|
Certificate, Certificate Suspension and Revocation List Profile
7.1 Certificate Profile
7.1.1 Version number(s)
CCA issues certificates in conformance with X.509 version 3 and RFC 2459.
7.1.2 Certificate Extensions
- Certificate Extension used are
- Key Usage Marked critical
- Basic Constraints with a pathLenConstraint of '0' marked critical
- Policy Constraint marked critical
- Alternate Identity marked critical
7.1.3 Algorithm object Identifiers
Certificates shall be signed using the RSA algorithm
7.1.4 Name Forms
CCA shall populate the name constraint field in the certificates with directory names.
7.1.5 Name Constraints
RCAI does not support anonymous names. Names must be meaningful and must be associated with the subscriber. Names are constrained to be unique Distinguished Names (DN)
7.1.6 Certificate policy object
Identifier All certificates issued in accordance with this Certification Practice statement shall reference the OID for this policy. The OID for this policy is detailed in section
7.1.7 Usage of Policy Object Identifier
The Policy Constraint is marked critical to ensure that all certificate holders and relying parties are aware of the requirement to conform with this CPS.
7.1.8 Policy qualifiers syntax and semantics
None in the present version.
7.1.9 Processing semantics for the critical certificate policy extension
None in the present version.
7.1.10 Certificate Format
An issued certificate shall contain:
- The identity of the Licensed CA
- Copy of the public key of the Licensed CA
- Unique distinguished name
- Validity period of no longer than five years from the date of issue
- Unique certificate serial number
- Digital signature of RCAI
- For future use
7.2 CRL Profile / Certificate Suspension and Revocation List Profile
7.2.1 Version number(s)
The CCA issues CRLs in conformance with X.509 Ver. 2 CRLs.
7.2.2 CRL and CRL entry extensions
None .
|
