Skip to content

Commit 8a497e9

Browse files
peppelinuxpeppelinux
committed
fix: x509 chain example and added x509 chain gen util
1 parent 8cf0684 commit 8a497e9

File tree

2 files changed

+389
-106
lines changed

2 files changed

+389
-106
lines changed

‎docs/en/trust.rst

Lines changed: 175 additions & 106 deletions
Original file line numberDiff line numberDiff line change
@@ -802,120 +802,189 @@ When a participant self-issues an X.509 Certificate, it adheres to the following
802802
- ``DNS=example.net``
803803
- ``DNS=*.example.org``
804804

805-
Below a non-normative example of an X.509 Certificate Chain without intermediaries and in plain text, to facilitate the reading.
805+
Below a non-normative example in plain text (OpenSSL format) of an X.509 Certificate Chain with an intermediary, starting from the leaf certificate.
806806

807807

808808
.. code-block:: text
809809
810810
Certificate:
811-
Data:
812-
Version: 3 (0x2)
813-
Serial Number: 1 (0x1)
814-
Signature Algorithm: sha256WithRSAEncryption
815-
Issuer: CN=trust-anchor.example.com, O=Example Trust Anchor, C=IT
816-
Validity
817-
Not Before: Sep 1 00:00:00 2023 GMT
818-
Not After : Sep 1 00:00:00 2033 GMT
819-
Subject: CN=trust-anchor.example.com, O=Example Trust Anchor, C=IT
820-
Subject Public Key Info:
821-
Public Key Algorithm: rsaEncryption
822-
Public-Key: (4096 bit)
823-
Modulus:
824-
00:af:82:3b:...
825-
Exponent: 65537 (0x10001)
826-
X509v3 extensions:
827-
X509v3 Basic Constraints:
828-
CA:TRUE
829-
X509v3 Key Usage:
830-
Certificate Sign, CRL Sign
831-
X509v3 Subject Key Identifier:
832-
12:34:56:78:90:ab:cd:ef:12:34:56:78:90:ab:cd:ef
833-
X509v3 Authority Key Identifier:
834-
keyid:12:34:56:78:90:ab:cd:ef:12:34:56:78:90:ab:cd:ef
835-
X509v3 CRL Distribution Points:
836-
Full Name:
837-
URI:https://trust-anchors.example.com/crl/ca.crl
838-
839-
Signature Algorithm: sha256WithRSAEncryption
840-
5c:4f:3b:...
841-
842-
811+
Data:
812+
Version: 3 (0x2)
813+
Serial Number: 608272730246993755169238192525892220352984983786 (0x6a8be47f69567ad86d9f286a009f8ba9e71f28ea)
814+
Signature Algorithm: sha256
815+
Issuer: commonName=https://intermediate.example.net, organizationName=Example INT, countryName=IT
816+
Validity
817+
Not Before: May 26 15:30:02 2025 GMT
818+
Not After : May 27 15:30:02 2026 GMT
819+
Subject: commonName=CN=leaf.example.com, O=Example Leaf, C=IT, organizationName=Example Leaf, countryName=IT
820+
Subject Public Key Info:
821+
Public Key Algorithm: (unknown)
