RFC 2312

S/MIME Version 2 Certificate Handling

📅 published March 1998, from ietf

S/MIME Version 2 Certificate Handling 💌

Okay bestie, this is RFC 2312 💖 and it's Informational, so it's history for the record and not an official IETF standard 🙈 It came out in March 1998 from the Network Working Group. The author squad is S. Dusse (RSA Data Security), P. Hoffman (Internet Mail Consortium), B. Ramsdell (Worldtalk), and J. Weinstein (Netscape). The title block doesn't list anything it obsoletes or updates, so it stands on its own 🦋 The whole thing is about how S/MIME agents handle certificates 🔐

Status of this Memo 📜

This memo gives information to the Internet community ✨ It doesn't specify an Internet standard of any kind, and distribution of it is unlimited 🌸

Copyright Notice ©️

1. Overview ✨

Okay so S/MIME (Secure/Multipurpose Internet Mail Extensions), described in [SMIME-MSG], is how you send and receive secure MIME messages 💌 To validate the keys of a message sent to it, an S/MIME agent needs to certify that the key is valid. This memo describes the mechanisms S/MIME uses to create and validate keys using certificates 🔑

This spec is compatible with PKCS #7 because it uses the data types PKCS #7 defines. It also inherits all the varieties of architectures for certificate-based key management that PKCS #7 supports 🧚 Note that the method S/MIME messages use to make certificate requests is defined in [SMIME-MSG].

In order to handle S/MIME certificates, an agent has to follow the specifications in this memo, plus some of the specifications in these documents:

"PKCS #1: RSA Encryption", [PKCS-1].
"PKCS #7: Cryptographic Message Syntax", [PKCS-7]
"PKCS #10: Certification Request Syntax", [PKCS-10].

Please note 🙈 The information here is historical material published for the public record. It is not an IETF standard. When this document says "standard," it means a standard for adopters of S/MIME version 2, not an IETF standard.

1.1 Definitions 📚

For this memo, the following definitions apply 💅

ASN.1: Abstract Syntax Notation One, as defined in CCITT X.208.
BER: Basic Encoding Rules for ASN.1, as defined in CCITT X.209.
Certificate: A type that binds an entity's distinguished name to a public key with a digital signature. This type is defined in CCITT X.509 [X.509]. It also contains the distinguished name of the certificate issuer (the signer), an issuer-specific serial number, the issuer's signature algorithm identifier, and a validity period.
Certificate Revocation List (CRL): A type that contains information about certificates whose validity an issuer has prematurely revoked 💀 The information consists of an issuer name, the time of issue, the next scheduled time of issue, and a list of certificate serial numbers and their associated revocation times. The CRL is signed by the issuer. The type this spec intends is the one defined in [KEYM].
DER: Distinguished Encoding Rules for ASN.1, as defined in CCITT X.509.

1.2 Compatibility with Prior Practice of S/MIME 🎀

Appendix C has important info about how S/MIME agents following this specification should act so they get the greatest interoperability with earlier implementations of S/MIME 🫶

1.3 Terminology 🌈

Throughout this memo, the terms MUST, MUST NOT, SHOULD, and SHOULD NOT are written in capital letters. This follows the definitions in [MUSTSHOULD]. [MUSTSHOULD] explains how these key words help make the intent of standards track documents as clear as possible ✨ The same key words are used in this document to help implementors reach interoperability 🦋

2. PKCS #7 Options 🍓

The PKCS #7 message format allows a huge variety of options for content and algorithm support 🤯 This section lays out a bunch of support requirements and recommendations so every S/MIME implementation gets a base level of interoperability 🫶 Most of the PKCS #7 format for S/MIME messages is defined in [SMIME-MSG].

2.1 CertificateRevocationLists 🔥

Receiving agents MUST support the Certificate Revocation List (CRL) format defined in [KEYM]. If sending agents include CRLs in outgoing messages, the CRL format defined in [KEYM] MUST be used.

