Most .der and .cer files hold an X.509 certificate, the
structure defined for the internet by RFC 5280. Some hold a revocation list, a key
(PKCS #8 or PKCS #1) or a PKCS #7 bundle instead; the first SEQUENCE’s contents tell
them apart. This page gives the certificate and CRL structures; the encoding itself is
on the encoding rules page.
Sources: RFC 5280 (sections 4, 5 and the ASN.1 modules in Appendix A) for the structures, attribute, extension, key purpose and reason values; RFC 4055 for the RSA OIDs, RFC 5480 and RFC 5758 for the elliptic-curve ones, RFC 8410 for Ed25519.
Certificate
Certificate ::= SEQUENCE {
tbsCertificate TBSCertificate,
signatureAlgorithm AlgorithmIdentifier,
signatureValue BIT STRING }| Field of TBSCertificate | Encoding | Meaning |
|---|---|---|
version | [0] EXPLICIT INTEGER, default 0 | 0 v1, 1 v2, 2 v3. Certificates with extensions are v3. |
serialNumber | INTEGER | Unique per issuer; positive, at most 20 octets. |
signature | AlgorithmIdentifier | The signature algorithm; must match signatureAlgorithm. |
issuer | Name | Who signed it. See names. |
validity | SEQUENCE of two Times | notBefore and notAfter: UTCTime up to 2049, GeneralizedTime from 2050 (UTCTime years 50–99 mean 1950–1999). GeneralizedTime here has no fractional seconds. A notAfter of 99991231235959Z means no well-defined expiry. |
subject | Name | Whom the certificate is for. |
subjectPublicKeyInfo | SEQUENCE { AlgorithmIdentifier, BIT STRING } | The public key and its algorithm. |
issuerUniqueID | [1] IMPLICIT BIT STRING, optional | v2 and later; rarely used. |
subjectUniqueID | [2] IMPLICIT BIT STRING, optional | v2 and later; rarely used. |
extensions | [3] EXPLICIT SEQUENCE OF Extension, optional | v3. Each Extension is { extnID OID, critical BOOLEAN default false, extnValue OCTET STRING holding the DER of the extension’s value }. |
An AlgorithmIdentifier is a SEQUENCE of an OID and optional parameters. Common
ones: 1.2.840.113549.1.1.1 RSA, 1.2.840.113549.1.1.11
SHA-256 with RSA, 1.2.840.113549.1.1.10 RSASSA-PSS,
1.2.840.10045.2.1 elliptic-curve public key,
1.2.840.10045.4.3.2 ECDSA with SHA-256, 1.3.101.112
Ed25519.
Names
A Name is a SEQUENCE OF RelativeDistinguishedName, each a SET OF { type OID, value }.
RFC 5280 requires CAs to encode DirectoryString values as PrintableString or
UTF8String, except that a CA’s or CRL issuer’s subject must match the encoding it uses
in the issuer field of what it issues. The OIDs below are under
id-at (2.5.4), except domain component and the e-mail
address, which RFC 5280 keeps only for legacy implementations.
| Attribute | Short name | OID |
|---|---|---|
| Common name | CN | 2.5.4.3 |
| Surname | SN | 2.5.4.4 |
| Serial number | – | 2.5.4.5 |
| Country | C | 2.5.4.6 |
| Locality | L | 2.5.4.7 |
| State or province | ST | 2.5.4.8 |
| Organisation | O | 2.5.4.10 |
| Organisational unit | OU | 2.5.4.11 |
| Title | – | 2.5.4.12 |
| Given name | – | 2.5.4.42 |
| Initials | – | 2.5.4.43 |
| Generation qualifier | – | 2.5.4.44 |
| DN qualifier | – | 2.5.4.46 |
| Pseudonym | – | 2.5.4.65 |
| Domain component | DC | 0.9.2342.19200300.100.1.25 |
| Email address (legacy) | – | 1.2.840.113549.1.9.1 |
Extensions
| OID | Extension | Value |
|---|---|---|
2.5.29.9 | Subject directory attributes | Attributes of the subject. |
2.5.29.14 | Subject key identifier | An OCTET STRING identifying this public key. |
2.5.29.15 | Key usage | A BIT STRING; see key usage. |