822+
X509v3 extensions:
823+
X509v3 Basic Constraints:
824+
CA:TRUE, pathlen:0
825+
X509v3 Subject Alternative Name:
826+
DNS:leaf.example.org
827+
URI:leaf.example.org
828+
X509v3 Key Usage:
829+
Digital Signature, Key Encipherment, Certificate Sign, CRL Sign
830+
X509v3 CRL Distribution Points:
831+
Full Name:
832+
URI:https://leaf.example.com/crl/leaf.example.com.crl
833+
X509v3 Name Constraints:
834+
Permitted:
835+
URI.1=https://leaf.example.com
836+
DNS.2=leaf.example.com
837+
Excluded:
838+
DNS.1=localhost
839+
DNS.2=localhost.localdomain
840+
DNS.3=127.0.0.1
841+
DNS.4=example.com
842+
DNS.5=example.org
843+
DNS.6=example.net
844+
845+
Signature Algorithm: sha256
846+
30:46:02:21:00:e8:99:36:e9:4d:3c:35:57:61:37:87
847+
9a:45:bb:e6:68:13:b7:99:94:9c:82:91:69:33:a5:1e
848+
10:8a:58:03:e0:02:21:00:8d:7b:51:28:b5:85:5d:15
849+
78:76:18:e0:22:bb:f1:dc:2e:16:e4:f0:c2:17:ee:58
850+
94:9c:2e:a5:51:e7:5c:6b
851+
852+
-----BEGIN CERTIFICATE-----
853+
MIIC6zCCApCgAwIBAgIUaovkf2lWethtnyhqAJ+LqecfKOowCgYIKoZIzj0EAwIw
854+
TjEpMCcGA1UEAwwgaHR0cHM6Ly9pbnRlcm1lZGlhdGUuZXhhbXBsZS5uZXQxFDAS
855+
BgNVBAoMC0V4YW1wbGUgSU5UMQswCQYDVQQGEwJJVDAeFw0yNTA1MjYxNTMwMDJa
856+
Fw0yNjA1MjcxNTMwMDJaMFgxMjAwBgNVBAMMKUNOPWxlYWYuZXhhbXBsZS5jb20s
857+
IE89RXhhbXBsZSBMZWFmLCBDPUlUMRUwEwYDVQQKDAxFeGFtcGxlIExlYWYxCzAJ
858+
BgNVBAYTAklUMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE9FVR+VHqHu8EGgm5
859+
RFiQDyLMB9UIZ24Wt7gmJDzMwu3vKMlbkTLNk3nRd/jQpv77wW9Djp5fkVmzAkMD
860+
KJuppqOCAUAwggE8MBIGA1UdEwEB/wQIMAYBAf8CAQAwLQYDVR0RBCYwJIIQbGVh
861+
Zi5leGFtcGxlLm9yZ4YQbGVhZi5leGFtcGxlLm9yZzAOBgNVHQ8BAf8EBAMCAaYw
862+
QgYDVR0fBDswOTA3oDWgM4YxaHR0cHM6Ly9sZWFmLmV4YW1wbGUuY29tL2NybC9s
863+
ZWFmLmV4YW1wbGUuY29tLmNybDCBogYDVR0eAQH/BIGXMIGUoDAwGoYYaHR0cHM6
864+
Ly9sZWFmLmV4YW1wbGUuY29tMBKCEGxlYWYuZXhhbXBsZS5jb22hYDALgglsb2Nh
865+
bGhvc3QwF4IVbG9jYWxob3N0LmxvY2FsZG9tYWluMAuCCTEyNy4wLjAuMTANggtl
866+
eGFtcGxlLmNvbTANggtleGFtcGxlLm9yZzANggtleGFtcGxlLm5ldDAKBggqhkjO
867+
PQQDAgNJADBGAiEA6Jk26U08NVdhN4eaRbvmaBO3mZScgpFpM6UeEIpYA+ACIQCN
868+
e1EotYVdFXh2GOAiu/HcLhbk8MIX7liUnC6lUedcaw==
869+
-----END CERTIFICATE-----
870+
843871
Certificate:
844-
Data:
845-
Version: 3 (0x2)
846-
Serial Number: 1234567890 (0x499602d2)
847-
Signature Algorithm: sha256WithRSAEncryption
848-
Issuer: CN=trust-anchor.example.com, O=Example Trust Anchor, C=IT
849-
Validity
850-
Not Before: Sep 1 00:00:00 2023 GMT
851-
Not After : Sep 1 00:00:00 2024 GMT
852-
Subject: CN=leaf.example.org, O=Leaf, C=IT
