增加RC数据结构和资源集合数据结构 (#1)
Co-authored-by: xiuting.xu <xiutingxt.xu@gmail.com> Reviewed-on: #1 Reviewed-by: yuyr <yuyr@zgclab.edu.cn> Co-authored-by: xuxt <xuxt@zgclab.edu.cn> Co-committed-by: xuxt <xuxt@zgclab.edu.cn>
This commit was merged in pull request #1.
This commit is contained in:
36
specs/01_tal.md
Normal file
36
specs/01_tal.md
Normal file
@@ -0,0 +1,36 @@
|
||||
# 01. Trust Anchor Locator (TAL)
|
||||
|
||||
## 1.1 对象定位
|
||||
TAL是一个数据格式/配置文件，目的是告诉RP信任锚的公钥是什么，以及相关对象可以从哪里获取。
|
||||
|
||||
## 1.2 数据格式 （RFC 8630 §2.2）
|
||||
TAL是一个配置文件，格式定义如下：
|
||||
```
|
||||
The TAL is an ordered sequence of:
|
||||
1. an optional comment section consisting of one or more lines each starting with the "#" character, followed by human-readable informational UTF-8 text, conforming to the restrictions defined
|
||||
in Section 2 of [RFC5198], and ending with a line break,
|
||||
2. a URI section that is comprised of one or more ordered lines, each containing a TA URI, and ending with a line break,
|
||||
3. a line break, and
|
||||
4. a subjectPublicKeyInfo [RFC5280] in DER format [X.509], encoded in base64 (see Section 4 of [RFC4648]). To avoid long lines,
|
||||
line breaks MAY be inserted into the base64-encoded string.
|
||||
Note that line breaks in this file can use either "<CRLF>" or "<LF>".
|
||||
```
|
||||
|
||||
## 1.3 抽象数据模型
|
||||
|
||||
### 1.3.1 TAL
|
||||
|
||||
| 字段 | 类型 | 语义 | 约束/解析规则 | RFC 引用 |
|
||||
|----------|-------------|-------------------------|--------------------------------------------|---------------|
|
||||
| uris | Vec<TalUri> | 指向TA的URI列表 | 允许rsync和https协议。 | RFC 8630 §2.1 |
|
||||
| comment | Vec<String> | 注释（可选） | | RFC 8630 §2.2 |
|
||||
| spki_der | Vec<u8> | 原始的subjectPublicKeyInfo | x.509 SubjectPublicKeyInfo DER编码，再base64编码 | RFC 8630 §2.2 |
|
||||
|
||||
|
||||
### 1.3.2 TalUri
|
||||
|
||||
| 字段 | 类型 | 语义 | 约束/解析规则 | RFC 引用 |
|
||||
|-------|--------|---------|---------|---------------|
|
||||
| Rsync | String | rsync地址 | | RFC 8630 §2.1 |
|
||||
| Https | String | https地址 | | RFC 8630 §2.1 |
|
||||
|
||||
121
specs/02_ta.md
Normal file
121
specs/02_ta.md
Normal file
@@ -0,0 +1,121 @@
|
||||
# 02. Trust Anchor (TA)
|
||||
|
||||
## 2.1 对象定位
|
||||
TA是一个自签名的CA证书。
|
||||
|
||||
## 2.2 原始载体与编码
|
||||
|
||||
- 载体：X.509 certificates.