All agents MUST validate CRLs and check certificates against CRLs, if available, in accordance with [KEYM]. All agents SHOULD check the nextUpdate field in the CRL against the current time. If the current time is later than the nextUpdate time, the action the agent takes is a local decision. For instance, it could warn a human user, it could retrieve a new CRL if able, and so on 👑

Receiving agents MUST recognize CRLs in received S/MIME messages.

Clients MUST use revocation information included as a CRL in an S/MIME message when verifying the signature and certificate path validity in that message. Clients SHOULD store CRLs received in messages for use in processing later messages 💜

Clients MUST handle multiple valid Certificate Authority (CA) certificates containing the same subject name and the same public keys but with overlapping validity intervals 🌸

2.2 ExtendedCertificateOrCertificate 🧚

Receiving agents MUST support X.509 v1 and X.509 v3 certificates. See [KEYM] for details about the profile for certificate formats. End entity certificates MUST include an Internet mail address, as described in section 3.1 💌

2.2.1 Historical Note About PKCS #7 Certificates 🕰️

The PKCS #7 message format supports a choice of two certificate formats for public key content types: X.509 and PKCS #6 Extended Certificates. The PKCS #6 format isn't in widespread use 💀 Also, proposed revisions of X.509 certificates cover much of the same functionality and flexibility the PKCS #6 format was meant to provide. Thus, sending and receiving agents MUST NOT use PKCS #6 extended certificates 🙅‍♀️

2.3 ExtendedCertificateAndCertificates 🦋

Receiving agents MUST be able to handle an arbitrary number of certificates, with arbitrary relationships to the message sender and to each other, in arbitrary order 🌈 In many cases, the certificates in a signed message represent a chain of certification from the sender to a particular root. There may be, however, situations where the certificates in a signed message are unrelated and included for convenience.

Sending agents SHOULD include any certificates for the user's public key(s) and associated issuer certificates. This makes it more likely that the intended recipient can establish trust in the originator's public key(s) ✨ This is especially important when sending a message to recipients who may not have access to the sender's public key through any other means, or when sending a signed message to a new recipient. Certificates can be left out of outgoing messages if S/MIME objects are sent within a group of correspondents that already have access to each other's certificates by some other means, such as a shared directory or manual certificate distribution. Receiving S/MIME agents SHOULD be able to handle messages without certificates, using a database or directory lookup scheme 🔍

A sending agent SHOULD include at least one chain of certificates up to, but not including, a Certificate Authority (CA) that it believes the recipient may trust as authoritative. A receiving agent SHOULD be able to handle an arbitrarily large number of certificates and chains 👑

Clients MAY send CA certificates, meaning certificates that are self-signed and can be considered the "root" of other chains 🌸 Note that receiving agents SHOULD NOT simply trust any self-signed certificates as valid CAs. Instead, they SHOULD use some other mechanism to determine whether a CA should be trusted 🙈

Receiving agents MUST support chaining based on the distinguished name fields. Other methods of building certificate chains may be supported, but they are not currently recommended 💅

3. Distinguished Names in Certificates 🎀

3.1 Using Distinguished Names for Internet Mail 💖

The format of an X.509 certificate includes fields for the subject name and issuer name. The subject name identifies the owner of a particular public key/private key pair. The issuer name is meant to identify the entity that "certified" the subject, meaning who signed the subject's certificate 🔐 Both names are defined by X.509 as Distinguished Names.

Distinguished Names are defined by the CCITT standard X.501 [X.501] 🌈 A Distinguished Name is broken into one or more Relative Distinguished Names. Each Relative Distinguished Name is made up of one or more Attribute-Value Assertions. Each Attribute-Value Assertion consists of an Attribute Identifier and its corresponding value information, such as CountryName=US. Distinguished Names were meant to identify entities in the X.500 directory tree [X.500] 🌳 Each Relative Distinguished Name can be thought of as a node in that tree, described by some collection of Attribute-Value Assertions. The entire Distinguished Name is a collection of nodes that traverse a path from the root of the tree to an end node representing a particular entity.