853-
Subject Public Key Info:
854-
Public Key Algorithm: rsaEncryption
855-
Public-Key: (2048 bit)
856-
Modulus:
857-
00:af:82:3b:...
858-
Exponent: 65537 (0x10001)
859-
X509v3 extensions:
860-
X509v3 Basic Constraints:
861-
CA:TRUE, pathlen:1
862-
X509v3 Key Usage:
863-
Digital Signature, Key Encipherment
864-
X509v3 Subject Alternative Name:
865-
URI:https://leaf.example.com
866-
X509v3 Name Constraints:
867-
Permitted:
868-
URI.1=https://leaf.example.com
869-
DNS.1=leaf.example.com
870-
Excluded:
871-
DNS=localhost
872-
DNS=localhost.localdomain
873-
DNS=127.0.0.1
874-
DNS=example.com
875-
DNS=example.org
876-
DNS=example.net
877-
DNS=*.example.org
878-
X509v3 CRL Distribution Points:
879-
Full Name:
880-
URI:https://trust-ancor.example.com/crl/leaf.example.org.crl
881-
882-
Signature Algorithm: sha256WithRSAEncryption
883-
5c:4f:3b:...
884-
885-
872+
Data:
873+
Version: 3 (0x2)
874+
Serial Number: 166609465481942199701516106011740225358723958170 (0x1d2f06ddab3a673943e507ae5988e1e4a406459a)
875+
Signature Algorithm: sha256
876+
Issuer: commonName=CN=ca.example.com, O=Example CA, C=IT, organizationName=Example CA, countryName=IT
877+
Validity
878+
Not Before: May 26 15:30:02 2025 GMT
879+
Not After : May 27 15:30:02 2026 GMT
880+
Subject: commonName=https://intermediate.example.net, organizationName=Example INT, countryName=IT
881+
Subject Public Key Info:
882+
Public Key Algorithm: (unknown)
883+
X509v3 extensions:
884+
X509v3 Basic Constraints:
885+
CA:TRUE, pathlen:1
886+
X509v3 Key Usage:
887+
Digital Signature, Key Encipherment, Certificate Sign, CRL Sign
888+
X509v3 CRL Distribution Points:
889+
Full Name:
890+
URI:https://intermediate.example.net/crl/intermediate.example.net.crl
891+
X509v3 Name Constraints:
892+
Permitted:
893+
URI.1=https://intermediate.example.net
894+
DNS.2=intermediate.example.net
895+
Excluded:
896+
DNS.1=localhost
897+
DNS.2=localhost.localdomain
898+
DNS.3=127.0.0.1
899+
DNS.4=example.com
900+
DNS.5=example.org
901+
DNS.6=example.net
902+
903+
Signature Algorithm: sha256
904+
30:45:02:21:00:bf:68:99:e4:79:12:6d:76:91:f2:c3
905+
d3:b6:ca:71:5a:4b:2a:4e:18:0a:dd:ea:45:b0:ea:49
906+
62:5b:d4:c8:4a:02:20:23:44:86:7b:23:4f:b6:be:b4
907+
7f:cd:95:83:77:92:db:f5:a1:56:82:08:1a:7d:d0:02
908+
67:b6:af:74:91:ef:1f
909+
910+
-----BEGIN CERTIFICATE-----
911+
MIIC1TCCAnugAwIBAgIUHS8G3as6ZzlD5QeuWYjh5KQGRZowCgYIKoZIzj0EAwIw
912+
UjEuMCwGA1UEAwwlQ049Y2EuZXhhbXBsZS5jb20sIE89RXhhbXBsZSBDQSwgQz1J
913+