|
||||
- 编码：DER（遵循 RFC 5280 的 certificate 结构与字段语义，但受限于RFC 8630 §2.3）
|
||||
|
||||
|
||||
## 2.3 抽象数据类型
|
||||
|
||||
### 2.3.1 TA
|
||||
|
||||
| 字段 | 类型 | 语义 | 约束/解析规则 | RFC 引用 |
|
||||
|-------------------|------------------|---------------|---------|---------------|
|
||||
| name | String | 标识该TA，如apnic等 | | |
|
||||
| cert_der | Vec<u8> | 原始DER内容 | | |
|
||||
| cert | X509Certificate | 基础X509证书 | | RFC 5280 §4.1 |
|
||||
| resource | ResourceSet | 资源集合 | | |
|
||||
| publication_point | Uri | 获取该TA的URI | | |
|
||||
|
||||
### 2.3.2 ResourceSet
|
||||
资源集合是来自RFC 3779的IP地址块（§2）和AS号段（§3)，受约束于RFC 8630 §2.3
|
||||
|
||||
| 字段 | 类型 | 语义 | 约束/解析规则 | RFC 引用 |
|
||||
|------|----------------|--------|-------------|---------------------------|
|
||||
| ips | IpResourceSet | IP地址集合 | 不能是inherit | RFC 3779 §2和RFC 8630 §2.3 |
|
||||
| asns | AsnResourceSet | ASN集合 | 不能是inherit | RFC 3779 §3和RFC 8630 §2.3 |
|
||||
|
||||
[//]: # ()
|
||||
[//]: # (### 2.3.3 IpResourceSet)
|
||||
|
||||
[//]: # (包括IPv4和IPv6的前缀表示)
|
||||
|
||||
[//]: # ()
|
||||
[//]: # (| 字段 | 类型 | 语义 | 约束/解析规则 | RFC 引用 |)
|
||||
|
||||
[//]: # (|----|------------------------|----------|-------------|--------------|)
|
||||
|
||||
[//]: # (| v4 | PrefixSet<Ipv4Prefix> | IPv4前缀集合 | | RFC 3779 §2 |)
|
||||
|
||||
[//]: # (| v6 | PrefixSet<Ipv6Prefix> | IPv6前缀集合 | | RFC 3779 §2 |)
|
||||
|
||||
[//]: # ()
|
||||
[//]: # (### 2.3.4 AsnResourceSet)
|
||||
|
||||
[//]: # ()
|
||||
[//]: # (| 字段 | 类型 | 语义 | 约束/解析规则 | RFC 引用 |)
|
||||
|
||||
[//]: # (|-------|--------------------|-------|-------------|-------------|)
|
||||
|
||||
[//]: # (| range | RangeSet<AsnBlock> | ASN集合 | | RFC 3779 §3 |)
|
||||
|
||||
[//]: # ()
|
||||
[//]: # (### 2.3.5 Ipv4Prefix)
|
||||
|
||||
[//]: # ()
|
||||
[//]: # (| 字段 | 类型 | 语义 | 约束/解析规则 | RFC 引用 |)
|
||||
|
||||
[//]: # (|------|-----|-----|---------|-------------|)
|
||||
|
||||
[//]: # (| addr | u32 | 地址 | | RFC 3779 §2 |)
|
||||
|
||||
[//]: # (| len | u8 | 长度 | 0-32 | RFC 3779 §2 |)
|
||||
|
||||
[//]: # ()
|
||||
[//]: # ()
|
||||
[//]: # (### 2.3.6 Ipv6Prefix)
|
||||
|
||||
[//]: # ()
|
||||
[//]: # (| 字段 | 类型 | 语义 | 约束/解析规则 | RFC 引用 |)
|
||||
|
||||
[//]: # (|------|------|-----|---------|-------------|)
|
||||
|
||||
[//]: # (| addr | u128 | 地址 | | RFC 3779 §2 |)
|
||||
|
||||
[//]: # (| len | u8 | 长度 | 0-128 | RFC 3779 §2 |)
|
||||
|
||||
[//]: # ()
|
||||
[//]: # (### 2.3.7 AsnBlock)
|
||||
|
||||
[//]: # ()
|
||||
[//]: # (| 字段 | 类型 | 语义 | 约束/解析规则 | RFC 引用 |)
|
||||
|
||||
