Subject: ASN.1 Encoding of no valued extension

From: "Kwon, YongChul" <[email-masked]>
Date: Mon, 21 Aug 2000 23:59:49 +0900

I wonder about how no valued extension will be encoded in DER form.

for example,

NameConstraints ::= SEQUENCE {
    permittedSubtrees       [0]     GeneralSubtrees OPTIONAL,
    excludedSubtrees        [1]     GeneralSubtrees OPTIONAL }

permittedSubtrees and excludedSubtrees are both omittable.

and then it's an empty sequence when both are omitted. 

I'd omit this extension rather than encode as empty sequence.

What's the PKIX's recomendation about this situation?

both(omit or empty sequence)? or omit such extension? or encode as

empty sequence? or depends on situation? :-(

(I guess that just omitting Extension like that basic constraints
should not appear in EE's certificates is the best way).