憑證廢止清冊（CRL）剖繪
CRL profile
Prior to 2024-03-15, the CA SHALL issue CRLs in accordance with the profile specified in these Requirements or the profile specified in Version 1.8.7 of the Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates. Effective 2024-03-15, the CA SHALL issue CRLs in accordance with the profile specified in these Requirements.
於 2024-03-15 之前，憑證機構（Certification Authority，CA）應（SHALL）依本文件指定之剖繪，或依《公開信賴憑證簽發與管理之基本要求》（Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates）第 1.8.7 版指定之剖繪簽發憑證廢止清冊（Certificate Revocation List，CRL）。自 2024-03-15 起，CA 應（SHALL）依本文件指定之剖繪簽發 CRL。
If the CA asserts compliance with these Baseline Requirements, all CRLs that it issues MUST comply with the following CRL profile, which incorporates, and is derived from RFC 5280. Except as explicitly noted, all normative requirements imposed by RFC 5280 shall apply, in addition to the normative requirements imposed by this document. CAs SHOULD examine RFC 5280, Appendix B for further issues to be aware of.
若 CA 聲明其遵循本《基本要求》規定，則其所簽發之所有 CRL 應（MUST）遵循下列 CRL 剖繪；該剖繪引用 RFC 5280 之相關規定，並以其為基礎衍生。除非另有明確說明，除本文件所規定之規範性要求外，RFC 5280 所定之所有規範性要求亦適用。CA 宜（SHOULD）參閱 RFC 5280 附錄 B，以瞭解其他應注意事項。
A full and complete CRL is a CRL whose scope includes all Certificates issued by the CA.
「完整 CRL（full and complete CRL）」係指其涵蓋範圍包含 CA 所簽發之所有憑證的 CRL。
A partitioned CRL (sometimes referred to as a “sharded CRL”) is a CRL with a constrained scope, such as all Certificates issued by the CA during a certain period of time (“temporal sharding”). Aside from the presence of the Issuing Distribution Point extension (OID 2.5.29.28) in partitioned CRLs, both CRL formats are syntactically the same from the perspective of this profile.
「分割式 CRL（partitioned CRL，有時稱為「分片式 CRL（sharded CRL）」）」係指涵蓋範圍有限的 CRL，例如僅涵蓋 CA 於特定期間所簽發之所有憑證（「時間分片（temporal sharding）」）。除分割式 CRL 含有簽發發布點（Issuing Distribution Point）擴充欄位（OID 2.5.29.28）外，從本剖繪的角度而言，兩種 CRL 格式在語法上相同。
Minimally, CAs MUST issue either a “full and complete” CRL or a set of “partitioned” CRLs which cover the complete set of Certificates issued by the CA within 7 days of such CA issuing its first certificate. In other words, if issuing only partitioned CRLs, the combined scope of those CRLs must be equivalent to that of a full and complete CRL.
CA 應（MUST）至少於首次簽發憑證後 7 日內，簽發一份「完整 CRL」，或簽發一組範圍涵蓋該 CA 所簽發之全部憑證的「分割式 CRL」。換言之，若僅簽發分割式 CRL，該等分割 CRL 的合計涵蓋範圍須等同於一份完整 CRL 的涵蓋範圍。
CAs MUST NOT issue indirect CRLs (i.e., the issuer of the CRL is not the issuer of all Certificates that are included in the scope of the CRL).
CA 不得（MUST NOT）簽發間接 CRL（indirect CRL）（即 CRL 簽發者並非該 CRL 涵蓋範圍內的所有憑證簽發者）。
CRL Fields Field Presence Description tbsCertListversionMUST MUST be v2(1), see Section 7.2.1 signatureMUST See Section 7.1.3.2 issuerMUST MUST be byte-for-byte identical to the subjectfield of the Issuing CA.thisUpdateMUST Indicates the issue date of the CRL. nextUpdateMUST Indicates the date by which the next CRL will be issued. For CRLs covering Subscriber Certificates, at most 10 days after the thisUpdate. For other CRLs, at most 12 months after thethisUpdate.revokedCertificates* MUST be present if the CA has issued a Certificate that has been revoked and the corresponding entry has yet to appear on at least one regularly scheduled CRL beyond the revoked Certificate’s validity period. The CA SHOULD remove an entry for a corresponding Certificate after it has appeared on at least one regularly scheduled CRL beyond the revoked Certificate’s validity period. See the “revokedCertificates Component” table for additional requirements. extensionsMUST See the “CRL Extensions” table for additional requirements. signatureAlgorithmMUST Encoded value MUST be byte-for-byte identical to the tbsCertList.signature.signatureMUST - Any other value NOT RECOMMENDED -
| 欄位 | 必要性 | 說明 |
|---|---|---|
tbsCertList | ||
version | 應（MUST） | 應（MUST）為 v2(1)，參見第 7.2.1 節。 |
signature | 應（MUST） | 參見第 7.1.3.2 節 |
issuer | 應（MUST） | 應（MUST）與簽發憑證機構（Issuing CA）的 subject 欄位逐位元組完全相同 |
thisUpdate | 應（MUST） | 表示 CRL 的簽發日期 |
nextUpdate | 應（MUST） | 表示下一份 CRL 的最晚簽發日期。對於範圍涵蓋用戶憑證的 CRL，該日期最遲為 thisUpdate 後 10 日；對於其他 CRL，最遲為 thisUpdate 後 12 個月。 |
revokedCertificates | * | 若 CA 已簽發之憑證其後遭廢止，且其對應 CRL 條目尚未出現在該廢止憑證有效期屆滿後，至少一份依正常排程簽發的 CRL 中，則 revokedCertificates 應（MUST）存在。當某 CRL 條目已出現在其所對應之遭廢止憑證有效期屆滿後，至少一份依正常排程簽發的 CRL 中，則 CA 宜（SHOULD）移除該 CRL 條目。其他要求詳見「revokedCertificates 元件」表格 |
extensions | 應（MUST） | 其他要求詳見「CRL 擴充欄位」表格 |
signatureAlgorithm | 應（MUST） | 編碼後之值應（MUST）與 tbsCertList.signature 逐位元組完全相同 |
signature | 應（MUST） | - |
| 其他任何值 | 不建議（NOT RECOMMENDED） | - |