[//]: # (|----------|----------|-------|---------|--------------|)
|
||||
|
||||
[//]: # (| asn | Asn | ASN | | RFC 3779 §3 |)
|
||||
|
||||
[//]: # (| asnRange | AsnRange | ASN范围 | | RFC 3779 §3 |)
|
||||
|
||||
[//]: # ()
|
||||
[//]: # ()
|
||||
[//]: # (### 2.3.8 Asn)
|
||||
|
||||
[//]: # ()
|
||||
[//]: # (| 字段 | 类型 | 语义 | 约束/解析规则 | RFC 引用 |)
|
||||
|
||||
[//]: # (|-----|-----|-----|---------|-------------|)
|
||||
|
||||
[//]: # (| asn | u32 | ASN | | RFC 3779 §3 |)
|
||||
|
||||
[//]: # ()
|
||||
[//]: # (### 2.3.8 AsnRange)
|
||||
|
||||
[//]: # ()
|
||||
[//]: # (| 字段 | 类型 | 语义 | 约束/解析规则 | RFC 引用 |)
|
||||
|
||||
[//]: # (|-----|-----|-------|---------|--------------|)
|
||||
|
||||
[//]: # (| min | Asn | 最小ASN | | RFC 3779 §3 |)
|
||||
|
||||
[//]: # (| max | Asn | 最大ASN | | RFC 3779 §3 |)
|
||||
|
||||
# 2.4 TA校验流程（RFC 8630 §3）
|
||||
1. 从TAL的URI列表中获取证书对象。（顺序访问，若前面失效，再访问后面的）
|
||||
2. 验证证书格式，必须是当前、有效的自签名RPKI证书。
|
||||
3. 验证公钥匹配。TAL中的SubjectPublicKeyInfo与下载证书的公钥一致。
|
||||
4. 其他检查。
|
||||
5. 更新本地存储库缓存。
|
||||
314
specs/03_rc.md
Normal file
314
specs/03_rc.md
Normal file
@@ -0,0 +1,314 @@
|
||||
# 03. RC (Resource Certifications)
|
||||
|
||||
## 3.1 对象定位
|
||||
RC是资源证书，包括CA和EE
|
||||
|
||||
## 3.2 原始载体与编码
|
||||
|
||||
- 载体：X.509 certificates.
|
||||
- 编码：DER（遵循 RFC 5280 的 Certificate 结构与字段语义，但受 RPKI profile 限制）RFC 6487 §4
|
||||
|
||||
### 3.2.1 基本语法（RFC 5280 §4，RFC 6487 ）
|
||||
|
||||
RC是遵循RFC5280定义的X.509Certificate语法(RFC 5280 §4)，并且符合RFC 6487 §4的约束。只选取RFC 6487 §4章节列出来的字段。（Unless specifically noted as being OPTIONAL, all the fields listed
|
||||
here MUST be present, and any other fields MUST NOT appear in a
|
||||
conforming resource certificate.）
|
||||
|
||||
```
|
||||
Certificate ::= SEQUENCE {
|
||||
tbsCertificate TBSCertificate,
|
||||
signatureAlgorithm AlgorithmIdentifier,
|
||||
signatureValue BIT STRING
|
||||
}
|
||||
|
||||
TBSCertificate ::= SEQUENCE {
|
||||
version [0] EXPLICIT Version MUST be v3,
|
||||
serialNumber CertificateSerialNumber,
|
||||
signature AlgorithmIdentifier,
|
||||
issuer Name,
|
||||
subject Name,
|
||||
validity Validity,
|
||||
subjectPublicKeyInfo SubjectPublicKeyInfo,
|
||||
extensions [3] EXPLICIT Extensions OPTIONAL
|
||||
-- If present, version MUST be v3
|
||||
}
|
||||
|
||||
Version ::= INTEGER { v1(0), v2(1), v3(2) }
|
||||
|
||||
CertificateSerialNumber ::= INTEGER
|
||||
|
||||
Validity ::= SEQUENCE {
|
||||
notBefore Time,
|
||||
notAfter Time }
|
||||
|
||||
Time ::= CHOICE {
|
||||
utcTime UTCTime,
|
||||
