Subject: [Q] AuthorityKeyIdentifier Question

From: [email-masked] (Dmitry Dolinsky)
Date: Fri, 12 Feb 1999 11:51:37 -0800

Hi all,

I have a question about matching authorityCertIssuer in
AuthorityKeyIdentifier extension with authority certificate.

I understand authorityCertIssuer has to match issuer (and/or?)
issuerAltName of the issuer certificate. Since authorityCertIssuer is
GeneralNames and issuer is a Name (distinguished name), in what manner one
should be matched against the other?

Alternatively, if authorityCertIssuer is supposed to be matched only with
issuerAltName, which is GeneralNames, doesn't it mean that presence of
authorityCertIssuer in the subject's certificate requires the presence of
issuerAltName in the issuer's certificate and the presence of
subjectAltName in the issuer issuer's certificate.

The clarification will be really appreciated.

--Dmitry