manpagez: man pages & more
info gnutls
Home | html | info | man
[ << ] [ < ] [ Up ] [ > ] [ >> ]         [Top] [Contents] [Index] [ ? ]

4.1.1 X.509 certificate structure

An X.509 certificate usually contains information about the certificate holder, the signer, a unique serial number, expiration dates and some other fields [PKIX] as shown in Table 4.2.

FieldDescription
versionThe field that indicates the version of the certificate.
serialNumberThis field holds a unique serial number per certificate.
signatureThe issuing authority’s signature.
issuerHolds the issuer’s distinguished name.
validityThe activation and expiration dates.
subjectThe subject’s distinguished name of the certificate.
extensionsThe extensions are fields only present in version 3 certificates.

Table 4.2: X.509 certificate fields.

The certificate’s subject or issuer name is not just a single string. It is a Distinguished name and in the ASN.1 notation is a sequence of several object identifiers with their corresponding values. Some of available OIDs to be used in an X.509 distinguished name are defined in ‘gnutls/x509.h’.

The Version field in a certificate has values either 1 or 3 for version 3 certificates. Version 1 certificates do not support the extensions field so it is not possible to distinguish a CA from a person, thus their usage should be avoided.

The validity dates are there to indicate the date that the specific certificate was activated and the date the certificate’s key would be considered invalid.

Certificate extensions are there to include information about the certificate’s subject that did not fit in the typical certificate fields. Those may be e-mail addresses, flags that indicate whether the belongs to a CA etc. All the supported X.509 version 3 extensions are shown in Table 4.3.

ExtensionOIDDescription
Subject key id2.5.29.14An identifier of the key of the subject.
Authority key id2.5.29.35An identifier of the authority’s key used to sign the certificate.
Subject alternative name2.5.29.17Alternative names to subject’s distinguished name.
Key usage2.5.29.15Constraints the key’s usage of the certificate.
Extended key usage2.5.29.37Constraints the purpose of the certificate.
Basic constraints2.5.29.19Indicates whether this is a CA certificate or not, and specify the maximum path lengths of certificate chains.
CRL distribution points2.5.29.31This extension is set by the CA, in order to inform about the issued CRLs.
Proxy Certification Information1.3.6.1.5.5.7.1.14Proxy Certificates includes this extension that contains the OID of the proxy policy language used, and can specify limits on the maximum lengths of proxy chains. Proxy Certificates are specified in [RFC3820].

Table 4.3: X.509 certificate extensions.

In GnuTLS the X.509 certificate structures are handled using the gnutls_x509_crt_t type and the corresponding private keys with the gnutls_x509_privkey_t type. All the available functions for X.509 certificate handling have their prototypes in ‘gnutls/x509.h’. An example program to demonstrate the X.509 parsing capabilities can be found at ex:x509-info.


[ << ] [ < ] [ Up ] [ > ] [ >> ]         [Top] [Contents] [Index] [ ? ]

This document was generated on March 2, 2012 using texi2html 5.0.

© manpagez.com 2000-2024
Individual documents may contain additional copyright information.