預簽憑證（Precertificate）剖繪
Precertificate Profile
A Precertificate is a signed data structure that can be submitted to a Certificate Transparency log, as defined by RFC 6962. A Precertificate appears structurally identical to a Certificate, with the exception of a special critical poison extension in the
extensionsfield, with the OID of 1.3.6.1.4.1.11129.2.4.3. This extension ensures that the Precertificate will not be accepted as a Certificate by clients conforming to RFC 5280. The existence of a signed Precertificate can be treated as evidence of a corresponding Certificate also existing, as the signature represents a binding commitment by the CA that it may issue such a Certificate.
預簽憑證（Precertificate）係一種經簽章之資料結構，如 RFC 6962 所定義，可提出至憑證透明度（Certificate Transparency）記錄系統。預簽憑證在結構上與有效憑證相同，惟其 extensions 欄位中包含一特殊之關鍵性 poison 擴充欄位，其 OID 為 1.3.6.1.4.1.11129.2.4.3。此擴充欄位可確保遵循 RFC 5280 之用戶端不會將預簽憑證接受為有效憑證。經簽章之預簽憑證的存在，可視為相對應有效憑證亦存在之證據，因該簽章代表 CA 對可能簽發此憑證做出具有約束力之承諾。
A Precertificate is created after a CA has decided to issue a Certificate, but prior to the actual signing of the Certificate. The CA MAY construct and sign a Precertificate corresponding to the Certificate, for purposes of submitting to Certificate Transparency Logs. The CA MAY use the returned Signed Certificate Timestamps to then alter the Certificate’s
extensionsfield, adding a Signed Certificate Timestamp List, as defined in Section 7.1.2.11.3 and as permitted by the relevant profile, prior to signing the Certificate.
預簽憑證是於 CA 決定簽發憑證之後，但在實際簽章該有效憑證之前建立。CA 得（MAY）建構並簽章與該有效憑證相對應之預簽憑證，以提出至憑證透明度記錄系統。CA 得（MAY）使用所回傳之已簽章憑證時間戳記（Signed Certificate Timestamps，SCT），於簽章該有效憑證之前修改憑證之 extensions 欄位，新增如第 7.1.2.11.3 節所定義且為相關剖繪所允許之已簽章憑證時間戳記（SCT）清單。
Once a Precertificate is signed, relying parties are permitted to treat this as a binding commitment from the CA of the intent to issue a corresponding Certificate, or more commonly, that a corresponding Certificate exists. A Certificate is said to be corresponding to a Precertificate based upon the value of the
tbsCertificatecontents, as transformed by the process defined in RFC 6962, Section 3.2.
預簽憑證一經簽章，信賴憑證者可將其視為 CA 對其簽發相對應有效憑證之意圖所做出的具有約束力之承諾，或更常見的是，視為相對應有效憑證已存在。有效憑證是否與預簽憑證相對應，是依據經 RFC 6962 第 3.2 節 所定義之流程轉換後的 tbsCertificate 內容值判定。
This profile describes the transformations that are permitted to a Certificate to construct a Precertificate. CAs MUST NOT issue a Precertificate unless they are willing to issue a corresponding Certificate, regardless of whether they have done so. Similarly, a CA MUST NOT issue a Precertificate unless the corresponding Certificate conforms to these Baseline Requirements, regardless of whether the CA signs the corresponding Certificate.
本剖繪描述將憑證轉換為預簽憑證時，所允許之轉換。CA 不得（MUST NOT）簽發預簽憑證，除非其願意簽發相對應有效憑證，無論其是否已簽發該相對應有效憑證。同樣地，CA 不得（MUST NOT）簽發預簽憑證，除非相對應有效憑證遵循本《基本要求》規定，無論 CA 是否簽章該相對應有效憑證。
A Precertificate may be issued either directly by the Issuing CA or, when issued prior to 2026-03-15, by a Technically Constrained Precertificate Signing CA, as defined in Section 7.1.2.4. If issued by a Precertificate Signing CA, then in addition to the precertificate poison and signed certificate timestamp list extensions, the Precertificate issuer field and, if present,
authorityKeyIdentifierextension, may differ from the Certificate, as described below.
