rfc3039.txt

来自「RFC 的详细文档！」· 文本 代码 · 共 1,771 行 · 第 1/5 页

           }
       }
   }

C.1.1.2 The keyUsage extension

   petrasKeyUsage KeyUsage ::= {nonRepudiation}

C.1.1.3 The certificatePolicies extension

   petrasCertificatePolicies CertificatePoliciesSyntax ::= {
       {
           policyIdentifier {1 3 36 8 1 1}
       }
   }

C.1.1.4 The qcStatements extension

   petrasQCStatement QCStatements ::= {
       {
           statementId   id-qcs-pkixQCSyntax-v1,
           statementInfo SemanticsInformation : {
               nameRegistrationAuthorities {
                   rfc822Name : "[e-mail]"
               }
          }
       }
   }

C.1.1.5 The authorityKeyIdentifier extension

   petrasAKI AuthorityKeyIdentifier ::= {
       keyIdentifier '000102030405060708090A0B0C0D0E0FFEDCBA98'H
   }



Santesson, et al.           Standards Track                    [Page 26]

RFC 3039             Qualified Certificates Profile         January 2001


C.1.2 The certificate

   The signed portion of the certificate is shown here in the value
   notation defined in [X.680].  Note that extension values are already
   DER encoded in this structure.  Some values has been truncated for
   readability purposes.

   {
     version v3,
     serialNumber 1234567890,
     signature
     {
       algorithm { 1 2 840 113549 1 1 5 },
       parameters RSAParams : NULL
     },
     issuer rdnSequence :
       {
         {
           {
             type { 2 5 4 6 },
             value PrintableString : "DE"
           }
         },
         {
           {
             type { 2 5 4 10 },
             value UTF8String :
               "GMD - Forschungszentrum Informationstechnik GmbH"
           }
         }
       },
     validity
     {
       notBefore utcTime : "000501100000Z",
       notAfter utcTime : "001101100000Z"
     },
     subject rdnSequence :
       {
         {
           {
             type { 2 5 4 6 },
             value PrintableString : "DE"
           }
         },
         {
           {
             type { 2 5 4 10 },
             value UTF8String :



Santesson, et al.           Standards Track                    [Page 27]

RFC 3039             Qualified Certificates Profile         January 2001


               "GMD Forschungszentrum Informationstechnik GmbH"
           }
         },
         {
           {
             type { 2 5 4 4 },
             value UTF8String : "Barzin"
           },
           {
             type { 2 5 4 42 },
             value UTF8String : "Petra"
           }
         }
       },
     subjectPublicKeyInfo
     {
       algorithm
       {
         algorithm { 1 2 840 113549 1 1 1 },
         parameters RSAParams : NULL
       },
       subjectPublicKey '00110000 10000001 10000111 00000010 1000 ...'B
     },
     extensions
     {
       {
         extnId { 2 5 29 9 },  -- subjectDirectoryAttributes
         extnValue '305B301006082B06010505070904310413024445300F0 ...'H
       },
       {
         extnId { 2 5 29 15 }, -- keyUsage
         critical TRUE,
         extnValue '03020640'H
       },
       {
         extnId { 2 5 29 32 }, -- certificatePolicies
         extnValue '3009300706052B24080101'H
       },
       {
         extnId { 2 5 29 35 }, -- authorityKeyIdentifier
         extnValue '30168014000102030405060708090A0B0C0D0E0FFEDCBA98'H
       },
       {
         extnId { 1 3 6 1 5 5 7 1 3 }, -- qcStatements
         extnValue '302B302906082B06010505070B01301D301B81196D756 ...'H
       }
     }
   }



Santesson, et al.           Standards Track                    [Page 28]

RFC 3039             Qualified Certificates Profile         January 2001


C.2 ASN.1 dump

   This section contains an ASN.1 dump of the signed portion of the
   certificate.  Some values has been truncated for readability
   purposes.