VDETMBEGA1UECgwKRXhhbXBsZSBDQTELMAkGA1UEBhMCSVQwHhcNMjUwNTI2MTUz
914+
MDAyWhcNMjYwNTI3MTUzMDAyWjBOMSkwJwYDVQQDDCBodHRwczovL2ludGVybWVk
915+
aWF0ZS5leGFtcGxlLm5ldDEUMBIGA1UECgwLRXhhbXBsZSBJTlQxCzAJBgNVBAYT
916+
AklUMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEwEU7hPwB7P6WE2VuBAi0zwhn
917+
fRmKvysWr4IILTqA7A4HHqoSGK1JEluOoDCpKL3MdM16X75tGI9kwYIJgjcw5KOC
918+
ATEwggEtMBIGA1UdEwEB/wQIMAYBAf8CAQEwDgYDVR0PAQH/BAQDAgGmMFIGA1Ud
919+
HwRLMEkwR6BFoEOGQWh0dHBzOi8vaW50ZXJtZWRpYXRlLmV4YW1wbGUubmV0L2Ny
920+
bC9pbnRlcm1lZGlhdGUuZXhhbXBsZS5uZXQuY3JsMIGyBgNVHR4BAf8EgacwgaSg
921+
QDAihiBodHRwczovL2ludGVybWVkaWF0ZS5leGFtcGxlLm5ldDAaghhpbnRlcm1l
922+
ZGlhdGUuZXhhbXBsZS5uZXShYDALgglsb2NhbGhvc3QwF4IVbG9jYWxob3N0Lmxv
923+
Y2FsZG9tYWluMAuCCTEyNy4wLjAuMTANggtleGFtcGxlLmNvbTANggtleGFtcGxl
924+
Lm9yZzANggtleGFtcGxlLm5ldDAKBggqhkjOPQQDAgNIADBFAiEAv2iZ5HkSbXaR
925+
8sPTtspxWksqThgK3epFsOpJYlvUyEoCICNEhnsjT7a+tH/NlYN3ktv1oVaCCBp9
926+
0AJntq90ke8f
927+
-----END CERTIFICATE-----
928+
886929
Certificate:
887-
Data:
888-
Version: 3 (0x2)
889-
Serial Number: 987654321 (0x3ade68b1)
890-
Signature Algorithm: sha256WithRSAEncryption
891-
Issuer: CN=https://leaf.example.org, O=Leaf, C=IT
892-
Validity
893-
Not Before: Sep 1 00:00:00 2023 GMT
894-
Not After : Sep 1 00:00:00 2024 GMT
895-
Subject: CN=https://leaf.example.org, O=Leaf, C=IT
896-
Subject Public Key Info:
897-
Public Key Algorithm: rsaEncryption
898-
Public-Key: (2048 bit)
899-
Modulus:
900-
00:af:82:3b:...
901-
Exponent: 65537 (0x10001)
902-
X509v3 extensions:
903-
X509v3 Basic Constraints:
904-
CA:FALSE
905-
X509v3 Key Usage:
906-
Digital Signature, Key Encipherment
907-
X509v3 Subject Alternative Name:
908-
URI:https://leaf.example.org
909-
X509v3 Name Constraints:
910-
Permitted:
911-
URI.1=https://leaf.example.com
912-
DNS.1=leaf.example.com
913-
X509v3 CRL Distribution Points:
914-
Full Name:
915-
URI:https://leaf.example.org/crl/self.crl
930+
Data:
931+
Version: 3 (0x2)
932+
Serial Number: 342257486529888684799109295840076139464867004184 (0x3bf35b42db365d2741af24d73f5fbfda0c493f18)
933+
Signature Algorithm: sha256
934+
Issuer: commonName=CN=ca.example.com, O=Example CA, C=IT, organizationName=Example CA, countryName=IT
935+
Validity
936+
Not Before: May 26 15:30:02 2025 GMT
937+
Not After : May 27 15:30:02 2026 GMT
938+
Subject: commonName=CN=ca.example.com, O=Example CA, C=IT, organizationName=Example CA, countryName=IT
939+
Subject Public Key Info:
940+
Public Key Algorithm: (unknown)
941+