generalTime GeneralizedTime }
|
||||
|
||||
UniqueIdentifier ::= BIT STRING
|
||||
|
||||
SubjectPublicKeyInfo ::= SEQUENCE {
|
||||
algorithm AlgorithmIdentifier,
|
||||
subjectPublicKey BIT STRING }
|
||||
|
||||
Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
|
||||
|
||||
Extension ::= SEQUENCE {
|
||||
extnID OBJECT IDENTIFIER,
|
||||
critical BOOLEAN DEFAULT FALSE,
|
||||
extnValue OCTET STRING
|
||||
-- contains the DER encoding of an ASN.1 value
|
||||
-- corresponding to the extension type identified
|
||||
-- by extnID
|
||||
}
|
||||
```
|
||||
|
||||
> 其中`Name` "a valid X.501 distinguished name"(RFC 6487 §4.4)
|
||||
|
||||
### 3.2.2 证书扩展字段 （RFC 6487 §4.8)
|
||||
|
||||
RC的证书扩展字段按照RFC 6487 §4.8的规定，有以下几个扩展：
|
||||
|
||||
- Basic Constraints
|
||||
- Subject Key Identifier
|
||||
- Authority Key Identifier
|
||||
- Key Usage
|
||||
- Extended Key Usage(CA证书，以及验证RPKI对象的EE证书不能出现该字段。非RPKI对象的EE可以出现EKU，但必须为non-critical)
|
||||
- CRL Distribution Points
|
||||
- Authority Information Access
|
||||
- Subject Information Access
|
||||
- SIA for CA Certificates
|
||||
- SIA for EE Certificates
|
||||
- Certificate Policies
|
||||
- IP Resources
|
||||
- AS Resources
|
||||
|
||||
```
|
||||
# Basic Constraints
|
||||
id-ce-basicConstraints OBJECT IDENTIFIER ::= { id-ce 19 }
|
||||
|
||||
BasicConstraints ::= SEQUENCE {
|
||||
cA BOOLEAN DEFAULT FALSE }
|
||||
|
||||
|
||||
# Subject Key Identifier
|
||||
id-ce-subjectKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 14 }
|
||||
|
||||
SubjectKeyIdentifier ::= KeyIdentifier
|
||||
|
||||
KeyIdentifier ::= OCTET STRING
|
||||
|
||||
|
||||
# Authority Key Identifier
|
||||
id-ce-authorityKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 35 }
|
||||
|
||||
AuthorityKeyIdentifier ::= SEQUENCE {
|
||||
keyIdentifier [0] KeyIdentifier OPTIONAL }
|
||||
|
||||
|
||||
# Key Usage
|
||||
id-ce-keyUsage OBJECT IDENTIFIER ::= { id-ce 15 }
|
||||
|
||||
KeyUsage ::= BIT STRING {
|
||||
digitalSignature (0),
|
||||
nonRepudiation (1), -- recent editions of X.509 have
|
||||
-- renamed this bit to contentCommitment
|
||||
keyEncipherment (2),
|
||||
dataEncipherment (3),
|
||||
keyAgreement (4),
|
||||
keyCertSign (5),
|
||||
cRLSign (6),
|
||||
encipherOnly (7),
|
||||
decipherOnly (8) }
|
||||
|
||||
|
||||
# Extended Key Usage
|
||||
id-ce-extKeyUsage OBJECT IDENTIFIER ::= { id-ce 37 }
|
||||
|
||||
ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId
|
||||
|
||||
KeyPurposeId ::= OBJECT IDENTIFIER
|
||||
|
||||
|
||||