The goal of the directory was to give everything a way to uniquely name every communications entity everywhere 🌍 However, adoption of a global X.500 directory infrastructure has been slower than expected. Because of that, there is no requirement for X.500 directory service provision in the S/MIME environment. Still, such provision would almost undoubtedly be super valuable for making key management for S/MIME easier 🙌

Using Distinguished Names the X.500 way isn't very widespread 🥲 Internet mail addresses, as described in RFC 822 [RFC-822], are used almost exclusively on the Internet to identify message originators and recipients 📬 Internet mail addresses don't look anything like X.500 Distinguished Names, though (except, maybe, that they're both hierarchical). Some method is needed to map Internet mail addresses to the entities that hold public keys. Some people have suggested dropping the X.509 certificate format in favor of other binding mechanisms. Instead, S/MIME keeps the X.509 certificate and Distinguished Name mechanisms, and tailors the content of the naming info to suit the Internet mail environment 💜

End-entity certificates MUST contain an Internet mail address as described in [RFC-822]. The address must be an "addr-spec" as defined in Section 6.1 of that specification 💌

Receiving agents MUST recognize email addresses in the subjectAltName field. Receiving agents MUST recognize email addresses in the Distinguished Name field 🫶

Sending agents SHOULD make the address in the From header of a mail message match an Internet mail address in the signer's certificate. Receiving agents MUST check that the address in the From header of a mail message matches an Internet mail address in the signer's certificate. A receiving agent MUST provide some explicit alternate processing of the message if this comparison fails, which may be to reject the message 🚨 This check is the whole vibe, so don't skip it 👀

3.2 Required Name Attributes 🎀

Okay bestie, receiving agents MUST support parsing zero, one, or more instances of each of the name attributes below inside the Distinguished Names in certificates. They have to be able to read all of them 💅

Sending agents MUST include the Internet mail address when they create a Distinguished Name. Which other attributes you include or leave out, and what order they go in, is mostly up to the policies of the certification service that certifies the name and public key, so check their rules 🦋

CountryName
StateOrProvinceName
Locality
CommonName
Title
Organization
OrganizationalUnit
StreetAddress
PostalCode
PhoneNumber
EmailAddress

Everything except EmailAddress is explained in [X.520]. EmailAddress is an IA5String, and it can have multiple attribute values 💌

4. Certificate Processing 🧚

A receiving agent needs some kind of certificate retrieval mechanism so it can get its hands on certificates for the recipients of digital envelopes 📬 There are lots of ways to build one. X.500 directory service is a great example of a retrieval-only mechanism that works with classic X.500 Distinguished Names. The PKIX Working Group is looking into other options, and the IETF is also considering handing out certificates through the existing Domain Name System (DNS). Until these are widely used, they might not be super useful, since only a small number of correspondents' certificates can be retrieved. At a minimum, for early S/MIME deployment, a user agent could automatically send a message to the intended recipient asking for their certificate in a signed return message 🙋

Receiving and sending agents SHOULD also give users a way to "store and protect" certificates for their correspondents, so they can be retrieved later for sure ✨ In a lot of environments, it makes sense to link retrieval and storage together in some sort of certificate database. In its simplest form, that database is local to one user and works like an "address book" for their frequent correspondents. That way, retrieval is limited to certificates the user has already stored (presumably from incoming messages). A complete certificate retrieval/storage solution may combine two or more mechanisms for the greatest flexibility and usefulness. For instance, a secure Internet mail agent may check a centralized retrieval mechanism for a certificate when it can't be found in the user's local certificate storage/retrieval database 🔍

Receiving and sending agents SHOULD provide a way to import and export certificates using a PKCS #7 certs-only message. This lets you import and export full certificate chains instead of just a single certificate. It's described in [SMIME-MSG] 📦