預簽憑證可直接由簽發憑證機構（Issuing CA）簽發；若預簽憑證是於 2026-03-15 之前簽發，亦可由第 7.1.2.4 節所定義的受技術約束之預簽憑證簽章憑證機構（Signing CA）簽發。若預簽憑證是由預簽憑證簽章憑證機構簽發，則除預簽憑證 poison 擴充欄位及已簽章憑證時間戳記清單（SCT 清單）擴充欄位外，預簽憑證之 issuer 欄位及 authorityKeyIdentifier 擴充欄位（若存在）亦可與有效憑證不同，如下所述。
When the Precertificate is issued directly by the Issuing CA Field Description tbsCertificateversionEncoded value MUST be byte-for-byte identical to the versionfield of the CertificateserialNumberEncoded value MUST be byte-for-byte identical to the serialNumberfield of the CertificatesignatureEncoded value MUST be byte-for-byte identical to the signaturefield of the CertificateissuerEncoded value MUST be byte-for-byte identical to the issuerfield of the CertificatevalidityEncoded value MUST be byte-for-byte identical to the validityfield of the CertificatesubjectEncoded value MUST be byte-for-byte identical to the subjectfield of the CertificatesubjectPublicKeyInfoEncoded value MUST be byte-for-byte identical to the subjectPublicKeyInfofield of the CertificateissuerUniqueIDEncoded value MUST be byte-for-byte identical to the issuerUniqueIDfield of the Certificate, or omitted if omitted in the CertificatesubjectUniqueIDEncoded value MUST be byte-for-byte identical to the subjectUniqueIDfield of the Certificate, or omitted if omitted in the CertificateextensionsSee Section 7.1.2.9.1 signatureAlgorithmEncoded value MUST be byte-for-byte identical to the tbsCertificate.signature.signature
| 欄位 | 說明 |
|---|---|
tbsCertificate | |
version | 編碼後之值應（MUST）與有效憑證之 version 欄位逐位元組完全相同 |
serialNumber | 編碼後之值應（MUST）與有效憑證之 serialNumber 欄位逐位元組完全相同 |
signature | 編碼後之值應（MUST）與有效憑證之 signature 欄位逐位元組完全相同 |
issuer | 編碼後之值應（MUST）與有效憑證之 issuer 欄位逐位元組完全相同 |
validity | 編碼後之值應（MUST）與有效憑證之 validity 欄位逐位元組完全相同 |
subject | 編碼後之值應（MUST）與有效憑證之 subject 欄位逐位元組完全相同 |
subjectPublicKeyInfo | 編碼後之值應（MUST）與有效憑證之 subjectPublicKeyInfo 欄位逐位元組完全相同 |
issuerUniqueID | 編碼後之值應（MUST）與有效憑證之 issuerUniqueID 欄位逐位元組完全相同，若有效憑證省略此欄位，則亦予以省略。 |
subjectUniqueID | 編碼後之值應（MUST）與有效憑證之 subjectUniqueID 欄位逐位元組完全相同，若有效憑證省略此欄位，則亦予以省略。 |
extensions | 參見第 7.1.2.9.1 節 |
signatureAlgorithm | 編碼後之值應（MUST）與 tbsCertificate.signature 逐位元組完全相同 |
signature |
When the Precertificate is issued by a Precertificate Signing CA on behalf of an Issuing CA Field Description tbsCertificateversionEncoded value MUST be byte-for-byte identical to the versionfield of the CertificateserialNumberEncoded value MUST be byte-for-byte identical to the serialNumberfield of the CertificatesignatureEncoded value MUST be byte-for-byte identical to the signaturefield of the CertificateissuerEncoded value MUST be byte-for-byte identical to the subjectfield of the Precertificate Signing CA CertificatevalidityEncoded value MUST be byte-for-byte identical to the validityfield of the CertificatesubjectEncoded value MUST be byte-for-byte identical to the subjectfield of the CertificatesubjectPublicKeyInfoEncoded value MUST be byte-for-byte identical to the subjectPublicKeyInfofield of the CertificateissuerUniqueIDEncoded value MUST be byte-for-byte identical to the issuerUniqueIDfield of the Certificate, or omitted if omitted in the CertificatesubjectUniqueIDEncoded value MUST be byte-for-byte identical to the subjectUniqueIDfield of the Certificate, or omitted if omitted in the CertificateextensionsSee Section 7.1.2.9.2 signatureAlgorithmEncoded value MUST be byte-for-byte identical to the tbsCertificate.signature.signature
| 欄位 | 說明 |
|---|---|
tbsCertificate | |
version | 編碼後之值應（MUST）與有效憑證之 version 欄位逐位元組完全相同 |
serialNumber | 編碼後之值應（MUST）與有效憑證之 serialNumber 欄位逐位元組完全相同 |
signature | 編碼後之值應（MUST）與有效憑證之 signature 欄位逐位元組完全相同 |
issuer | 編碼後之值應（MUST）與預簽憑證簽章憑證機構憑證之 subject 欄位逐位元組完全相同 |
validity | 編碼後之值應（MUST）與有效憑證之 validity 欄位逐位元組完全相同 |
subject | 編碼後之值應（MUST）與有效憑證之 subject 欄位逐位元組完全相同 |
subjectPublicKeyInfo | 編碼後之值應（MUST）與有效憑證之 subjectPublicKeyInfo 欄位逐位元組完全相同 |
issuerUniqueID | 編碼後之值應（MUST）與有效憑證之 issuerUniqueID 欄位逐位元組完全相同，若有效憑證省略此欄位，則亦予以省略。 |
subjectUniqueID | 編碼後之值應（MUST）與有效憑證之 subjectUniqueID 欄位逐位元組完全相同，若有效憑證省略此欄位，則亦予以省略。 |
extensions | 參見第 7.1.2.9.2 節 |
signatureAlgorithm | 編碼後之值應（MUST）與 tbsCertificate.signature 逐位元組完全相同 |
signature |
Note: This profile requires that the
serialNumberfield of the Precertificate be identical to that of the corresponding Certificate. RFC 5280, Section 4.1.2.2 requires that theserialNumberof certificates be unique. For the purposes of this document, a Precertificate shall not be considered a “certificate” subject to that requirement, and thus may have the sameserialNumberof the corresponding Certificate. However, this does not permit two Precertificates to share the sameserialNumber, unless they correspond to the same Certificate, as this would otherwise indicate there are two corresponding Certificates that share the sameserialNumber.
注意：本剖繪要求預簽憑證之 serialNumber 欄位與相對應有效憑證之 serialNumber 欄位完全相同。RFC 5280 第 4.1.2.2 節 要求憑證之 serialNumber 必須具唯一性。就本文件而言，預簽憑證不應被視為受該 RFC 要求規範之「憑證」，因此得與相對應有效憑證具有相同之 serialNumber。然而，除非兩個預簽憑證對應於同一有效憑證，否則不得共用相同之 serialNumber，因為此情形將表示存在兩個具有相同 serialNumber 之相對應有效憑證。