RFC 2587

Internet X.509 Public Key Infrastructure LDAPv2 Schema

📅 published June 1999, from ietf

RFC 2587 ✨ Internet X.509 Public Key Infrastructure LDAPv2 Schema 🎀

okay bestie, so this one is by S. Boeyen (Entrust), T. Howes (Netscape), and P. Richard (Xcert) 💖 It's a Standards Track doc from June 1999. The title block doesn't list anything it obsoletes or updates, so there's no drama there 🫶

Status of This Memo 🌸

okay so this doc is an Internet standards track protocol spec for the Internet community, and it's literally asking for discussion and suggestions for improvements 🧚 For the current standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited, so share it with everyone 💅

Copyright Notice 🦋

1. Abstract ✨

okay so the schema in this doc is super minimal, just enough to support PKIX in an LDAPv2 environment like the one in RFC 2559 🌈 Only the PKIX-specific parts are specified here. LDAP servers acting as PKIX repositories should support the auxiliary object classes defined in this spec, and they should integrate this schema with the generic and other app-specific schemas as needed, depending on what services that server is providing 🍓

The key words 'MUST', 'SHALL', 'REQUIRED', 'SHOULD', 'RECOMMENDED', and 'MAY' in this doc are interpreted as described in RFC 2119. That's the main rulebook for how to read these words 👑

2. Introduction 🧚

This spec is part of a multi-part standard for building a Public Key Infrastructure (PKI) for the Internet 🫶 LDAPv2 is one mechanism for accessing a PKI repository. Other mechanisms, like http, are defined too 🌸

If an LDAP server accessed through LDAPv2 is being used as a repository, the minimum requirement is that the repository supports adding X.509 certificates to directory entries 🎀 Certificate Revocation List (CRL) is one way to publish revocation info in a repository. Other mechanisms, like http, are also defined 💅

This spec defines the attributes and object classes that LDAP servers acting as PKIX repositories should use, and that LDAP clients talking to those repositories should understand. That's how they query, add, modify, and delete PKI info ✨ Some object classes and attributes from X.509 are copied here for completeness. The thing is, for end entities and Certification Authorities (CA), the earlier X.509 object classes required attributes that are actually optional for PKIX 😭 And because of that mandatory attribute spec, the object class attribute would need to be dynamically changed whenever those attributes weren't always there in an entry 💀 So for these reasons, this doc defines alternative object classes for LDAP servers acting as PKIX repositories 🔥

3. PKIX Repository Objects 👑

The main PKIX objects that get represented in a repository are:

End Entities 🦋
Certification Authorities (CA) 🌈

These objects are defined in RFC 2459 🧚

3.1. End Entities 💖

Okay so for PKIX schema purposes, the big deal is that end entities are the subjects of certificates 🫶 End entities can be human users or other kinds of entities that certificates can be issued to. Sometimes the entry for the end entity already exists, and the PKI-specific info just gets added to it. Other times the entry might not exist before a certificate is issued, so the entity adding the certificate may also need to create the entry 🎀 The schema bits for the non-PKIX parts of an entry, like the structural object class used for organizational persons, can change depending on the environment and the apps being served. Those are outside the scope of this spec 🌸

The following auxiliary object class MAY be used to represent certificate subjects ✨

pkiUser   OBJECT-CLASS   ::= {
   SUBCLASS OF   { top}
   KIND          auxiliary
   MAY CONTAIN   {userCertificate}
   ID    joint-iso-ccitt(2) ds(5) objectClass(6) pkiUser(21)}

userCertificate    ATTRIBUTE  ::=  {
     WITH SYNTAX   Certificate
     EQUALITY MATCHING RULE   certificateExactMatch
     ID  joint-iso-ccitt(2) ds(5) attributeType(4) userCertificate(36) }

An end entity can get one or more certificates from one or more Certification Authorities 🍓 The userCertificate attribute MUST be used to represent these certificates in the directory entry for that user 💅

3.2. Certification Authorities 🌈

Just like end entities, Certification Authorities are usually represented in directories as auxiliary parts of entries for a more generic object, like organizations or organizational units 🧚 The non-PKIX schema elements for these entries, like the object's structural object class, are outside the scope of this spec 🫶

The following auxiliary object class MAY be used to represent Certification Authorities 👑

pkiCA   OBJECT-CLASS   ::= {
   SUBCLASS OF   { top}
   KIND          auxiliary
   MAY CONTAIN   {cACertificate |
                  certificateRevocationList |
                  authorityRevocationList |
                  crossCertificatePair }
   ID    joint-iso-ccitt(2) ds(5) objectClass(6) pkiCA(22)}

cACertificate    ATTRIBUTE  ::=  {
     WITH SYNTAX   Certificate
     EQUALITY MATCHING RULE   certificateExactMatch
     ID  joint-iso-ccitt(2) ds(5) attributeType(4) cACertificate(37) }

crossCertificatePairATTRIBUTE::={
   WITH SYNTAX   CertificatePair
   EQUALITY MATCHING RULE certificatePairExactMatch
 ID joint-iso-ccitt(2) ds(5) attributeType(4) crossCertificatePair(40)}