4.1 Certificate Revocation Lists 🚫

A receiving agent SHOULD have access to some certificate-revocation list (CRL) retrieval mechanism so it can get certificate-revocation information when validating certificate chains. A receiving or sending agent SHOULD also provide a way for a user to store incoming certificate-revocation information for correspondents, in a way that guarantees it can be retrieved later. Still, it's always better to get the latest info from the CA than to rely on info stored away from incoming messages 💯

Receiving and sending agents SHOULD retrieve and use CRL information every single time a certificate is verified as part of a certificate chain validation, even if that certificate was already verified in the past. Still, in lots of situations (like off-line verification), getting the latest CRL information can be hard or impossible. So how much you rely on CRL information may depend on how valuable the protected information is. How much CRL information matters in a particular context is outside the scope of this memo, but it may be governed by the policies of particular certificate hierarchies 🌸

4.2 Certificate Chain Validation 🔗

When you build a user agent for secure messaging, certificate, CRL, and certificate chain validation SHOULD be highly automated while still acting in the user's best interests. Certificate, CRL, and chain validation MUST be performed when validating a correspondent's public key. That's necessary when (a) verifying a signature from a correspondent and (b) creating a digital envelope with the correspondent as the intended recipient 🫶

Certificates and CRLs reach the chain validation procedure in two ways: (a) incoming messages, and (b) certificate and CRL retrieval mechanisms. Certificates and CRLs in incoming messages don't have to be in any particular order, and they don't have to be related to the sender or recipient of the message (although in most cases they will be related to the sender). Incoming certificates and CRLs SHOULD be cached for use in chain validation and optionally stored for later use. This temporary certificate and CRL cache SHOULD be used to augment any other certificate and CRL retrieval mechanisms for chain validation on incoming signed messages 🧠

4.3 Certificate and CRL Signing Algorithms ✍️

Certificates and Certificate-Revocation Lists (CRLs) are signed by the certificate issuer. A receiving agent MUST be able to verify signatures on certificates and CRLs made with the md5WithRSAEncryption and sha-1WithRSAEncryption signature algorithms, with key sizes from 512 bits to 2048 bits, as described in [SMIME-MSG]. A receiving agent SHOULD be able to verify signatures on certificates and CRLs made with the md2WithRSAEncryption signature algorithm, with key sizes from 512 bits to 2048 bits 🔐

4.4 X.509 Version 3 Certificate Extensions 🧩

The X.509 v3 standard describes an extensible framework where the basic certificate information can be extended, and how those extensions can be used to control the process of issuing and validating certificates. The PKIX Working Group is actively working on identifying and creating extensions that are valuable in particular certification environments. So there's still a fair amount of profiling work to do before everyone agrees on which v3 extensions will be used. There are also active efforts underway to issue X.509 v3 certificates for business purposes. This memo identifies the minimum required set of certificate extensions that have the greatest value in the S/MIME environment. The basicConstraints and keyUsage extensions are defined in [X.509] 🌈

Sending and receiving agents MUST correctly handle the v3 Basic Constraints Certificate Extension, the Key Usage Certificate Extension, authorityKeyID, subjectKeyID, and the subjectAltNames when they appear in end-user certificates. Some mechanism SHOULD exist to handle the defined v3 certificate extensions when they appear in intermediate or CA certificates 🙌

Certificates issued for the S/MIME environment SHOULD NOT contain any critical extensions other than those listed here. These extensions SHOULD be marked as non-critical unless proper handling of the extension is deemed critical to the correct interpretation of the associated certificate. Other extensions may be included, but those extensions SHOULD NOT be marked as critical 🚦

4.4.1 Basic Constraints Certificate Extension 🏗️

The basic constraints extension delimits the role and position that an issuing authority or end-user certificate plays in a chain of certificates.