2.5.29.17 | Subject alternative name | GeneralNames: the host names, addresses or e-mail addresses covered. |
2.5.29.18 | Issuer alternative name | GeneralNames. |
2.5.29.19 | Basic constraints | SEQUENCE { cA BOOLEAN default false, pathLenConstraint INTEGER optional }. |
2.5.29.30 | Name constraints | Permitted and excluded subtrees of names for certificates below a CA. |
2.5.29.31 | CRL distribution points | Where to fetch revocation lists. |
2.5.29.32 | Certificate policies | Policy OIDs, with qualifiers; 2.5.29.32.0 is any policy. |
2.5.29.33 | Policy mappings | Pairs of issuer and subject policy OIDs. |
2.5.29.35 | Authority key identifier | Identifies the issuer’s key, usually by its subject key identifier. |
2.5.29.36 | Policy constraints | Requirements on explicit policies below a CA. |
2.5.29.37 | Extended key usage | A list of key purpose OIDs; see key purposes. |
2.5.29.46 | Freshest CRL | Where to fetch delta CRLs. |
2.5.29.54 | Inhibit anyPolicy | Certificates after which “any policy” stops counting. |
1.3.6.1.5.5.7.1.1 | Authority information access | How to reach the issuer: …48.1 OCSP responder, …48.2 CA issuers (the issuer’s certificate). |
1.3.6.1.5.5.7.1.11 | Subject information access | Services of the subject: …48.3 time stamping, …48.5 CA repository. |
GeneralName
A CHOICE told apart by its context tag: [0] otherName,
[1] rfc822Name (e-mail address, IA5String), [2] dNSName
(IA5String), [3] x400Address, [4] directoryName (Name),
[5] ediPartyName, [6] uniformResourceIdentifier (IA5String),
[7] iPAddress (OCTET STRING of 4 or 16 bytes, or 8 or 32 with a mask in
name constraints), [8] registeredID (OID).
Key usage bits
| Bit | Name |
|---|---|
| 0 | digitalSignature |
| 1 | nonRepudiation (now contentCommitment) |
| 2 | keyEncipherment |
| 3 | dataEncipherment |
| 4 | keyAgreement |
| 5 | keyCertSign |
| 6 | cRLSign |
| 7 | encipherOnly |
| 8 | decipherOnly |
Bit 0 is the most significant bit of the first content octet after the unused-bits count.
Key purposes
| OID | Purpose |
|---|---|
1.3.6.1.5.5.7.3.1 | TLS server authentication |
1.3.6.1.5.5.7.3.2 | TLS client authentication |
1.3.6.1.5.5.7.3.3 | Code signing |
1.3.6.1.5.5.7.3.4 | E-mail protection |
1.3.6.1.5.5.7.3.8 | Time stamping |
1.3.6.1.5.5.7.3.9 | OCSP signing |
2.5.29.37.0 | Any extended key usage |
Certificate revocation lists
CertificateList ::= SEQUENCE {
tbsCertList TBSCertList,
signatureAlgorithm AlgorithmIdentifier,
signatureValue BIT STRING }
TBSCertList ::= SEQUENCE {
version INTEGER OPTIONAL, -- 1 (v2) if present
signature AlgorithmIdentifier,
issuer Name,
thisUpdate Time,
nextUpdate Time OPTIONAL,
revokedCertificates SEQUENCE OF SEQUENCE {
userCertificate INTEGER, -- serial number
revocationDate Time,
crlEntryExtensions Extensions OPTIONAL } OPTIONAL,
crlExtensions [0] EXPLICIT Extensions OPTIONAL }| OID | CRL extension |
|---|---|
2.5.29.20 | CRL number |
2.5.29.27 | Delta CRL indicator (critical) |
2.5.29.28 | Issuing distribution point (critical) |
2.5.29.35, .18, .46, 1.3.6.1.5.5.7.1.1 | Authority key identifier, issuer alternative name, freshest CRL, authority information access |
2.5.29.21 | Entry: reason code |
2.5.29.24 | Entry: invalidity date |
2.5.29.29 | Entry: certificate issuer (critical) |
| Reason code | Meaning |
|---|---|
| 0 | unspecified |
| 1 | keyCompromise |
| 2 | cACompromise |
| 3 | affiliationChanged |
| 4 | superseded |
| 5 | cessationOfOperation |
| 6 | certificateHold |
| 7 | not used |
| 8 | removeFromCRL |
| 9 | privilegeWithdrawn |
| 10 | aACompromise |