The identification of a CA certificate during chain validation is based on the Authority Key Identifier (AKI) certificate extension of the certificate being verified. A certificate's AKI field can contain different types of information:
- Issuer name and serial number of the issuer's certificate--If the AKI field contains this information, the chain-validation software tries to find a matching certificate by using the certificate's Serial number and Subject fields. This method of identifying a certificate is called an exact match.
- Public Key identifier (KeyID) of the issuer's certificate--If the AKI field contains this information, the chain-validation logic tries to find a matching certificate by using the certificate's Subject Key Identifier (SKI) extension, which contains a unique identifier for a certificate subject's public key. This method of identifying a certificate is called a key match.
If the certificate being verified doesn't contain an AKI field, the chain-validation software tries to identify the issuing CA's certificate by matching the name in the Issuer field of the certificate being verified with the name in a certificate's Subject field. This method of identifying a certificate is called a name match. . . .
Register
