1
PKIX1Implicit93 {iso(1) identified-organization(3) dod(6) internet(1)
2
security(5) mechanisms(5) pkix(7) id-mod(0) id-pkix1-implicit-93(4)}
4
DEFINITIONS IMPLICIT TAGS::=
11
id-pe, id-qt, id-kp, id-ad, id-qt-unotice,
12
ORAddress, Name, RelativeDistinguishedName,
13
CertificateSerialNumber, CertificateList,
14
AlgorithmIdentifier, ub-name, DirectoryString,
16
FROM PKIX1Explicit93 {iso(1) identified-organization(3)
17
dod(6) internet(1) security(5) mechanisms(5) pkix(7)
18
id-mod(0) id-pkix1-explicit-93(3)};
20
-- Key and policy information extensions --
22
authorityKeyIdentifier EXTENSION ::= {
23
SYNTAX AuthorityKeyIdentifier
24
IDENTIFIED BY id-ce-authorityKeyIdentifier }
26
AuthorityKeyIdentifier ::= SEQUENCE {
27
keyIdentifier [0] KeyIdentifier OPTIONAL,
28
authorityCertIssuer [1] GeneralNames OPTIONAL,
29
authorityCertSerialNumber [2] CertificateSerialNumber OPTIONAL }
30
( WITH COMPONENTS {..., authorityCertIssuer PRESENT,
31
authorityCertSerialNumber PRESENT} |
32
WITH COMPONENTS {..., authorityCertIssuer ABSENT,
33
authorityCertSerialNumber ABSENT} )
35
KeyIdentifier ::= OCTET STRING
37
subjectKeyIdentifier EXTENSION ::= {
38
SYNTAX SubjectKeyIdentifier
39
IDENTIFIED BY id-ce-subjectKeyIdentifier }
41
SubjectKeyIdentifier ::= KeyIdentifier
43
keyUsage EXTENSION ::= {
45
IDENTIFIED BY id-ce-keyUsage }
47
KeyUsage ::= BIT STRING {
58
extendedKeyUsage EXTENSION ::= {
59
SYNTAX SEQUENCE SIZE (1..MAX) OF KeyPurposeId
60
IDENTIFIED BY id-ce-extKeyUsage }
62
KeyPurposeId ::= OBJECT IDENTIFIER
64
-- PKIX-defined extended key purpose OIDs
65
id-kp-serverAuth OBJECT IDENTIFIER ::= { id-kp 1 }
66
id-kp-clientAuth OBJECT IDENTIFIER ::= { id-kp 2 }
67
id-kp-codeSigning OBJECT IDENTIFIER ::= { id-kp 3 }
68
id-kp-emailProtection OBJECT IDENTIFIER ::= { id-kp 4 }
69
id-kp-ipsecEndSystem OBJECT IDENTIFIER ::= { id-kp 5 }
70
id-kp-ipsecTunnel OBJECT IDENTIFIER ::= { id-kp 6 }
71
id-kp-ipsecUser OBJECT IDENTIFIER ::= { id-kp 7 }
72
id-kp-timeStamping OBJECT IDENTIFIER ::= { id-kp 8 }
74
privateKeyUsagePeriod EXTENSION ::= {
75
SYNTAX PrivateKeyUsagePeriod
76
IDENTIFIED BY { id-ce-privateKeyUsagePeriod } }
78
PrivateKeyUsagePeriod ::= SEQUENCE {
79
notBefore [0] GeneralizedTime OPTIONAL,
80
notAfter [1] GeneralizedTime OPTIONAL }
81
( WITH COMPONENTS {..., notBefore PRESENT} |
82
WITH COMPONENTS {..., notAfter PRESENT} )
84
certificatePolicies EXTENSION ::= {
85
SYNTAX CertificatePoliciesSyntax
86
IDENTIFIED BY id-ce-certificatePolicies }
88
CertificatePoliciesSyntax ::=
89
SEQUENCE SIZE (1..MAX) OF PolicyInformation
91
PolicyInformation ::= SEQUENCE {
92
