Certificate Management Protocols

This document describes the Internet X.509 Public Key Infrastructure (PKI) Certificate Management Protocols. Protocol messages are defined for all relevant aspects of certificate creation and management. Note that "certificate" in this document refers to an X.509v3 Certificate as defined in [COR95, X509-AM]. The key words "MUST", "MUST NOT", "REQUIRED", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document (in uppercase, as shown) are to be interpreted as described in [RFC2119]. Adams & Farrell Expires January 2001 [Page 1] Introduction The layout of this document is as follows: Section 1 contains an overview of PKI management; Section 2 contains discussion of assumptions and restrictions; Section 3 contains data structures used for PKI management messages; Section 4 defines the functions that are to be carried out in PKI management by conforming implementations; Section 5 describes version negotiation and compatibility with RFC 2510; the Appendices specify profiles for conforming implementations and provide an ASN.1 module containing the syntax for all messages defined in this specification. Adams & Farrell Expires January 2001 [Page 2] 1 PKI Management Overview The PKI must be structured to be consistent with the types of individuals who must administer it. Providing such administrators with unbounded choices not only complicates the software required but also increases the chances that a subtle mistake by an administrator or software developer will result in broader compromise. Similarly, restricting administrators with cumbersome mechanisms will cause them not to use the PKI. Management protocols are REQUIRED to support on-line interactions between Public Key Infrastructure (PKI) components. For example, a management protocol might be used between a Certification Authority (CA) and a client system with which a key pair is associated, or between two CAs that issue cross-certificates for each other. 1.1 PKI Management Model Before specifying particular message formats and procedures we first define the entities involved in PKI management and their interactions (in terms of the PKI management functions required). We then group these functions in order to accommodate different identifiable types