Setting Issuer Alternative Name

[Robert Moskowitz]

On 5/14/23 14:00, Viktor Dukhovni wrote:
> On Sun, May 14, 2023 at 12:44:48PM -0400, Robert Moskowitz wrote:
>
>> I looked at that manpage and tried:
>>
>> authorityKeyIdentifier =
>> otherName:1.3.27.16.2.1.1;BITSTR:20010030000000052aeb9adc1ce8b1ec
> https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.1
>
>         AuthorityKeyIdentifier ::= SEQUENCE {
>            keyIdentifier             [0] KeyIdentifier           OPTIONAL,
>            authorityCertIssuer       [1] GeneralNames            OPTIONAL,
>            authorityCertSerialNumber [2] CertificateSerialNumber OPTIONAL  }
>
> You're trying to set the AKID to just the GeneralName, but it has to be
> a tagged sequence,

I did spend some time digging to get what a "tagged sequence" is let 
alone represent  it but can't find it in 5280

>   and note that "authorityCertIssuer" is the name of
> the "grandparent" of the certificate in which the AKID appears, along
> with the authorityCertIssuer you'd need to provide the serial number
> of the parent certificate.

The two together seems only mandated in sec A.2.

I am not finding any discussion on authorityCertIssuer being that of the 
"grandparent", can you point me to that?

> But as I mentioned before, I don't expect that support for names other
> than directory names in the AKID extension is particularly common.

Well I could put:

e.d.c.a.b.0.b.e.0.6.8.2.e.0.b.9.5.0.8.f.f.3.e.f.f.3.0.0.1.0.0.2.ip6.arpa.

? It will exist (we are for now doing this under driptesting.org as it 
will be a bit of process to get 3.0.0.1.0.0.2.ip6.arpa. delegated).

But that is 73 bytes to show a 16 byte value.

> You're better off with just "keyIdentifier", liking the child cert
> to the key if of the parent cert.

I assume you mean:

authorityKeyIdentifier = keyid

and I can't see how to set keyid to 20010030000000052aeb9adc1ce8b1ec

I can control subjectKeyIdentifier like:

subjectKeyIdentifier = 20010030000000052aeb9adc1ce8b1ec

             X509v3 Subject Key Identifier:
                 20:01:00:30:00:00:00:05:2A:EB:9A:DC:1C:E8:B1:EC

Which is defined as:

SubjectKeyIdentifier ::= KeyIdentifier


I tried

authorityKeyIdentifier = keyid=20010030000000052aeb9adc1ce8b1ec

And get an error

authorityKeyIdentifier = keyid:20010030000000052aeb9adc1ce8b1ec

Just uses the keyid as is:

             X509v3 Authority Key Identifier:
0F:4E:5E:54:C2:4F:80:9E:E5:79:CD:B4:14:9B:BF:EB:A8:57:CB:CA



>
> Perhaps I should not have mentioned issuer SANs, you probably have no
> use for them.  Do use the appropriate data type in the EE SAN.
>