Re: AuthorityKeyIdentifier and SubjectKeyIdentifier in DRIP X.509 certs

Robert Moskowitz <[email protected]> writes:

>I SHOULD be able to use the DETS in keyIdentifier as I do with
>SubjectKeyIdentifier, but openSSL is resisting my efforts.  So far.

The aKID is copied from the issuing cert so I would imagine you can't just set
it arbitrarily.  OTOH since the aKID is copied from the issuing cert the
obvious way to get it into the subject cert would be to set it as the sKID in
the issuing cert.

>I was wondering if there is something I could do with authorityCertIssuer?

Probably not for the same reason you can't set the aKID in the subject cert
yourself.

You then also run into the problem that the sKID/aKID is the universal
identifier there and it's not clear what, if any, support there is for
handling authorityCertIssuers.

Peter.