   TBSCertificate SEQUENCE: tag = [UNIVERSAL 16] constructed;
     length = 631
     version : tag = [0] constructed; length = 3
       Version INTEGER: tag = [UNIVERSAL 2] primitive; length = 1
         2
     serialNumber CertificateSerialNumber INTEGER: tag = [UNIVERSAL 2]
       primitive; length = 4
       1234567890
     signature AlgorithmIdentifier SEQUENCE: tag = [UNIVERSAL 16]
       constructed; length = 13
       algorithm OBJECT IDENTIFIER: tag = [UNIVERSAL 6] primitive;
         length = 9
         { 1 2 840 113549 1 1 5 }
       parameters OpenType: NULL: tag = [UNIVERSAL 5] primitive;
         length = 0
         NULL
     issuer Name CHOICE
       rdnSequence RDNSequence SEQUENCE OF: tag = [UNIVERSAL 16]
         constructed; length = 72
         RelativeDistinguishedName SET OF: tag = [UNIVERSAL 17]
           constructed; length = 11
           AttributeTypeAndValue SEQUENCE: tag = [UNIVERSAL 16]
             constructed; length = 9
             type OBJECT IDENTIFIER: tag = [UNIVERSAL 6] primitive;
               length = 3
               { 2 5 4 6 }
             value OpenType: PrintableString: tag = [UNIVERSAL 19]
               primitive; length = 2
               "DE"
         RelativeDistinguishedName SET OF: tag = [UNIVERSAL 17]
           constructed; length = 57
           AttributeTypeAndValue SEQUENCE: tag = [UNIVERSAL 16]
           constructed; length = 55
             type OBJECT IDENTIFIER: tag = [UNIVERSAL 6] primitive;
               length = 3
               { 2 5 4 10 }
             value OpenType : UTF8String: tag = [UNIVERSAL 12]
               primitive; length = 48
               0x474d44202d20466f72736368756e67737a656e7472756d2049...
     validity Validity SEQUENCE: tag = [UNIVERSAL 16] constructed;
       length = 30
       notBefore Time CHOICE



Santesson, et al.           Standards Track                    [Page 29]

RFC 3039             Qualified Certificates Profile         January 2001


         utcTime UTCTime: tag = [UNIVERSAL 23] primitive; length = 13
           000501100000Z
       notAfter Time CHOICE
         utcTime UTCTime: tag = [UNIVERSAL 23] primitive; length = 13
           001101100000Z
     subject Name CHOICE
       rdnSequence RDNSequence SEQUENCE OF: tag = [UNIVERSAL 16]
         constructed; length = 101
         RelativeDistinguishedName SET OF: tag = [UNIVERSAL 17]
           constructed; length = 11
           AttributeTypeAndValue SEQUENCE: tag = [UNIVERSAL 16]
             constructed; length = 9
             type OBJECT IDENTIFIER: tag = [UNIVERSAL 6] primitive;
               length = 3
               { 2 5 4 6 }
             value OpenType: PrintableString: tag = [UNIVERSAL 19]
               primitive; length = 2
               "DE"
         RelativeDistinguishedName SET OF: tag = [UNIVERSAL 17]
           constructed; length = 55
           AttributeTypeAndValue SEQUENCE: tag = [UNIVERSAL 16]
             constructed; length = 53
             type OBJECT IDENTIFIER: tag = [UNIVERSAL 6] primitive;
               length = 3
               { 2 5 4 10 }
             value OpenType: UTF8String: tag = [UNIVERSAL 12]
               primitive; length = 46
               0x474d4420466f72736368756e67737a656e7472756d20496e66...
         RelativeDistinguishedName SET OF: tag = [UNIVERSAL 17]
           constructed; length = 29
           AttributeTypeAndValue SEQUENCE: tag = [UNIVERSAL 16]
             constructed; length = 13
             type OBJECT IDENTIFIER: tag = [UNIVERSAL 6] primitive;
               length = 3
               { 2 5 4 4 }
             value OpenType: UTF8String: tag = [UNIVERSAL 12]
               primitive; length = 6
               0x4261727a696e
           AttributeTypeAndValue SEQUENCE: tag = [UNIVERSAL 16]
             constructed; length = 12
             type OBJECT IDENTIFIER: tag = [UNIVERSAL 6] primitive;
               length = 3
               { 2 5 4 42 }
             value OpenType: UTF8String: tag = [UNIVERSAL 12]
               primitive; length = 5
               0x5065747261
     subjectPublicKeyInfo SubjectPublicKeyInfo SEQUENCE: tag =
       [UNIVERSAL 16] constructed; length = 157



Santesson, et al.           Standards Track                    [Page 30]