For example, certificates issued to CAs and subordinate CAs contain a basic constraint extension that identifies them as issuing authority certificates. End-user subscriber certificates contain an extension that stops the certificate from being an issuing authority certificate 👑

Certificates SHOULD contain a basicContstraints extension.

4.4.2 Key Usage Certificate Extension 🔑

The key usage extension limits the technical purposes for which a public key listed in a valid certificate may be used. Issuing authority certificates may contain a key usage extension that restricts the key to signing certificates, certificate revocation lists and other data 💜

For example, a certification authority may create subordinate issuer certificates that contain a keyUsage extension specifying that the corresponding public key can be used to sign end user certs and sign CRLs 🍓

5. Generating Keys and Certification Requests ✨

5.1 Binding Names and Keys ✨

okay so bestie, an S/MIME agent (or some admin tool or function) MUST be capable of generating a certification request from a user's public key and their name info 🔑. Usually the public/private key pair gets made at the same time, but sometimes the keying info comes from somewhere else, like a cryptographic token or a "key recovery" service 🧚.

There SHOULD NOT be multiple valid (aka non-expired and non-revoked) certificates for the same key pair bound to different Distinguished Names 🙅‍♀️. Otherwise there's a security flaw where an attacker can swap one valid certificate for another in a way the recipient can't detect, and that is NOT it 💀. If a user wants to change their name (or make an alternate one), the user agent SHOULD generate a new key pair 🦋. And if they want to reuse an existing key pair with a new or alternate name, the user SHOULD first have any valid certificates for the existing public key revoked 🍓.

In general, a user can request certification for the same name with a different public key, from the same or a different certification authority. This is totally fine for both end-entity and issuer certificates, and it can be super useful when you need to switch issuer keys smoothly 🌈.

CAs that re-use their own name with distinct keys MUST include the AuthorityKeyIdentifier extension in the certificates they issue, and MUST have the SubjectKeyIdentifier extension in their own certificate. CAs SHOULD use these extensions uniformly 👑.

Clients SHOULD handle multiple valid CA certificates that certify different public keys but contain the same subject name (in this case, that CA's name) 💜.

When picking the right issuer's certificate to verify a given certificate, clients SHOULD process the AuthorityKeyIdentifier and SubjectKeyIdentifier extensions 🔍.

5.2 Using PKCS #10 for Certification Requests 📜

PKCS #10 is a flexible, extensible message format for representing the results of cryptographic operations on some data 🎀. The naming info you pick is mostly decided by the policies and procedures of the certification service you're going to, so it's not a free-for-all 🙈.

Besides key and naming info, PKCS #10 also supports optional attributes, signed by the entity requesting certification ✨. This lets you pass along info that helps the request process, even if it isn't part of the Distinguished Name being certified. Iconic 💅.

Receiving agents MUST support identifying an RSA key with the rsa defined in X.509 and the rsaEncryption OID 🧠. Certification authorities MUST support sha-1WithRSAEncryption and md5WithRSAEncryption, and SHOULD support MD2WithRSAEncryption, for verifying signatures on certificate requests as described in [SMIME-MSG] 🔐.

When you create and submit certification requests, RSA keys SHOULD be identified with the rsaEncryption OID and signed with the sha-1WithRSAEncryption signature algorithm 🌸. Certification requests MUST NOT be signed with the md2WithRSAEncryption signature algorithm. Absolutely not, no cap 🚫.

Certification requests MUST include a valid Internet mail address, either as part of the certificate (as described in 3.2) or as part of the PKCS #10 attribute list 📬. Certification authorities MUST check that the address in the From: header matches either of those addresses. CAs SHOULD let the CA operator configure how messages with non-matching addresses get processed ⭐.

Certification authorities SHOULD support parsing zero or one instance of each of the following certification-request attributes in incoming messages 🫶. An implementation that doesn't support a particular attribute may either send the requestor a warning message or silently ignore it. Whether you include these attributes when creating and submitting a certification request will most likely be dictated by the policies of the certification service that certifies the name and public key, so check with them first 🧚‍♀️.

postalAddress
challengePassword
unstructuredAddress

postalAddress is described in [X.520] 🏡.