# CRL Distribution Points
|
||||
id-ce-cRLDistributionPoints OBJECT IDENTIFIER ::= { id-ce 31 }
|
||||
|
||||
CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint
|
||||
|
||||
DistributionPoint ::= SEQUENCE {
|
||||
distributionPoint [0] DistributionPointName OPTIONAL }
|
||||
|
||||
DistributionPointName ::= CHOICE {
|
||||
fullName [0] GeneralNames }
|
||||
|
||||
|
||||
## Authority Information Access
|
||||
id-pe-authorityInfoAccess OBJECT IDENTIFIER ::= { id-pe 1 }
|
||||
|
||||
AuthorityInfoAccessSyntax ::=
|
||||
SEQUENCE SIZE (1..MAX) OF AccessDescription
|
||||
|
||||
AccessDescription ::= SEQUENCE {
|
||||
accessMethod OBJECT IDENTIFIER,
|
||||
accessLocation GeneralName }
|
||||
|
||||
# AccessDescription
|
||||
id-ad OBJECT IDENTIFIER ::= { id-pkix 48 }
|
||||
# CA 证书发布位置
|
||||
id-ad-caIssuers OBJECT IDENTIFIER ::= { id-ad 2 }
|
||||
# OCSP 服务地址
|
||||
id-ad-ocsp OBJECT IDENTIFIER ::= { id-ad 1 }
|
||||
|
||||
|
||||
# Subject Information Access
|
||||
id-pe-subjectInfoAccess OBJECT IDENTIFIER ::= { id-pe 11 }
|
||||
|
||||
SubjectInfoAccessSyntax ::= SEQUENCE SIZE (1..MAX) OF AccessDescription
|
||||
AccessDescription ::= SEQUENCE {
|
||||
accessMethod OBJECT IDENTIFIER,
|
||||
accessLocation GeneralName }
|
||||
|
||||
## Subject Information Access for CA (RFC 6487 §4.8.8.1)
|
||||
id-ad OBJECT IDENTIFIER ::= { id-pkix 48 }
|
||||
id-ad-rpkiManifest OBJECT IDENTIFIER ::= { id-ad 10 }
|
||||
|
||||
必须存在一个accessMethod=id-ad-caRepository，accessLocation=rsyncURI。
|
||||
必须存在一个accessMethod=id-ad-repiManifest, accessLocation=rsync URI，指向该CA的mft对象。
|
||||
|
||||
## Subject Information Access for EE (RFC 6487 §4.8.8.2)
|
||||
id-ad-signedObject OBJECT IDENTIFIER ::= { id-ad 11 }
|
||||
|
||||
必须存在一个accessMethod=id-ad-signedObject, accessLocation=rsyncURI
|
||||
不允许其他的accessMethod
|
||||
|
||||
|
||||
# Certificate Policies
|
||||
id-ce-certificatePolicies OBJECT IDENTIFIER ::= { id-ce 32 }
|
||||
anyPolicy OBJECT IDENTIFIER ::= { id-ce-certificatePolicies 0 }
|
||||
|
||||
certificatePolicies ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation
|
||||
|
||||
PolicyInformation ::= SEQUENCE {
|
||||
policyIdentifier CertPolicyId,
|
||||
policyQualifiers SEQUENCE SIZE (1..MAX) OF PolicyQualifierInfo OPTIONAL }
|
||||
|
||||
CertPolicyId ::= OBJECT IDENTIFIER
|
||||
|
||||
PolicyQualifierInfo ::= SEQUENCE {
|
||||
policyQualifierId PolicyQualifierId,
|
||||
qualifier ANY DEFINED BY policyQualifierId }
|
||||
|
||||
-- policyQualifierIds for Internet policy qualifiers
|
||||
