7.1.2.6 已翻譯對應原文版本：2.3.0

TLS 下屬憑證機構（TLS Subordinate CA）憑證剖繪

TLS Subordinate CA Certificate Profile

Field Description
tbsCertificate
version MUST be v3(2)
serialNumber MUST be a non-sequential number greater than zero (0) and less than 2¹⁵⁹ containing at least 64 bits of output from a CSPRNG.
signature See Section 7.1.3.2
issuer MUST be byte-for-byte identical to the subject field of the Issuing CA. See Section 7.1.4.1
validity See Section 7.1.2.10.1
subject See Section 7.1.2.10.2
subjectPublicKeyInfo See Section 7.1.3.1
issuerUniqueID MUST NOT be present
subjectUniqueID MUST NOT be present
extensions See Section 7.1.2.6.1
signatureAlgorithm Encoded value MUST be byte-for-byte identical to the tbsCertificate.signature.
signature

欄位	說明
`tbsCertificate`
`version`	應（MUST）為 v3(2)
`serialNumber`	應（MUST）為一個非連續之數值，其值大於 0 且小於 2¹⁵⁹，且其中至少 64 個位元應來自 CSPRNG 之輸出。
`signature`	參見第 7.1.3.2 節
`issuer`	應（MUST）與簽發憑證機構（Issuing CA）之 `subject` 欄位逐位元組完全相同。參見第 7.1.4.1 節
`validity`	參見第 7.1.2.10.1 節
`subject`	參見第 7.1.2.10.2 節
`subjectPublicKeyInfo`	參見第 7.1.3.1 節
`issuerUniqueID`	不得（MUST NOT）存在
`subjectUniqueID`	不得（MUST NOT）存在
`extensions`	參見第 7.1.2.6.1 節
`signatureAlgorithm`	編碼後之值應（MUST）與 `tbsCertificate.signature` 逐位元組完全相同
`signature`

Field	Description
`tbsCertificate`
`version`	MUST be v3(2)
`serialNumber`	MUST be a non-sequential number greater than zero (0) and less than 2¹⁵⁹ containing at least 64 bits of output from a CSPRNG.
`signature`	See Section 7.1.3.2
`issuer`	MUST be byte-for-byte identical to the `subject` field of the Issuing CA. See Section 7.1.4.1
`validity`	See Section 7.1.2.10.1
`subject`	See Section 7.1.2.10.2
`subjectPublicKeyInfo`	See Section 7.1.3.1
`issuerUniqueID`	MUST NOT be present
`subjectUniqueID`	MUST NOT be present
`extensions`	See Section 7.1.2.6.1
`signatureAlgorithm`	Encoded value MUST be byte-for-byte identical to the `tbsCertificate.signature`.
`signature`