Subject: What is mean by recognizing critical extensions ?

From: "Wahaj" <[email-masked]>
Date: Fri, 4 Jul 2003 20:04:13 +0500

Hi All,

I need to know if a Certificate has got an extension marked as critical, should the application process it ( By process I mean perform some action & not merely recognizing it). So if an application receives a user certificate having SubjectAltName marked as critical and that application don't use or process SubjectAltName then should the application discard or reject the user certificate based on the fact it won't process it and only recognize it OR should it carry on with it because it can recognize this extension.

As far as CRL extensions are concerned, it is clearly stated that if they are marked as Critical they should be processed, if not the CRL is not valid and is rejected. 

In RFC 3280 in certificate extension section it is stated " A certificate using system MUST reject the certificate if it encounters a critical extension it does not recognize". Now what recognize mean ? is it to use it (in other words process it) or merely read it and not processing. I came across three different terms used. Ability to Recognize, Process or Support. What is exactly meant by them. Are they same or different ?

Also it is stated in RFC 3280 that Basic Constaint MUST be set set as critical. So should an application reject such CA certificate if Basic Constraint is present but is not set as critical. Same for other extensions ?

Best Regards,
Wahaj

---

From: "David A. Cooper" <[email-masked]>
Date: Mon, 07 Jul 2003 15:02:59 -0400

Wahaj wrote:

> Hi All,
>  
> I need to know if a Certificate has got an extension marked as 
> critical, should the application process it ( By process I mean 
> perform some action & not merely recognizing it). So if an application 
> receives a user certificate having SubjectAltName marked as critical 
> and that application don't use or process SubjectAltName then should 
> the application discard or reject the user certificate based on the 
> fact it won't process it and only recognize it OR should it carry on 
> with it because it can recognize this extension.

If an extension is marked critical, the application must process the 
extension or reject the certificate.  For the SubjectAltName extension, 
X.509 states: "If the [SubjectAltName] extension is flagged critical, at 
least one of the name forms that is present shall be recognized and 
processed, otherwise the certificate shall be considered invalid."

> As far as CRL extensions are concerned, it is clearly stated that if 
> they are marked as Critical they should be processed, if not the CRL 
> is not valid and is rejected.
>  
> In RFC 3280 in certificate extension section it is stated " A 
> certificate using system MUST reject the certificate if it encounters 
> a critical extension it does not recognize". Now what recognize mean ? 
> is it to use it (in other words process it) or merely read it and 
> not processing. I came across three different terms used. Ability to 
> Recognize, Process or Support. What is exactly meant by them. Are they 
> same or different ?
>  
> Also it is stated in RFC 3280 that Basic Constaint MUST be set set as 
> critical. So should an application reject such CA certificate if Basic 
> Constraint is present but is not set as critical. Same for other 
> extensions ?

No.  This statement is indicating that CAs conforming to RFC 3280 must 
set the BasicConstraints extension to critical.  There is no requirement 
for clients to only accept certificates issued by RFC 3280 compliant CAs.