id-qt OBJECT IDENTIFIER ::= { id-pkix 2 }
|
||||
id-qt-cps OBJECT IDENTIFIER ::= { id-qt 1 }
|
||||
id-qt-unotice OBJECT IDENTIFIER ::= { id-qt 2 }
|
||||
|
||||
PolicyQualifierId ::= OBJECT IDENTIFIER ( id-qt-cps | id-qt-unotice )
|
||||
|
||||
Qualifier ::= CHOICE {
|
||||
cPSuri CPSuri,
|
||||
userNotice UserNotice }
|
||||
|
||||
CPSuri ::= IA5String
|
||||
|
||||
UserNotice ::= SEQUENCE {
|
||||
noticeRef NoticeReference OPTIONAL,
|
||||
explicitText DisplayText OPTIONAL }
|
||||
|
||||
NoticeReference ::= SEQUENCE {
|
||||
organization DisplayText,
|
||||
noticeNumbers SEQUENCE OF INTEGER }
|
||||
|
||||
DisplayText ::= CHOICE {
|
||||
ia5String IA5String (SIZE (1..200)),
|
||||
visibleString VisibleString (SIZE (1..200)),
|
||||
bmpString BMPString (SIZE (1..200)),
|
||||
utf8String UTF8String (SIZE (1..200)) }
|
||||
|
||||
|
||||
# IP Resources
|
||||
id-pe-ipAddrBlocks OBJECT IDENTIFIER ::= { id-pe 7 }
|
||||
|
||||
IPAddrBlocks ::= SEQUENCE OF IPAddressFamily
|
||||
|
||||
IPAddressFamily ::= SEQUENCE { -- AFI & optional SAFI --
|
||||
addressFamily OCTET STRING (SIZE (2..3)),
|
||||
ipAddressChoice IPAddressChoice }
|
||||
|
||||
IPAddressChoice ::= CHOICE {
|
||||
inherit NULL, -- inherit from issuer --
|
||||
addressesOrRanges SEQUENCE OF IPAddressOrRange }
|
||||
|
||||
IPAddressOrRange ::= CHOICE {
|
||||
addressPrefix IPAddress,
|
||||
addressRange IPAddressRange }
|
||||
|
||||
IPAddressRange ::= SEQUENCE {
|
||||
min IPAddress,
|
||||
max IPAddress }
|
||||
|
||||
IPAddress ::= BIT STRING
|
||||
|
||||
|
||||
# AS Resources
|
||||
id-pe-autonomousSysIds OBJECT IDENTIFIER ::= { id-pe 8 }
|
||||
ASIdentifiers ::= SEQUENCE {
|
||||
asnum [0] EXPLICIT ASIdentifierChoice OPTIONAL,
|
||||
rdi [1] EXPLICIT ASIdentifierChoice OPTIONAL}
|
||||
|
||||
ASIdentifierChoice ::= CHOICE {
|
||||
inherit NULL, -- inherit from issuer --
|
||||
asIdsOrRanges SEQUENCE OF ASIdOrRange }
|
||||
|
||||
ASIdOrRange ::= CHOICE {
|
||||
id ASId,
|
||||
range ASRange }
|
||||
|
||||
ASRange ::= SEQUENCE {
|
||||
min ASId,
|
||||
max ASId }
|
||||
|
||||
ASId ::= INTEGER
|
||||
```
|
||||
|
||||
# 3.3 抽象数据结构
|
||||
采用X509 Certificate + Resource + 约束校验的方式组合
|
||||
|
||||
| 字段 | 类型 | 语义 | 约束/解析规则 | RFC 引用 |
|
||||
|----------|---------------------|----------|---------|---------------|
|
||||
| cert_der | Vec<u8> | 证书原始数据 | | |
|
||||
| cert | X509Certificate | 基础X509证书 | | RFC 5280 §4.1 |
|
||||
| resource | ResourceSet | 资源集合 | | |
|
||||
|
||||
|
||||
# 3.4 约束规则
|
||||
|
||||
## 3.4.1 Cert约束校验规则
|