5.2.1 Challenge Password 🔒

The challenge-password attribute type specifies a password that an entity may use to request certificate revocation 🚨. What the password means is meant to be specified by the certificate's issuer, and no particular interpretation is required. This attribute type is meant for PKCS #10 certification requests 💖.

Challenge-password attribute values have the ASN.1 type ChallengePassword:

ChallengePassword ::= CHOICE {
  PrintableString, T61String }

A challenge-password attribute must have a single attribute value 🙃.

It is expected that if UCS becomes an ASN.1 type (e.g., UNIVERSAL STRING), ChallengePassword will become a CHOICE type:

ChallengePassword ::= CHOICE {
    PrintableString, T61String, UNIVERSAL STRING }

5.2.2 Unstructured Address 🌷

The unstructured-address attribute type specifies the address or addresses of a certificate's subject as an unstructured ASCII or T.61 string 💌. What the addresses mean is meant to be specified by the certificate's issuer, and no particular interpretation is required. A likely reading is as an alternative to the X.520 postalAddress attribute type 🏠. This attribute type is meant for PKCS #10 certification requests 🎀.

Unstructured-address attribute values have the ASN.1 type UnstructuredAddress:

UnstructuredAddress ::= CHOICE {
  PrintableString, T61String }

An unstructured-address attribute can have multiple attribute values 🍰.

Note: T.61's newline character (hexadecimal code 0d) is recommended as a line separator in multi-line addresses. 📝

It is expected that if UCS becomes an ASN.1 type (e.g., UNIVERSAL STRING), UnstructuredAddress will become a CHOICE type:

UnstructuredAddress ::= CHOICE {
    PrintableString, T61String, UNIVERSAL STRING }

5.3 Fulfilling a Certification Request 🎉

Certification authorities SHOULD use the sha-1WithRSAEncryption signature algorithm when signing certificates 🖋️.

5.4 Using PKCS #7 for Fulfilled Certificate Response 📦

[PKCS-7] supports a degenerate case of the SignedData content type where there are no signers on the content (so the content value is "irrelevant") 🫧. This degenerate case is used to carry certificate and CRL info. Certification authorities MUST use this format to return certificate info once a certification request is successfully fulfilled 💅. At a minimum, the fulfilled certificate response MUST include the actual subject certificate (the one matching the info in the certification request) 🎯. The response SHOULD include other certificates that link the issuer up to higher-level certification authorities, plus the matching certificate-revocation lists 🔗. Unrelated certificates and revocation info are also acceptable 🌈.

Receiving agents MUST parse this degenerate PKCS #7 message type and handle the certificates and CRLs according to the requirements and recommendations in Section 4 🧁.

6. Security Considerations 🛡️

All of the security issues faced by any cryptographic application must be faced by an S/MIME agent, bestie 😭. Among these are protecting the user's private key, preventing various attacks, and helping the user avoid mistakes like accidentally encrypting a message for the wrong recipient 🙈. The entire list of security considerations is beyond the scope of this document, but a few big concerns are listed here 👀.

When processing certificates, there are lots of situations where processing might fail. Because that processing may be done by a user agent, a security gateway, or some other program, there's no single way to handle these failures 🤷‍♀️. Just because the methods for handling failures aren't listed here, though, the reader should not assume they aren't important. The opposite is true: if a certificate is not provably valid and associated with the message, the processing software should take immediate and noticeable steps to inform the end user about it 🚨.

Some of the many places where signature and certificate checking might fail include the following. 💀

no Internet mail addresses in a certificate match the sender of a message
no certificate chain leads to a trusted CA
no ability to check the CRL for a certificate
an invalid CRL was received
the CRL being checked is expired
the certificate is expired
the certificate has been revoked

There are definitely other ways a certificate can be invalid, and it's the processing software's job to check them all thoroughly and decide what to do when a check fails 🫶. Don't skip the checks, periodt 😤.

