Subject: Questionable fields in PKIX structures

From: "Christopher Williams" <[email-masked]>
Date: Mon, 10 Apr 2000 10:46:59 +0100

There are a number of structures in the PKIX specification which have fields
whose purpose in most unclear.  In many cases, I can write routines (indeed
have written routines) to access them, but I can't fathom what they'd be
used for.  If anybody can give an explanation of the purpose of the
following fields (and possibly an example of how they might be used in a
real world scenario) I would be very grateful:

PKIMessage.extraCerts
PKIHeader.freeText
CertReqMsg.regInfo
RevDetails.crlEntryDetails
CertResponse.rspInfo

Christopher Williams

Software engineer, NetLexis Ltd.
Solutions for secure electronic commerce
http://www.netlexis.com

---

From: Ari Kermaier <[email-masked]>
Date: Mon, 10 Apr 2000 12:13:37 -0400

Christopher, the following is my understanding of the spec for the fields 
you mentioned.

   -- Ari Kermaier

>PKIMessage.extraCerts

In a PKIMessage whose MessageBody content is a CertRepMessage certification 
response, if the CA is not a root CA, it may include additional 
certificates along with the EE's certificate that complete the verification 
chain.

>PKIHeader.freeText

A CA server might send a message in the freeText field for a human-operated 
client (e.g., a web browser) to display to the person, for example "Your 
certificates will be sent to you by email within the next 30 minutes".

>CertReqMsg.regInfo

Might contain information from the EE client to the CA server needed to 
issue the certificate e.g., the email address to which the certificate 
should be mailed, the client's credit card number, etc.

>RevDetails.crlEntryDetails

RFC 2459 Section 5.3 CRL Entry Extensions talks about this field. For 
example, it might contain a reason code explaining the revocation, the date 
the certificate became invalid, etc.

>CertResponse.rspInfo

Similar to CertReqMsg.regInfo, the rspInfo field may be used by the CA 
server to convey additional issuance info to the EE client needed for 
receiving/installing the certificate.