||||
RFC 6487中规定的证书的字段参见[3.2.1 ](#321-基本语法rfc-5280-4rfc-6487-)
|
||||
-
|
||||
|
||||
| 字段 | 语义 | 约束/解析规则 | RFC 引用 |
|
||||
|-----------|-------|----------------------------------------------|--------------|
|
||||
| version | 证书版本 | 必须是v3(值为2） | RFC6487 §4.1 |
|
||||
| serial | 证书编号 | 同一个CA签发的证书编号必须唯一 | RFC6487 §4.2 |
|
||||
| validity | 证书有效期 | notBefore：时间不能早于证书的生成时间。若时间段大于上级证书的有效期，也是有效的 | RFC6487 §4.6 |
|
||||
|
||||
|
||||
## 3.4.2 Cert Extentions中字段的约束校验规则
|
||||
RFC 6487中规定的扩展字段参见[3.2.2 ](#322-证书扩展字段-rfc-6487-48)
|
||||
|
||||
| 字段 | critical | 语义 | 约束/解析规则 | RFC 引用 |
|
||||
|----------------------------|----------|-------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------|
|
||||
| basicConstraints | Y | 证书类型 | CA证书：cA=TRUE; EE证书：cA=FALSE | RFC6487 §4.8.1 |
|
||||
| subjectKeyIdentifier | N | 证书公钥 | SKI = SHA-1(DER-encoded SPKI bit string) | RFC6487 §4.8.2 |
|
||||
| authorityKeyIdentifier | N | 父证书的公钥 | 字段只包含keyIdentifier，不能包含authorityCertIssuer和authorityCertSerialNumber；除了自签名CA外，其余证书必须出现。自签名CA若出现该字段，则等于SKI | RFC6487 §4.8.3 |
|
||||
| keyUsage | Y | 证书公钥的用途权限 | CA证书：keyCertSign = TRUE, cRLSign = TRUE 其他都是FALSE。EE证书：digitalSignature = TRUE 其他都是FALSE | RFC6487 §4.8.4 |
|
||||
| extendedKeyUsage | N | 扩展证书公钥的用途权限 | CA证书：不能出现EKU；验证 RPKI 对象的 EE 证书：不能出现EKU；非 RPKI 对象的 EE：可以出现EKU，但必须为non-critical. | RFC6487 §4.8.5 |
|
||||
| cRLDistributionPoints | N | CRL的发布点位置 | 字段：distributionPoint，不能包含reasons、cRLIssuer。其中distributionPoint字段包含：fullName，不能包含nameRelativeToCRLIssuer。fullName的格式必须是URI。自签名证书禁止出现该字段。非自签名证书必须出现。一个CA只能有一个CRL。一个CRLDP只能包含一个distributionPoint。但一个distributionPoint字段中可以包含多于1个的URI，但必须包含rsync URI且必须是最新的。 | RFC6487 §4.8.6 |
|
||||
| authorityInformationAccess | N | 签发者的发布点位置 | 除了自签名的CA，必须出现。自签名CA，禁止出现。推荐的URI访问方式是rsync，并且rsyncURI的话，必须指定accessMethod=id-ad-caIssuers | RFC6487 §4.8.7 |
|
||||
| subjectInformationAccess | N | 发布点位置 | CA证书：必须存在。必须存在一个accessMethod=id-ad-caRepository，accessLocation=rsyncURI。必须存在一个accessMethod=id-ad-repiManifest,accessLocation=rsync URI，指向该CA的mft对象。 EE证书：必须存在。必须存在一个accessMethod=id-ad-signedObject,accessLocation=rsyncURI。不允许其他的accessMethod | RFC6487 §4.8.8 |
|
||||
| certificatePolicies | Y | 证书策略 | 必须存在，并且只能存在一种策略：RFC 6484 — RPKI Certificate Policy (CP) | RFC6487 §4.8.9 |
|
||||
| iPResources | Y | IP地址集合 | 所有的RPKI证书中必须包含IP Resources或者ASResources，或者两者都包含。 | RFC6487 §4.8.10 |
|
||||
| aSResources | Y | ASN集合 | 所有的RPKI证书中必须包含IP Resources或者ASResources，或者两者都包含。 | RFC6487 §4.8.11 |
|
||||
|
||||
|
||||
Reference in New Issue
Block a user