A. Object Identifiers and Syntax 🧩

Sections A.1 through A.4 are adopted from [SMIME-MSG] 📚.

A.5 Name Attributes 🏷️

emailAddress OBJECT IDENTIFIER ::=
     {iso(1) member-body(2) US(840) rsadsi(113549) pkcs(1) pkcs-9(9) 1}

CountryName OBJECT IDENTIFIER ::=
     {joint-iso-ccitt(2) ds(5) attributeType(4) 6}

StateOrProvinceName OBJECT IDENTIFIER ::=
     {joint-iso-ccitt(2) ds(5) attributeType(4) 8}

locality OBJECT IDENTIFIER ::=
     {joint-iso-ccitt(2) ds(5) attributeType(4) 7}

CommonName OBJECT IDENTIFIER ::=
     {joint-iso-ccitt(2) ds(5) attributeType(4) 3}

Title OBJECT IDENTIFIER ::=
     {joint-iso-ccitt(2) ds(5) attributeType(4) 12}

Organization OBJECT IDENTIFIER ::=
     {joint-iso-ccitt(2) ds(5) attributeType(4) 10}

OrganizationalUnit OBJECT IDENTIFIER ::=
     {joint-iso-ccitt(2) ds(5) attributeType(4) 11}

StreetAddress OBJECT IDENTIFIER ::=
     {joint-iso-ccitt(2) ds(5) attributeType(4) 9}

Postal Code OBJECT IDENTIFIER ::=
     {joint-iso-ccitt(2) ds(5) attributeType(4) 17}

Phone Number OBJECT IDENTIFIER ::=
     {joint-iso-ccitt(2) ds(5) attributeType(4) 20}

A.6 Certification Request Attributes 📝

postalAddress OBJECT IDENTIFIER ::=
     {joint-iso-ccitt(2) ds(5) attributeType(4) 16}

challengePassword OBJECT IDENTIFIER ::=
     {iso(1) member-body(2) US(840) rsadsi(113549) pkcs(1) pkcs-9(9) 7}

unstructuredAddress OBJECT IDENTIFIER ::=
     {iso(1) member-body(2) US(840) rsadsi(113549) pkcs(1) pkcs-9(9) 8}

A.7 X.509 V3 Certificate Extensions 🧾

basicConstraints OBJECT IDENTIFIER ::=
     {joint-iso-ccitt(2) ds(5) 29 19 }

The ASN.1 definition of the basicConstraints certificate extension is:

basicConstraints basicConstraints EXTENSION ::= {
     SYNTAX  BasicConstraintsSyntax
     IDENTIFIED BY { id-ce 19 } }

BasicConstraintsSyntax ::= SEQUENCE {
     cA                 BOOLEAN DEFAULT FALSE,
     pathLenConstraint  INTEGER (0..MAX) OPTIONAL }

keyUsage OBJECT IDENTIFIER ::=
     {joint-iso-ccitt(2) ds(5) 29 15 }

The ASN.1 definition of the keyUsage certificate extension is:

keyUsage EXTENSION ::= {
     SYNTAX  KeyUsage
     IDENTIFIED BY { id-ce 15 }}

KeyUsage ::= BIT STRING {
     digitalSignature      (0),
     nonRepudiation        (1),
     keyEncipherment       (2),
     dataEncipherment      (3),
     keyAgreement          (4),
     keyCertSign           (5),
     cRLSign               (6)}

B. References ✨

Okay bestie, here's the reading list 📚💖

[KEYM] PKIX Part 1. PKIX is still a work in progress at the time of writing 🌸, but standards-track RFCs are expected to show up someday.