X509v3 extensions:
942+
X509v3 Basic Constraints:
943+
CA:TRUE, pathlen:2
944+
X509v3 Subject Alternative Name:
945+
DNS:ca.example.com
946+
X509v3 Key Usage:
947+
Digital Signature, Key Encipherment, Certificate Sign, CRL Sign
948+
X509v3 CRL Distribution Points:
949+
Full Name:
950+
URI:https://ca.example.com/crl/ca.example.com.crl
951+
X509v3 Name Constraints:
952+
Permitted:
953+
URI.1=https://ca.example.com
954+
DNS.2=ca.example.com
955+
Excluded:
956+
DNS.1=localhost
957+
DNS.2=localhost.localdomain
958+
DNS.3=127.0.0.1
959+
DNS.4=example.com
960+
DNS.5=example.org
961+
DNS.6=example.net
962+
963+
Signature Algorithm: sha256
964+
30:44:02:20:13:09:99:fa:30:ea:5a:97:9f:89:ff:dc
965+
4d:5d:a0:15:70:3d:5f:6c:77:14:b9:a5:2a:18:34:cf
966+
31:35:96:da:02:20:62:8e:85:1c:d6:a0:04:e5:44:f2
967+
27:56:a7:d2:ca:3a:2e:dd:53:d3:39:1e:d7:22:45:ea
968+
b0:ba:cd:9d:a1:18
969+
970+
-----BEGIN CERTIFICATE-----
971+
MIICyzCCAnKgAwIBAgIUO/NbQts2XSdBryTXP1+/2gxJPxgwCgYIKoZIzj0EAwIw
972+
UjEuMCwGA1UEAwwlQ049Y2EuZXhhbXBsZS5jb20sIE89RXhhbXBsZSBDQSwgQz1J
973+
VDETMBEGA1UECgwKRXhhbXBsZSBDQTELMAkGA1UEBhMCSVQwHhcNMjUwNTI2MTUz
974+
MDAyWhcNMjYwNTI3MTUzMDAyWjBSMS4wLAYDVQQDDCVDTj1jYS5leGFtcGxlLmNv
975+
bSwgTz1FeGFtcGxlIENBLCBDPUlUMRMwEQYDVQQKDApFeGFtcGxlIENBMQswCQYD
976+
VQQGEwJJVDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABAZR6TY0PDNDSug886Bg
977+
WuB5dj7EA1+ovLUA/lc5pvN2xKtoY0+7XkH6FFtZMoBXdsxFf6RM89XDM9mufLNF
978+
bCijggEkMIIBIDASBgNVHRMBAf8ECDAGAQH/AgECMBkGA1UdEQQSMBCCDmNhLmV4
979+
YW1wbGUuY29tMA4GA1UdDwEB/wQEAwIBpjA+BgNVHR8ENzA1MDOgMaAvhi1odHRw
980+
czovL2NhLmV4YW1wbGUuY29tL2NybC9jYS5leGFtcGxlLmNvbS5jcmwwgZ4GA1Ud
981+
HgEB/wSBkzCBkKAsMBiGFmh0dHBzOi8vY2EuZXhhbXBsZS5jb20wEIIOY2EuZXhh
982+
bXBsZS5jb22hYDALgglsb2NhbGhvc3QwF4IVbG9jYWxob3N0LmxvY2FsZG9tYWlu
983+
MAuCCTEyNy4wLjAuMTANggtleGFtcGxlLmNvbTANggtleGFtcGxlLm9yZzANggtl
984+
eGFtcGxlLm5ldDAKBggqhkjOPQQDAgNHADBEAiATCZn6MOpal5+J/9xNXaAVcD1f
985+
bHcUuaUqGDTPMTWW2gIgYo6FHNagBOVE8idWp9LKOi7dU9M5HtciReqwus2doRg=
986+
-----END CERTIFICATE-----
916987
917-
Signature Algorithm: sha256WithRSAEncryption
918-
7d:6e:5f:...
919988
920989
921990
Federation participants can ensure that their certificates are consistent, enabling interoperability and security across the federation. This approach, enabling X.509 certificate issuance delegation, introduces innovative practices for certificate management using the underlying Trust Relationships established within the OpenID Federation.

0 commit comments

Comments
 (0)