預簽憑證（Precertificate）之授權單位金鑰識別碼（Authority Key Identifier）

Precertificate Authority Key Identifier

For Precertificates issued by a Precertificate Signing CA, the contents of the authorityKeyIdentifier extension MUST be one of the following:

對於由預簽憑證簽章憑證機構（Precertificate Signing CA）所簽發之預簽憑證，authorityKeyIdentifier 擴充欄位之內容應（MUST）符合下列任一情形：

1. SHOULD be as defined in the profile below, or;
2. MAY be byte-for-byte identical with the contents of the authorityKeyIdentifier extension of the corresponding Certificate.

1. 宜（SHOULD）依下表之剖繪設定；或
2. 得（MAY）與相對應憑證之 authorityKeyIdentifier 擴充欄位內容逐位元組完全相同。

Field	Description
keyIdentifier	MUST be present. MUST be identical to the subjectKeyIdentifier field of the Precertificate Signing CA Certificate
authorityCertIssuer	MUST NOT be present
authorityCertSerialNumber	MUST NOT be present

Note: RFC 6962 describes how the authorityKeyIdentifier present on a Precertificate is transformed to contain the value of the Precertificate Signing CA’s authorityKeyIdentifier extension (i.e. reflecting the actual issuer certificate’s keyIdentifier), thus matching the corresponding Certificate when verified by clients. These Baseline Requirements RECOMMEND the use of the Precertificate Signing CA’s keyIdentifier in Precertificates issued by it in order to ensure consistency between the subjectKeyIdentifier and authorityKeyIdentifier of all certificates in the chain. Although RFC 5280 does not strictly require such consistency, a number of client implementations enforce such consistency for Certificates, and this avoids any risks from Certificate Transparency Logs incorrectly implementing such checks.

注意：RFC 6962 描述如何轉換預簽憑證中的 authorityKeyIdentifier，使其包含預簽憑證簽章憑證機構的 authorityKeyIdentifier 擴充欄位值（即反映實際簽發者憑證的 keyIdentifier），從而使其在用戶端驗證時與相對應有效憑證相符。本《基本要求》建議（RECOMMENDED）由預簽憑證簽章憑證機構簽發之預簽憑證，其 authorityKeyIdentifier 使用該簽章憑證機構之 authorityKeyIdentifier 擴充欄位中的 keyIdentifier，以確保憑證鏈中所有憑證之 subjectKeyIdentifier 與 authorityKeyIdentifier 具有一致性。雖然 RFC 5280 並未嚴格要求此種一致性，但已有若干用戶端實作會對憑證強制執行此種一致性檢查，而採用上述作法可避免因憑證透明度記錄系統（Certificate Transparency Log）錯誤實作此類檢查而產生的風險。