alternative Name ..............................   32




 
RFC 2459        Internet X.509 Public Key Infrastructure    January 1999


   4.2.1.8  Issuer Alternative Name ...............................   34
   4.2.1.9  Subject Directory Attributes ..........................   34
   4.2.1.10  Basic Constraints ....................................   35
   4.2.1.11  Name Constraints .....................................   35
   4.2.1.12  Policy Constraints ...................................   37
   4.2.1.13  Extended key usage field .............................   38
   4.2.1.14  CRL Distribution Points ..............................   39
   4.2.2  Private Internet Extensions .............................   40
   4.2.2.1  Authority Information Access ..........................   41
   5  CRL and CRL Extensions Profile ..............................   42
   5.1  CRL Fields ................................................   43
   5.1.1  CertificateList Fields ..................................   43
   5.1.1.1  tbsCertList ...........................................   44
   5.1.1.2  signatureAlgorithm ....................................   44
   5.1.1.3  signatureValue ........................................   44
   5.1.2  Certificate List "To Be Signed" .........................   44
   5.1.2.1  Version ...............................................   45
   5.1.2.2  Signature .............................................   45
   5.1.2.3  Issuer Name ...........................................   45
   5.1.2.4  This Update ...........................................   45
   5.1.2.5  Next Update ...........................................   45
   5.1.2.6  Revoked Certificates ..................................   46
   5.1.2.7  Extensions ............................................   46
   5.2  CRL Extensions ............................................   46
   5.2.1  Authority Key Identifier ................................   47
   5.2.2  Issuer Alternative Name .................................   47
   5.2.3  CRL Number ..............................................   47
   5.2.4  Delta CRL Indicator .....................................   48
   5.2.5  Issuing Distribution Point ..............................   48
   5.3  CRL Entry Extensions ......................................   49
   5.3.1  Reason Code .............................................   50
   5.3.2  Hold Instruction Code ...................................   50
   5.3.3  Invalidity Date .........................................   51
   5.3.4  Certificate Issuer ......................................   51
   6  Certificate Path Validation .................................   52
   6.1  Basic Path Validation .....................................   52
   6.2  Extending Path Validation .................................   56
   7  Algorithm Support ...........................................   57
   7.1  One-way Hash Functions ....................................   57
   7.1.1  MD2 One-way Hash Function ...............................   57
   7.1.2  MD5 One-way Hash Function ...............................   58
   7.1.3  SHA-1 One-way Hash Function .............................   58
   7.2  Signature Algorithms ......................................   58
   7.2.1  RSA Signature Algorithm .................................   59
   7.2.2  DSA Signature Algorithm .................................   60
   7.3  Subject Public Key Algorithms .............................   60
   7.3.1  RSA Keys ................................................   61
   7.3.2  Diffie-Hellman Key Exchange Key .........................   61




 
RFC 2459        Internet X.509 Public Key Infrastructure    January 1999


   7.3.3  DSA Signature Keys ......................................   63
   8  References ..................................................   64
   9  Intellectual Property Rights ................................   66
   10  Security Considerations ....................................   67
   Appendix A.  ASN.1 Structures and OIDs .........................   70
   A.1 Explicitly Tagged Module, 1988 Syntax ......................   70
   A.2 Implicitly Tagged Module, 1988 Syntax ......................   84
   Appendix B.  1993 ASN.1 Structures and OIDs ....................   91
   B.1 Explicitly Tagged Module, 1993 Syntax ......................   91
   B.2 Implicitly Tagged Module, 1993 Syntax ......................  108
   Appendix C.  ASN.1 Notes .......................................  116
   Appendix D.  Examples ..........................................  117
   D.1  Certificate ...............................................  117
   D.2  Certificate ...............................................  120
   D.3  End-Entity Certificate Using RSA ..........................  123
   D.4  Certificate Revocation List ...............................  126
   Appendix E.  Authors' Addresses ................................  128
   Appendix F.  Full Copyright Statement ..........................  129