RFC 3039             Qualified Certificates Profile         January 2001


       algorithm AlgorithmIdentifier SEQUENCE: tag = [UNIVERSAL 16]
         constructed; length = 13
         algorithm OBJECT IDENTIFIER: tag = [UNIVERSAL 6] primitive;
           length = 9
           { 1 2 840 113549 1 1 1 }
         parameters OpenType: NULL: tag = [UNIVERSAL 5] primitive;
           length = 0
           NULL
       subjectPublicKey BIT STRING: tag = [UNIVERSAL 3] primitive;
         length = 139
         0x0030818702818100b8488400d4b6088be48ead459ca19ec717aaf3d1d...
     extensions : tag = [3] constructed; length = 233
       Extensions SEQUENCE OF: tag = [UNIVERSAL 16] constructed;
         length = 230
         Extension SEQUENCE: tag = [UNIVERSAL 16] constructed;
           length = 100
           extnId OBJECT IDENTIFIER: tag = [UNIVERSAL 6] primitive;
             length = 3
             { 2 5 29 9 }
           extnValue OCTET STRING: tag = [UNIVERSAL 4] primitive;
             length = 93
             0x305b301006082b06010505070904310413024445300f06082b060...
         Extension SEQUENCE: tag = [UNIVERSAL 16] constructed;
           length = 14
           extnId OBJECT IDENTIFIER: tag = [UNIVERSAL 6] primitive;
             length = 3
             { 2 5 29 15 }
           critical BOOLEAN: tag = [UNIVERSAL 1] primitive; length = 1
             TRUE
           extnValue OCTET STRING: tag = [UNIVERSAL 4] primitive;
             length = 4
             0x03020640
         Extension SEQUENCE: tag = [UNIVERSAL 16] constructed;
           length = 18
           extnId OBJECT IDENTIFIER: tag = [UNIVERSAL 6] primitive;
             length = 3
             { 2 5 29 32 }
           extnValue OCTET STRING: tag = [UNIVERSAL 4] primitive;
             length = 11
             0x3009300706052b24080101
         Extension SEQUENCE: tag = [UNIVERSAL 16] constructed;
           length = 31
           extnId OBJECT IDENTIFIER: tag = [UNIVERSAL 6] primitive;
             length = 3
             { 2 5 29 35 }
           extnValue OCTET STRING: tag = [UNIVERSAL 4] primitive;
             length = 24
             0x30168014000102030405060708090a0b0c0d0e0ffedcba98



Santesson, et al.           Standards Track                    [Page 31]

RFC 3039             Qualified Certificates Profile         January 2001


         Extension SEQUENCE: tag = [UNIVERSAL 16] constructed;
           length = 57
           extnId OBJECT IDENTIFIER: tag = [UNIVERSAL 6] primitive;
             length = 8
             { 1 3 6 1 5 5 7 1 3 }
           extnValue OCTET STRING: tag = [UNIVERSAL 4] primitive;
             length = 45
             0x302b302906082b06010505070b01301d301b81196d756e6963697...

C.3 DER-encoding

   This section contains the full, DER-encoded certificate, in hex.

   3082030E30820277A0030201020204499602D2300D06092A864886F70D010105
   05003048310B300906035504061302444531393037060355040A0C30474D4420
   2D20466F72736368756E67737A656E7472756D20496E666F726D6174696F6E73
   746563686E696B20476D6248301E170D3030303530313130303030305A170D30
   30313130313130303030305A3065310B30090603550406130244453137303506
   0355040A0C2E474D4420466F72736368756E67737A656E7472756D20496E666F
   726D6174696F6E73746563686E696B20476D6248311D300C060355042A0C0550
   65747261300D06035504040C064261727A696E30819D300D06092A864886F70D
   010101050003818B0030818702818100B8488400D4B6088BE48EAD459CA19EC7
   17AAF3D1D4EE3ECCA496128A13597D16CC8B85EB37EFCE110C63B01E684E5CF6
   32291EAC60FD153C266EAAC36AD4CEA92319F9BFDD261AD2BFE41EAB4E17FE67
   8341EE52D9A0A8B4DEC07B7ACC76762514045CEE9994E0CF37BAE05F8DE33B35
   FF98BCE77742CE4B12273BD122137FE9020105A381E93081E630640603551D09
   045D305B301006082B06010505070904310413024445300F06082B0601050507
   09033103130146301D06082B060105050709013111180F313937313130313430
   30303030305A301706082B06010505