RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
- D. Cooper,
- S. Santesson,
- S. Farrell,
- S. Boeyen,
- R. Housley,
- W. Polk
Proposed Standard
3 subscribed
Added to 2 Sets
Network Working Group D. Cooper Request for Comments: 5280 NIST Obsoletes: 3280, 4325, 4630 S. Santesson Category: Standards Track Microsoft S. Farrell Trinity College Dublin S. Boeyen Entrust R. Housley Vigil Security W. Polk NIST May 2008 Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile Status of This Memo This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited. Abstract This memo profiles the X.509 v3 certificate and X.509 v2 certificate revocation list (CRL) for use in the Internet. An overview of this approach and model is provided as an introduction. The X.509 v3 certificate format is described in detail, with additional information regarding the format and semantics of Internet name forms. Standard certificate extensions are described and two Internet-specific extensions are defined. A set of required certificate extensions is specified. The X.509 v2 CRL format is described in detail along with standard and Internet-specific extensions. An algorithm for X.509 certification path validation is described. An ASN.1 module and examples are provided in the appendices. Cooper, et al. Standards Track [Page 1]
RFC 5280 PKIX Certificate and CRL Profile May 2008 Table of Contents 1. Introduction ....................................................4 2. Requirements and Assumptions ....................................6 2.1. Communication and Topology .................................7 2.2. Acceptability Criteria .....................................7 2.3. User Expectations ..........................................7 2.4. Administrator Expectations .................................8 3. Overview of Approach ............................................8 3.1. X.509 Version 3 Certificate ................................9 3.2. Certification Paths and Trust .............................10 3.3. Revocation ................................................13 3.4. Operational Protocols .....................................14 3.5. Management Protocols ......................................14 4. Certificate and Certificate Extensions Profile .................16 4.1. Basic Certificate Fields ..................................16 4.1.1. Certificate Fields .................................17 4.1.1.1. tbsCertificate ............................18 4.1.1.2. signatureAlgorithm ........................18 4.1.1.3. signatureValue ............................18 4.1.2. TBSCertificate .....................................18 4.1.2.1. Version ...................................19 4.1.2.2. Serial Number .............................19 4.1.2.3. Signature .................................19 4.1.2.4. Issuer ....................................20 4.1.2.5. Validity ..................................22 4.1.2.5.1. UTCTime ........................23 4.1.2.5.2. GeneralizedTime ................23 4.1.2.6. Subject ...................................23 4.1.2.7. Subject Public Key Info ...................25 4.1.2.8. Unique Identifiers ........................25 4.1.2.9. Extensions ................................26 4.2. Certificate Extensions ....................................26 4.2.1. Standard Extensions ................................27 4.2.1.1. Authority Key Identifier ..................27 4.2.1.2. Subject Key Identifier ....................28 4.2.1.3. Key Usage .................................29 4.2.1.4. Certificate Policies ......................32 4.2.1.5. Policy Mappings ...........................35 4.2.1.6. Subject Alternative Name ..................35 4.2.1.7. Issuer Alternative Name ...................38 4.2.1.8. Subject Directory Attributes ..............39 4.2.1.9. Basic Constraints .........................39 4.2.1.10. Name Constraints .........................40 4.2.1.11. Policy Constraints .......................43 4.2.1.12. Extended Key Usage .......................44 4.2.1.13. CRL Distribution Points ..................45 4.2.1.14. Inhibit anyPolicy ........................48 Cooper, et al. Standards Track [Page 2]
RFC 5280 PKIX Certificate and CRL Profile May 2008 4.2.1.15. Freshest CRL (a.k.a. Delta CRL Distribution Point) ......................48 4.2.2. Private Internet Extensions ........................49 4.2.2.1. Authority Information Access ..............49 4.2.2.2. Subject Information Access ................51 5. CRL and CRL Extensions Profile .................................54 5.1. CRL Fields ................................................55 5.1.1. CertificateList Fields .............................56 5.1.1.1. tbsCertList ...............................56 5.1.1.2. signatureAlgorithm ........................57 5.1.1.3. signatureValue ............................57 5.1.2. Certificate List "To Be Signed" ....................58 5.1.2.1. Version ...................................58 5.1.2.2. Signature .................................58 5.1.2.3. Issuer Name ...............................58 5.1.2.4. This Update ...............................58 5.1.2.5. Next Update ...............................59 5.1.2.6. Revoked Certificates ......................59 5.1.2.7. Extensions ................................60 5.2. CRL Extensions ............................................60 5.2.1. Authority Key Identifier ...........................60 5.2.2. Issuer Alternative Name ............................60 5.2.3. CRL Number .........................................61 5.2.4. Delta CRL Indicator ................................62 5.2.5. Issuing Distribution Point .........................65 5.2.6. Freshest CRL (a.k.a. Delta CRL Distribution Point) .............................................67 5.2.7. Authority Information Access .......................67 5.3. CRL Entry Extensions ......................................69 5.3.1. Reason Code ........................................69 5.3.2. Invalidity Date ....................................70 5.3.3. Certificate Issuer .................................70 6. Certification Path Validation ..................................71 6.1. Basic Path Validation .....................................72 6.1.1. Inputs .............................................75 6.1.2. Initialization .....................................77 6.1.3. Basic Certificate Processing .......................80 6.1.4. Preparation for Certificate i+1 ....................84 6.1.5. Wrap-Up Procedure ..................................87 6.1.6. Outputs ............................................89 6.2. Using the Path Validation Algorithm .......................89 6.3. CRL Validation ............................................90 6.3.1. Revocation Inputs ..................................91 6.3.2. Initialization and Revocation State Variables ......91 6.3.3. CRL Processing .....................................92 7. Processing Rules for Internationalized Names ...................95 7.1. Internationalized Names in Distinguished Names ............96 7.2. Internationalized Domain Names in GeneralName .............97 Cooper, et al. Standards Track [Page 3]
RFC 5280 PKIX Certificate and CRL Profile May 2008 7.3. Internationalized Domain Names in Distinguished Names .....98 7.4. Internationalized Resource Identifiers ....................98 7.5. Internationalized Electronic Mail Addresses ..............100 8. Security Considerations .......................................100 9. IANA Considerations ...........................................105 10. Acknowledgments ..............................................105 11. References ...................................................105 11.1. Normative References ....................................105 11.2. Informative References ..................................107 Appendix A. Pseudo-ASN.1 Structures and OIDs ....................110 A.1. Explicitly Tagged Module, 1988 Syntax ....................110 A.2. Implicitly Tagged Module, 1988 Syntax ....................125 Appendix B. ASN.1 Notes ..........................................133 Appendix C. Examples .............................................136 C.1. RSA Self-Signed Certificate ..............................137 C.2. End Entity Certificate Using RSA .........................140 C.3. End Entity Certificate Using DSA .........................143 C.4. Certificate Revocation List ..............................147 1. Introduction This specification is one part of a family of standards for the X.509 Public Key Infrastructure (PKI) for the Internet. This specification profiles the format and semantics of certificates and certificate revocation lists (CRLs) for the Internet PKI. Procedures are described for processing of certification paths in the Internet environment. Finally, ASN.1 modules are provided in the appendices for all data structures defined or referenced. Section 2 describes Internet PKI requirements and the assumptions that affect the scope of this document. Section 3 presents an architectural model and describes its relationship to previous IETF and ISO/IEC/ITU-T standards. In particular, this document's relationship with the IETF PEM specifications and the ISO/IEC/ITU-T X.509 documents is described. Section 4 profiles the X.509 version 3 certificate, and Section 5 profiles the X.509 version 2 CRL. The profiles include the identification of ISO/IEC/ITU-T and ANSI extensions that may be useful in the Internet PKI. The profiles are presented in the 1988 Abstract Syntax Notation One (ASN.1) rather than the 1997 ASN.1 syntax used in the most recent ISO/IEC/ITU-T standards. Section 6 includes certification path validation procedures. These procedures are based upon the ISO/IEC/ITU-T definition. Implementations are REQUIRED to derive the same results but are not required to use the specified procedures. Cooper, et al. Standards Track [Page 4]