The cACertificate attribute of a CA's directory entry shall be used to store self-issued certificates (if there are any) and certificates issued to this CA by CAs in the same realm as this CA 🦋

The forward elements of the crossCertificatePair attribute in a CA's directory entry shall be used to store all certificates issued to this CA except the self-issued ones 💖 Optionally, the reverse elements of that crossCertificatePair attribute in a CA's directory entry may contain a subset of certificates this CA issued to other CAs 🫶 When both the forward and reverse elements are in a single attribute value, the issuer name in one certificate shall match the subject name in the other one, and vice versa. Also, the subject public key in one certificate shall be able to verify the digital signature on the other certificate, and vice versa 🔥

When a reverse element is there, the forward element value and the reverse element value need not be stored in the same attribute value 🌸 In other words, they can be stored in either one attribute value or two attribute values ✨

For V3 certificates, none of the CA certificates above shall include a basicConstraints extension with the cA value set to FALSE 🚫 Like, don't do that 💀

The definition of realm is purely a matter of local policy 🎀

      certificateRevocationListATTRIBUTE::={
           WITH SYNTAX  CertificateList
           EQUALITY MATCHING RULE certificateListExactMatch
        ID joint-iso-ccitt(2) ds(5) attributeType(4)
           certificateRevocationList(39)}

The certificateRevocationList attribute, if it's present in a particular CA's entry, contains CRL(s) as defined in RFC 2459 🧚

      authorityRevocationListATTRIBUTE::={
         WITH SYNTAX   CertificateList
         EQUALITY MATCHING RULE certificateListExactMatch
       ID joint-iso-ccitt(2) ds(5) attributeType(4)
          authorityRevocationList(38)}

The authorityRevocationList attribute, if it's present in a particular CA's entry, includes revocation info about certificates issued to other CAs 🌈

3.2.1. CRL distribution points 🍓

CRL distribution points are an optional mechanism, specified in RFC 2459, that MAY be used to distribute revocation info 💅

There's a patent statement about CRL distribution points at the end of this document 👑

If a CA decides to use CRL distribution points, this object class is used to represent them ✨

 cRLDistributionPoint   OBJECT-CLASS::= {
    SUBCLASS OF     { top }
    KIND            structural
    MUST CONTAIN    { commonName }
    MAY CONTAIN     { certificateRevocationList |
                      authorityRevocationList |
                      deltaRevocationList }
    ID joint-iso-ccitt(2) ds(5) objectClass(6) cRLDistributionPoint(19) }

The certificateRevocationList and authorityRevocationList attributes are the same as defined above 🦋 The commonName attribute and the deltaRevocationList attribute, both defined in X.509, are copied below 🌸

      commonName   ATTRIBUTE::={
         SUBTYPE OF     name
         WITH SYNTAX   DirectoryString
         ID joint-iso-ccitt(2) ds(5) attributeType(4) commonName(3) }

      deltaRevocationList        ATTRIBUTE ::= {
         WITH SYNTAX             CertificateList
         EQUALITY MATCHING RULE  certificateListExactMatch
         ID joint-iso-ccitt(2) ds(5) attributeType(4)
            deltaRevocationList(53) }

3.2.2. Delta CRLs 🔥

Delta CRLs are an optional mechanism, specified in RFC 2459, that MAY be used to enhance how revocation info gets distributed 🧚

If a CA decides to use delta CRLs, this object class is used to represent them 💖

      deltaCRL   OBJECT-CLASS::= {
         SUBCLASS OF     { top }
         KIND            auxiliary
         MAY CONTAIN     { deltaRevocationList }
         ID joint-iso-ccitt(2) ds(5) objectClass(6) deltaCRL(23) }

🌈 to be continued in part 2 🧚 💅

7. Authors' Addresses 💖

Okay bestie, here are the three people who wrote this RFC, with their addresses and emails so you can reach out 💌

Sharon Boeyen
Entrust Technologies Limited
750 Heron Road
Ottawa, Ontario
Canada K1V 1A7

EMail: sharon.boeyen@entrust.com

Tim Howes
Netscape Communications Corp.
501 E. Middlefield Rd.
Mountain View, CA 94043
USA

EMail: howes@netscape.com

Patrick Richard
Xcert Software Inc.
Suite 1001, 701 W. Georgia Street
P.O. Box 10145
Pacific Centre
Vancouver, B.C.
Canada V7Y 1C6

EMail: patr@xcert.com

Full Copyright Statement 🎀

This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.

The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.

This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement 🧚

Funding for the RFC Editor function is currently provided by the Internet Society. ✨

📦 where this page comes from

ietf: rfc2587 1999-06
💖 girlified by claude-haiku-5-5 on 2026-10-16: a language model's rewrite of the original, under its terms