Lightweight Directory Access Protocol (LDAP) Schema Definitions for X.509 Certificates
obsoletes
Extracted elements (24)
No LDAP-specific encoding is defined for Certificate, CertificateList, CertificatePair, or SupportedAlgorithm syntaxes because these types have changed over time; mandating ;binary transfer preserves the exact signed octets without re-encoding.
The strongAuthenticationUser (OID 2.5.6.15) and certificationAuthority (OID 2.5.6.16) object classes are deprecated in favor of pkiUser and pkiCA respectively; implementations should migrate to the newer classes.
As values of Certificate syntax contain digitally signed data, values of this syntax and the form of each value MUST be preserved as presented to protect signature integrity.
Values of Certificate, CertificateList, CertificatePair, and SupportedAlgorithm syntaxes SHOULD be encoded using Distinguished Encoding Rules (DER) per X.690.
The algorithmIdentifierMatch matching rule (OID 2.5.13.40) compares a presented AlgorithmIdentifier assertion against a SupportedAlgorithm attribute value per X.509 clause 11.3.7.
The cACertificate attribute type (OID 2.5.4.37) holds X.509 certificates issued to a CA, uses certificateExactMatch for equality, and requires ;binary transfer.
The certificateExactMatch matching rule (OID 2.5.13.34) compares a CertificateExactAssertion against a Certificate attribute value, matching by serial number and issuer as defined in X.509 clause 11.3.1.
The certificateListExactMatch matching rule (OID 2.5.13.38) and certificateListMatch rule (OID 2.5.13.39) match CRL attribute values against assertion values identifying issuer, thisUpdate, and optional distribution point.
The certificateMatch matching rule (OID 2.5.13.35) compares a CertificateAssertion against a Certificate attribute, supporting rich multi-field filtering including validity period, key usage, subject, and policy.
The certificateRevocationList (OID 2.5.4.39), authorityRevocationList (OID 2.5.4.38), and deltaRevocationList (OID 2.5.4.53) attribute types hold CRL values, use certificateListExactMatch, and require ;binary transfer.
The cRLDistributionPoint object class (OID 2.5.6.19) is a STRUCTURAL class that MUST have a cn attribute and MAY hold CRL-related attributes; used to represent CRL distribution point directory entries.
The deltaCRL object class (OID 2.5.6.23) is an AUXILIARY class that MAY hold deltaRevocationList, used to augment entries with delta CRL data.
The pkiCA object class (OID 2.5.6.22) is an AUXILIARY class that MAY hold cACertificate, certificateRevocationList, authorityRevocationList, and crossCertificatePair; it supersedes certificationAuthority and certificationAuthority-V2.
The pkiUser object class (OID 2.5.6.21) is an AUXILIARY class derived from top that MAY contain userCertificate; it supersedes the deprecated strongAuthenticationUser class.
The userCertificate attribute type (OID 2.5.4.36) holds X.509 certificates issued to the user, uses certificateExactMatch for equality, and requires ;binary transfer.
IANA registered an LDAP Object Identifier for the LDAP X.509 Certificate schema elements introduced in this document, and updated the LDAP Descriptor registry with 22 descriptors (matching rules, attribute types, object classes) mapping to their OIDs.
Certificate signatures only protect the integrity of the signed content itself; without LDAP data integrity protections (or lower-layer e.g. IPsec), a server cannot verify client requests were unaltered in transit, and clients cannot verify query results. Implementations are recommended to use LDAP authentication and data integrity services (RFC4513, RFC4511).
Assertion syntaxes CertificateExactAssertion (OID 1.3.6.1.1.15.1), CertificateAssertion (OID 1.3.6.1.1.15.2), and related assertion types MUST be encoded using Generic String Encoding Rules (GSER) per RFC3641.
CertificateExactAssertion GSER encoding is a sequence with mandatory serialNumber (INTEGER) and issuer (rdnSequence Name) fields, used to uniquely identify a certificate for exact matching.
CertificateListExactAssertion GSER encoding contains mandatory issuer (Name) and thisUpdate (Time), plus optional distributionPoint (DistributionPointName), used for exact CRL matching.
The Certificate syntax (OID 1.3.6.1.4.1.1466.115.121.1.8) carries an X.509 Certificate value. No LDAP-specific encoding is defined; DER encoding is strongly preferred and ;binary transfer is required.
The CertificateList syntax (OID 1.3.6.1.4.1.1466.115.121.1.9) carries an X.509 CertificateList (CRL) value. DER encoding preferred, ;binary transfer required.
The CertificatePair syntax (OID 1.3.6.1.4.1.1466.115.121.1.10) carries an X.509 CertificatePair value for cross-certification. DER encoding preferred, ;binary transfer required.
The SupportedAlgorithm syntax (OID 1.3.6.1.4.1.1466.115.121.1.49) carries an X.509 SupportedAlgorithm value. DER encoding preferred, ;binary transfer required.