交互認證之下屬憑證機構（Cross-Certified Subordinate CA）之擴充欄位

Cross-Certified Subordinate CA Extensions

Extension	Presence	Critical	Description
authorityKeyIdentifier	MUST	N	See Section 7.1.2.11.1
basicConstraints	MUST	Y	See Section 7.1.2.10.4
certificatePolicies	MUST	N	See Section 7.1.2.2.6
crlDistributionPoints	MUST	N	See Section 7.1.2.11.2
keyUsage	MUST	Y	See Section 7.1.2.10.7
subjectKeyIdentifier	MUST	N	See Section 7.1.2.11.4
authorityInformationAccess	SHOULD	N	See Section 7.1.2.10.3
nameConstraints	MAY	*1	See Section 7.1.2.10.8
Signed Certificate Timestamp List	MAY	N	See Section 7.1.2.11.3
Any other extension	NOT RECOMMENDED	-	See Section 7.1.2.11.5

In addition to the above, extKeyUsage extension requirements vary based on the relationship between the Issuer and Subject organizations represented in the Cross-Certificate.

除上述規定外，extKeyUsage 擴充欄位之要求，視交互憑證的簽發者與主體組織的關係而異。

The extKeyUsage extension MAY be “unrestricted” as described in the following table if:

若符合以下條件，extKeyUsage 擴充欄位得（MAY）依下表所述設為「不受限制」：

• the organizationName represented in the Issuer and Subject names of the corresponding certificate are either:
  • the same, or
  • the organizationName represented in the Subject name is an affiliate of the organizationName represented in the Issuer name
• the corresponding CA represented by the Subject of the Cross-Certificate is operated by the same organization as the Issuing CA or an Affiliate of the Issuing CA organization.

• 交互憑證的簽發者與主體名稱中的 organizationName 符合下列任一情形：
  • 兩者相同，或
  • 主體名稱中的 organizationName 為簽發者名稱中的 organizationName 之關係企業
• 交互憑證之主體 CA，係由簽發憑證機構（Issuing CA）所屬組織或其關係企業負責營運。

Cross-Certified Subordinate CA with Unrestricted EKU

Extension	Presence	Critical	Description
extKeyUsage	SHOULD2	N	See Section 7.1.2.2.4

In all other cases, the extKeyUsage extension MUST be “restricted” as described in the following table:

在所有其他情況下，extKeyUsage 擴充欄位應（MUST）依下表所述設為「受限制」：

Cross-Certified Subordinate CA with Restricted EKU

Extension	Presence	Critical	Description
extKeyUsage	MUST2	N	See Section 7.1.2.2.5