[MUSTSHOULD] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 1l4, RFC 2119, March 1997. 🔑

[PKCS-1] Kaliski, B., "PKCS #1: RSA Encryption Version 1.5", RFC 2313, March 1998. 🔐

[PKCS-7] Kaliski, B., "PKCS #7: Cryptographic Message Syntax Version 1.5", RFC 2315, March 1998. 💌

[PKCS-10] Kaliski, B., "PKCS #10: Certification Request Syntax Version 1.5", RFC 2314, March 1998. 📝

[RFC-822] Crocker, D., "Standard For The Format Of ARPA Internet Text Messages", STD 11, RFC 822, August 1982. ✉️

[SMIME-MSG] Dusse, S., Hoffman, P., Ramsdell, R., Lundblade, L., and L. Repka, "S/MIME Version 2 Message Specification", RFC 2311, March 1998. 🎀

[X.500] ITU-T Recommendation X.500 (1997) | ISO/IEC 9594-1:1997, Information technology - Open Systems Interconnection - The Directory: Overview of concepts, models and services 🗂️

[X.501] ITU-T Recommendation X.501 (1997) | ISO/IEC 9594-2:1997, Information technology - Open Systems Interconnection - The Directory: Models 🧩

[X.509] ITU-T Recommendation X.509 (1997) | ISO/IEC 9594-8:1997, Information technology - Open Systems Interconnection - The Directory: Authentication framework 🪪

[X.520] ITU-T Recommendation X.520 (1997) | ISO/IEC 9594-6:1997, Information technology - Open Systems Interconnection - The Directory: Selected attribute types. 🏷️

C. Compatibility with Prior Practice in S/MIME 🕰️

Okay so, S/MIME started out at RSA Data Security, Inc. 💼 Loads of developers were already building S/MIME agents before this document came out, so it's giving history 📜. All S/MIME receiving agents SHOULD make a real effort to play nicely with those earlier implementations 🫶.

D. Acknowledgements 💜

Huge thank-yous to the many people who helped shape this memo ✨, including David Solo, Anil Gangolli, Jeff Thompson, and Lisa Repka. They're literally iconic 👑.

E. Authors' Addresses 📮

Here's where to find the authors 💅:

Steve Dusse
RSA Data Security, Inc.
100 Marine Parkway, #500
Redwood City, CA  94065  USA

Phone: (415) 595-8782
EMail: spock@rsa.com


Paul Hoffman
Internet Mail Consortium
127 Segre Place
Santa Cruz, CA  95060

Phone: (408) 426-9827
EMail: phoffman@imc.org


Blake Ramsdell
Worldtalk
13122 NE 20th St., Suite C
Bellevue, WA 98005

Phone: (425) 882-8861
EMail: blaker@deming.com


Jeff Weinstein
Netscape Communications Corporation
501 East Middlefield Road
Mountain View, CA  94043

Phone: (415) 254-1900
EMail: jsw@netscape.com

F. Full Copyright Statement ⚖️

Okay, the legal bit, but make it cute 🎀. You're allowed to copy and share this document, and you can make derivative works that comment on it, explain it, or help people implement it 🦋. You can publish and distribute those in whole or in part, with no restrictions of any kind, as long as the copyright notice and this paragraph stay on every copy and derivative work 💌. BUT the document itself can't be modified in any way, like removing the copyright notice or the references to the Internet Society or other Internet organizations 🙅‍♀️. The exceptions are when you're developing Internet standards, in which case the copyright procedures in the Internet Standards process have to be followed, or when you need to translate it into a language other than English 🌍.

These permissions are perpetual and won't be revoked by the Internet Society or its successors or assigns 💖. Bestie, the document and the info in it are provided on an "AS IS" basis 🫠. THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 💀

That's the whole thing, we did it bestie! 🌈✨🎉

📦 where this page comes from

ietf: rfc2312 1998-03
💖 girlified by claude-haiku-5-5 on 2026-10-15: a language model's rewrite of the original, under its terms