policyIdentifier CertPolicyId,
93
policyQualifiers SEQUENCE SIZE (1..MAX) OF
94
PolicyQualifierInfo OPTIONAL }
96
CertPolicyId ::= OBJECT IDENTIFIER
98
PolicyQualifierInfo ::= SEQUENCE {
99
policyQualifierId CERT-POLICY-QUALIFIER.&id
100
({SupportedPolicyQualifiers}),
101
qualifier CERT-POLICY-QUALIFIER.&Qualifier
102
({SupportedPolicyQualifiers}
103
{@policyQualifierId})OPTIONAL }
105
SupportedPolicyQualifiers CERT-POLICY-QUALIFIER ::= { noticeToUser |
108
CERT-POLICY-QUALIFIER ::= CLASS {
109
&id OBJECT IDENTIFIER UNIQUE,
110
&Qualifier OPTIONAL }
112
POLICY-QUALIFIER-ID &id
113
[QUALIFIER-TYPE &Qualifier] }
115
policyMappings EXTENSION ::= {
116
SYNTAX PolicyMappingsSyntax
117
IDENTIFIED BY id-ce-policyMappings }
119
PolicyMappingsSyntax ::= SEQUENCE SIZE (1..MAX) OF SEQUENCE {
120
issuerDomainPolicy CertPolicyId,
121
subjectDomainPolicy CertPolicyId }
123
-- Certificate subject and certificate issuer attributes extensions --
125
subjectAltName EXTENSION ::= {
127
IDENTIFIED BY id-ce-subjectAltName }
129
GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
131
GeneralName ::= CHOICE {
132
otherName [0] INSTANCE OF OTHER-NAME,
133
rfc822Name [1] IA5String,
134
dNSName [2] IA5String,
135
x400Address [3] ORAddress,
136
directoryName [4] Name,
137
ediPartyName [5] EDIPartyName,
138
uniformResourceIdentifier [6] IA5String,
139
iPAddress [7] OCTET STRING,
140
registeredID [8] OBJECT IDENTIFIER }
142
OTHER-NAME ::= TYPE-IDENTIFIER
144
EDIPartyName ::= SEQUENCE {
145
nameAssigner [0] DirectoryString {ub-name} OPTIONAL,
146
partyName [1] DirectoryString {ub-name} }
148
issuerAltName EXTENSION ::= {
150
IDENTIFIED BY id-ce-issuerAltName }
152
subjectDirectoryAttributes EXTENSION ::= {
153
SYNTAX AttributesSyntax
154
IDENTIFIED BY id-ce-subjectDirectoryAttributes }
156
AttributesSyntax ::= SEQUENCE SIZE (1..MAX) OF Attribute
158
-- Certification path constraints extensions --
160
basicConstraints EXTENSION ::= {
161
SYNTAX BasicConstraintsSyntax
162
IDENTIFIED BY id-ce-basicConstraints }
164
BasicConstraintsSyntax ::= SEQUENCE {
165
cA BOOLEAN DEFAULT FALSE,
166
pathLenConstraint INTEGER (0..MAX) OPTIONAL }
168
nameConstraints EXTENSION ::= {
169
SYNTAX NameConstraintsSyntax
170
IDENTIFIED BY id-ce-nameConstraints }
172
NameConstraintsSyntax ::= SEQUENCE {
173
permittedSubtrees [0] GeneralSubtrees OPTIONAL,
174
excludedSubtrees [1] GeneralSubtrees OPTIONAL }
176
GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
178
GeneralSubtree ::= SEQUENCE {
180
minimum [0] BaseDistance DEFAULT 0,
181
maximum [1] BaseDistance OPTIONAL }
183
BaseDistance ::= INTEGER (0..MAX)
185
