generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Add FAQ about AKID.

Browse Source
This commit is contained in:
Dr. Stephen Henson 2006-02-11 00:46:34 +00:00
parent b480283c56
commit a070f0dac5
1 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
FAQ
View File

@ -32,6 +32,7 @@ OpenSSL - Frequently Asked Questions
* How do I install a CA certificate into a browser? * How do I install a CA certificate into a browser?
* Why is OpenSSL x509 DN output not conformant to RFC2253? * Why is OpenSSL x509 DN output not conformant to RFC2253?
* What is a "128 bit certificate"? Can I create one with OpenSSL? * What is a "128 bit certificate"? Can I create one with OpenSSL?
* Why does OpenSSL set the authority key identifier extension incorrectly?
[BUILD] Questions about building and testing OpenSSL [BUILD] Questions about building and testing OpenSSL
@ -425,6 +426,25 @@ The export laws were later changed to allow almost unrestricted use of strong
encryption so these certificates are now obsolete. encryption so these certificates are now obsolete.
* Why does OpenSSL set the authority key identifier AKID) extension incorrectly?
It doesn't: this extension is often the cause of confusion.
Consider a certificate chain A->B->C so that A signs, B and B signs C. Suppose
certificate C contains AKID.
The purpose of this extension is to identify the authority certificate B. This
can be done either by including the subject key identifier of B or its issuer
name and serial number.
In this latter case because it is identifying certifcate B it must contain the
issuer name and serial number of B.
It is often wrongly assumed that it should contain the issuer name of C. If it
did this would be redundant information because it would duplicate the issuer
name of C.
[BUILD] ======================================================================= [BUILD] =======================================================================
* Why does the linker complain about undefined symbols? * Why does the linker complain about undefined symbols?