Internet X.509 Public Key Infrastructure LDAPv2 Schema
obsoleted by
- rfc-4523 — Lightweight Directory Access Protocol (LDAP) Schema Definitions for X.509 Certificates
Extracted elements (19)
Alternative object classes (pkiUser, pkiCA) are defined rather than reusing X.509-defined classes because X.509 mandates inclusion of attributes that are optional for PKIX, which would require dynamic modification of the object class attribute when those attributes are absent. The new auxiliary classes avoid this constraint.
CRL distribution points and delta CRLs are defined as optional mechanisms. A CA elects whether to use them; the schema provides dedicated object classes (cRLDistributionPoint, deltaCRL) only for CAs that choose to deploy these features.
This schema is explicitly minimal, intended only for PKIX support in LDAPv2 environments as defined in RFC 2559. LDAP servers should integrate this schema with generic and other application-specific schemas appropriate to their deployment.
When a reverse element of crossCertificatePair is present, the forward and reverse element values need not be stored in the same attribute value; they may be stored in either a single attribute value or two separate attribute values.
In the case of V3 certificates, none of the CA certificates stored in cACertificate or crossCertificatePair shall include a basicConstraints extension with the cA value set to FALSE.
The cACertificate attribute of a CA's directory entry shall be used to store self-issued certificates (if any) and certificates issued to this CA by CAs in the same realm.
The userCertificate attribute MUST be used to represent end-entity certificates in the directory entry for that user.
When both forward and reverse elements are present in a single crossCertificatePair value, the issuer name in one certificate shall match the subject name in the other and vice versa, and each certificate's public key shall be capable of verifying the other's digital signature.
The authorityRevocationList attribute, if present in a CA's entry, contains revocation information regarding certificates issued to other CAs. Uses CertificateList syntax and certificateListExactMatch. OID: joint-iso-ccitt(2) ds(5) attributeType(4) authorityRevocationList(38).
The cACertificate attribute stores self-issued certificates and certificates issued to a CA by CAs in the same realm. Uses certificateExactMatch equality matching. OID: joint-iso-ccitt(2) ds(5) attributeType(4) cACertificate(37).
The certificateRevocationList attribute, if present in a CA's entry, contains CRLs as defined in RFC 2459. It uses CertificateList syntax and certificateListExactMatch equality matching. OID: joint-iso-ccitt(2) ds(5) attributeType(4) certificateRevocationList(39).
The cRLDistributionPoint structural object class represents CRL distribution points. It MUST contain commonName and MAY contain certificateRevocationList, authorityRevocationList, and deltaRevocationList. OID: joint-iso-ccitt(2) ds(5) objectClass(6) cRLDistributionPoint(19).
The crossCertificatePair attribute stores cross-certification data using CertificatePair syntax and certificatePairExactMatch. The forward element stores all non-self-issued certificates issued to the CA; the reverse element optionally contains a subset of certificates this CA issued to other CAs. OID: joint-iso-ccitt(2) ds(5) attributeType(4) crossCertificatePair(40).
The deltaCRL auxiliary object class is used to represent delta CRLs. It is a subclass of top, and MAY contain the deltaRevocationList attribute. OID: joint-iso-ccitt(2) ds(5) objectClass(6) deltaCRL(23).
The deltaRevocationList attribute holds delta CRLs as defined in RFC 2459, using CertificateList syntax and certificateListExactMatch equality matching. OID: joint-iso-ccitt(2) ds(5) attributeType(4) deltaRevocationList(53).
The pkiCA auxiliary object class MAY be used to represent Certification Authorities. It MAY contain cACertificate, certificateRevocationList, authorityRevocationList, and crossCertificatePair. OID: joint-iso-ccitt(2) ds(5) objectClass(6) pkiCA(22).
The pkiUser auxiliary object class MAY be used to represent certificate subjects (end entities). It is a subclass of top, and MAY contain the userCertificate attribute. OID: joint-iso-ccitt(2) ds(5) objectClass(6) pkiUser(21).
The userCertificate attribute holds X.509 certificates for an end entity, using certificateExactMatch as its equality matching rule. OID: joint-iso-ccitt(2) ds(5) attributeType(4) userCertificate(36).
Since certificates and CRLs are digitally signed, no additional integrity service is REQUIRED for the schema-defined information. Security considerations for retrieval, addition, deletion, and modification of this information are addressed in RFC 2559.