policyConstraints EXTENSION ::= {
186
SYNTAX PolicyConstraintsSyntax
187
IDENTIFIED BY id-ce-policyConstraints }
189
PolicyConstraintsSyntax ::= SEQUENCE {
190
requireExplicitPolicy [0] SkipCerts OPTIONAL,
191
inhibitPolicyMapping [1] SkipCerts OPTIONAL }
193
SkipCerts ::= INTEGER (0..MAX)
195
-- Basic CRL extensions --
197
cRLNumber EXTENSION ::= {
199
IDENTIFIED BY id-ce-cRLNumber }
201
CRLNumber ::= INTEGER (0..MAX)
203
reasonCode EXTENSION ::= {
205
IDENTIFIED BY id-ce-reasonCode }
207
CRLReason ::= ENUMERATED {
211
affiliationChanged (3),
213
cessationOfOperation (5),
217
instructionCode EXTENSION ::= {
218
SYNTAX HoldInstruction
219
IDENTIFIED BY id-ce-instructionCode }
221
HoldInstruction ::= OBJECT IDENTIFIER
223
-- holdinstructions described in this specification, from ANSI x9
225
-- ANSI x9 arc holdinstruction arc
226
holdInstruction OBJECT IDENTIFIER ::= {
227
joint-iso-ccitt(2) member-body(2) us(840) x9cm(10040) 2}
229
-- ANSI X9 holdinstructions referenced by this standard
230
id-holdinstruction-none OBJECT IDENTIFIER ::= {holdInstruction 1}
231
id-holdinstruction-callissuer OBJECT IDENTIFIER ::= {holdInstruction 2}
232
id-holdinstruction-reject OBJECT IDENTIFIER ::= {holdInstruction 3}
234
invalidityDate EXTENSION ::= {
235
SYNTAX GeneralizedTime
236
IDENTIFIED BY id-ce-invalidityDate }
238
-- CRL distribution points and delta-CRL extensions --
240
cRLDistributionPoints EXTENSION ::= {
241
SYNTAX CRLDistPointsSyntax
242
IDENTIFIED BY id-ce-cRLDistributionPoints }
244
CRLDistPointsSyntax ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint
246
DistributionPoint ::= SEQUENCE {
247
distributionPoint [0] DistributionPointName OPTIONAL,
248
reasons [1] ReasonFlags OPTIONAL,
249
cRLIssuer [2] GeneralNames OPTIONAL }
251
DistributionPointName ::= CHOICE {
252
fullName [0] GeneralNames,
253
nameRelativeToCRLIssuer [1] RelativeDistinguishedName }
255
ReasonFlags ::= BIT STRING {
259
affiliationChanged (3),
261
cessationOfOperation (5),
262
certificateHold (6) }
264
issuingDistributionPoint EXTENSION ::= {
265
SYNTAX IssuingDistPointSyntax
266
IDENTIFIED BY id-ce-issuingDistributionPoint }
268
IssuingDistPointSyntax ::= SEQUENCE {
269
distributionPoint [0] DistributionPointName OPTIONAL,
270
onlyContainsUserCerts [1] BOOLEAN DEFAULT FALSE,
271
onlyContainsCACerts [2] BOOLEAN DEFAULT FALSE,
272
onlySomeReasons [3] ReasonFlags OPTIONAL,
273
indirectCRL [4] BOOLEAN DEFAULT FALSE }
275
certificateIssuer EXTENSION ::= {
277
IDENTIFIED BY id-ce-certificateIssuer }
279
deltaCRLIndicator EXTENSION ::= {
281
IDENTIFIED BY id-ce-deltaCRLIndicator }
283
BaseCRLNumber ::= CRLNumber