RFC 5280 PKIX Certificate and CRL Profile May 2008 Procedures for identification and encoding of public key materials and digital signatures are defined in [RFC3279], [RFC4055], and [RFC4491]. Implementations of this specification are not required to use any particular cryptographic algorithms. However, conforming implementations that use the algorithms identified in [RFC3279], [RFC4055], and [RFC4491] MUST identify and encode the public key materials and digital signatures as described in those specifications. Finally, three appendices are provided to aid implementers. Appendix A contains all ASN.1 structures defined or referenced within this specification. As above, the material is presented in the 1988 ASN.1. Appendix B contains notes on less familiar features of the ASN.1 notation used within this specification. Appendix C contains examples of conforming certificates and a conforming CRL. This specification obsoletes [RFC3280]. Differences from RFC 3280 are summarized below: * Enhanced support for internationalized names is specified in Section 7, with rules for encoding and comparing Internationalized Domain Names, Internationalized Resource Identifiers (IRIs), and distinguished names. These rules are aligned with comparison rules established in current RFCs, including [RFC3490], [RFC3987], and [RFC4518]. * Sections 4.1.2.4 and 4.1.2.6 incorporate the conditions for continued use of legacy text encoding schemes that were specified in [RFC4630]. Where in use by an established PKI, transition to UTF8String could cause denial of service based on name chaining failures or incorrect processing of name constraints. * Section 4.2.1.4 in RFC 3280, which specified the privateKeyUsagePeriod certificate extension but deprecated its use, was removed. Use of this ISO standard extension is neither deprecated nor recommended for use in the Internet PKI. * Section 4.2.1.5 recommends marking the policy mappings extension as critical. RFC 3280 required that the policy mappings extension be marked as non-critical. * Section 4.2.1.11 requires marking the policy constraints extension as critical. RFC 3280 permitted the policy constraints extension to be marked as critical or non-critical. * The Authority Information Access (AIA) CRL extension, as specified in [RFC4325], was added as Section 5.2.7. Cooper, et al. Standards Track [Page 5]
RFC 5280 PKIX Certificate and CRL Profile May 2008 * Sections 5.2 and 5.3 clarify the rules for handling unrecognized CRL extensions and CRL entry extensions, respectively. * Section 5.3.2 in RFC 3280, which specified the holdInstructionCode CRL entry extension, was removed. * The path validation algorithm specified in Section 6 no longer tracks the criticality of the certificate policies extensions in a chain of certificates. In RFC 3280, this information was returned to a relying party. * The Security Considerations section addresses the risk of circular dependencies arising from the use of https or similar schemes in the CRL distribution points, authority information access, or subject information access extensions. * The Security Considerations section addresses risks associated with name ambiguity. * The Security Considerations section references RFC 4210 for procedures to signal changes in CA operations. The ASN.1 modules in Appendix A are unchanged from RFC 3280, except that ub-emailaddress-length was changed from 128 to 255 in order to align with PKCS #9 [RFC2985]. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. 2. Requirements and Assumptions The goal of this specification is to develop a profile to facilitate the use of X.509 certificates within Internet applications for those communities wishing to make use of X.509 technology. Such applications may include WWW, electronic mail, user authentication, and IPsec. In order to relieve some of the obstacles to using X.509 certificates, this document defines a profile to promote the development of certificate management systems, development of application tools, and interoperability determined by policy. Some communities will need to supplement, or possibly replace, this profile in order to meet the requirements of specialized application domains or environments with additional authorization, assurance, or operational requirements. However, for basic applications, common representations of frequently used attributes are defined so that Cooper, et al. Standards Track [Page 6]
RFC 5280 PKIX Certificate and CRL Profile May 2008 application developers can obtain necessary information without regard to the issuer of a particular certificate or certificate revocation list (CRL). A certificate user should review the certificate policy generated by the certification authority (CA) before relying on the authentication or non-repudiation services associated with the public key in a particular certificate. To this end, this standard does not prescribe legally binding rules or duties. As supplemental authorization and attribute management tools emerge, such as attribute certificates, it may be appropriate to limit the authenticated attributes that are included in a certificate. These other management tools may provide more appropriate methods of conveying many authenticated attributes. 2.1. Communication and Topology The users of certificates will operate in a wide range of environments with respect to their communication topology, especially users of secure electronic mail. This profile supports users without high bandwidth, real-time IP connectivity, or high connection availability. In addition, the profile allows for the presence of firewall or other filtered communication. This profile does not assume the deployment of an X.500 directory system [X.500] or a Lightweight Directory Access Protocol (LDAP) directory system [RFC4510]. The profile does not prohibit the use of an X.500 directory or an LDAP directory; however, any means of distributing certificates and certificate revocation lists (CRLs) may be used.