285
-- Object identifier assignments for ISO certificate extensions --
286
id-ce OBJECT IDENTIFIER ::= {joint-iso-ccitt(2) ds(5) 29}
288
id-ce-subjectDirectoryAttributes OBJECT IDENTIFIER ::= {id-ce 9}
290
id-ce-subjectKeyIdentifier OBJECT IDENTIFIER ::= {id-ce 14}
291
id-ce-keyUsage OBJECT IDENTIFIER ::= {id-ce 15}
292
id-ce-privateKeyUsagePeriod OBJECT IDENTIFIER ::= {id-ce 16}
293
id-ce-subjectAltName OBJECT IDENTIFIER ::= {id-ce 17}
294
id-ce-issuerAltName OBJECT IDENTIFIER ::= {id-ce 18}
295
id-ce-basicConstraints OBJECT IDENTIFIER ::= {id-ce 19}
296
id-ce-cRLNumber OBJECT IDENTIFIER ::= {id-ce 20}
297
id-ce-reasonCode OBJECT IDENTIFIER ::= {id-ce 21}
298
id-ce-instructionCode OBJECT IDENTIFIER ::= {id-ce 23}
299
id-ce-invalidityDate OBJECT IDENTIFIER ::= {id-ce 24}
300
id-ce-deltaCRLIndicator OBJECT IDENTIFIER ::= {id-ce 27}
301
id-ce-issuingDistributionPoint OBJECT IDENTIFIER ::= {id-ce 28}
302
id-ce-certificateIssuer OBJECT IDENTIFIER ::= {id-ce 29}
303
id-ce-nameConstraints OBJECT IDENTIFIER ::= {id-ce 30}
304
id-ce-cRLDistributionPoints OBJECT IDENTIFIER ::= {id-ce 31}
305
id-ce-certificatePolicies OBJECT IDENTIFIER ::= {id-ce 32}
306
id-ce-policyMappings OBJECT IDENTIFIER ::= {id-ce 33}
307
id-ce-policyConstraints OBJECT IDENTIFIER ::= {id-ce 36}
308
id-ce-authorityKeyIdentifier OBJECT IDENTIFIER ::= {id-ce 35}
309
id-ce-extKeyUsage OBJECT IDENTIFIER ::= {id-ce 37}
313
authorityInfoAccess EXTENSION ::= {
314
SYNTAX AuthorityInfoAccessSyntax
315
IDENTIFIED BY id-pe-authorityInfoAccess }
317
AuthorityInfoAccessSyntax ::=
318
SEQUENCE SIZE (1..MAX) OF AccessDescription
320
AccessDescription ::= SEQUENCE {
321
accessMethod OBJECT IDENTIFIER,
322
accessLocation GeneralName }
324
id-pe-authorityInfoAccess OBJECT IDENTIFIER ::= { id-pe 1 }
326
id-ad-ocsp OBJECT IDENTIFIER ::= { id-ad 1 }
327
id-ad-caIssuers OBJECT IDENTIFIER ::= { id-ad 2 }
329
-- PKIX policy qualifier definitions
331
noticeToUser CERT-POLICY-QUALIFIER ::= {
332
POLICY-QUALIFIER-ID id-qt-cps QUALIFIER-TYPE CPSuri}
334
pointerToCPS CERT-POLICY-QUALIFIER ::= {
335
POLICY-QUALIFIER-ID id-qt-unotice QUALIFIER-TYPE UserNotice}
337
id-qt-cps OBJECT IDENTIFIER ::= { id-qt 1 }
339
id-qt-unotice OBJECT IDENTIFIER ::= { id-qt 2 }
343
UserNotice ::= SEQUENCE {
344
noticeRef NoticeReference OPTIONAL,
345
explicitText DisplayText OPTIONAL}
347
NoticeReference ::= SEQUENCE {
348
organization DisplayText,
349
noticeNumbers SEQUENCE OF INTEGER }
351
DisplayText ::= CHOICE {
352
visibleString VisibleString (SIZE (1..200)),
353
bmpString BMPString (SIZE (1..200)),
354
utf8String UTF8String (SIZE (1..200)) }