Subject Key ID - Revision history

Tom: /* Solutions */

2021-09-09T22:09:10Z

‎Solutions

2021-09-09T22:08:30Z

‎Solutions

2021-09-09T22:07:59Z

‎Solutions

2021-09-09T22:05:25Z

‎Problems

2021-09-09T22:01:50Z

‎Problems

2021-09-09T22:00:54Z

‎Problems

2021-09-09T21:58:55Z

‎Problems

2021-09-09T21:57:10Z

‎References

2021-09-09T21:49:36Z

‎Context

2021-09-09T21:48:36Z

‎Context

@@ Line 36: / Line 36: @@
 # The Certificate Fingerprint which is, essentially, a certificate GUID.
-Also note that an [[Entity]] could very well have multiple keys to support different business purposes.
+Also note that an [[Entity]] could very well have multiple dids or keys to support different business purposes.
 ==References==

@@ Line 36: / Line 36: @@
 # The Certificate Fingerprint which is, essentially, a certificate GUID.
-Also note that an [[Entity]] could very well have
+Also note that an [[Entity]] could very well have multiple keys to support different business purposes.
 ==References==

@@ Line 30: / Line 30: @@
 The SKID is a key id, not a certificate ID and so the SKID (as a rule) is calculated from the Subject and Public Key while the fingerprint is generated from the whole certificate. If a certificate is renewed, its SKID will stay the same, while its fingerprint will change. The SKID remains the same only when key pair is reused during renewal. If new key pair is generated, as happens when the key is rolled, it will produce new SKID value,
 ==Solutions==
-So there are three levels of ID that a [[Entity]] might exhibit.
+So there are several levels of ID that an [[Entity]] might exhibit.
 # The Entity ID which could survive even a change in cryptographic method.
 # The SKID which could survive the issuance of a new certificate if the key were not rolled.
 # The Certificate Fingerprint which is, essentially, a certificate GUID.
 ==References==

@@ Line 29: / Line 29: @@
 ==Problems==
 The SKID is a key id, not a certificate ID and so the SKID (as a rule) is calculated from the Subject and Public Key while the fingerprint is generated from the whole certificate. If a certificate is renewed, its SKID will stay the same, while its fingerprint will change. The SKID remains the same only when key pair is reused during renewal. If new key pair is generated, as happens when the key is rolled, it will produce new SKID value,
 ==References==

@@ Line 28: / Line 28: @@
 ==Problems==
-The SKID is a key id, not a certificate ID and so the SKID (as a rule) is calculated from the Subject and Public Key while the fingerprint is generated from the whole certificate. If a certificate is renewed, its SKID will stay the same, while its fingerprint will change. The SKID remains the same only when key pair is reused during renewal. If new key pair is generated, it will produce new SKID value,
+The SKID is a key id, not a certificate ID and so the SKID (as a rule) is calculated from the Subject and Public Key while the fingerprint is generated from the whole certificate. If a certificate is renewed, its SKID will stay the same, while its fingerprint will change. The SKID remains the same only when key pair is reused during renewal. If new key pair is generated, as happens when the key is rolled, it will produce new SKID value,
 ==References==

@@ Line 26: / Line 26: @@
          X509v3 Subject Key Identifier:
              BB:AF:7E:02:3D:FA:A6:F1:3C:84:8E:AD:EE:38:98:EC:D9:32:32:D4
 ==References==

@@ Line 3: / Line 3: @@
 ==Context==
- The fingerprint instead is not part of the certificate but instead computed from the certificate. A certificate does not need to have an SKID at all and can have at most one SKID. But since the fingerprint is just a computed from the certificate there can be multiple fingerprints, like one using SHA-1, one using SHA-256, one using MD5 ...
+The fingerprint is not part of the certificate but instead computed from the certificate. A certificate does not need to have an SKID at all and can have at most one SKID. But since the fingerprint is just a computed from the certificate there can be multiple fingerprints, like one using SHA-1, one using SHA-256, one using MD5 ...
 The SKID is used to create the trust chain not based on the certificate subject and issuer but on the certificate SKID and authority key identifier (AKID). This makes it easier to deal with situations where the same subject string is used with multiple CA certificates. While the RFC 3280 describes common ways to generate SKID the only real requirement is that the SKID of the CA certificate must match the AKID in all certificates issued by this CA.

@@ Line 17: / Line 17: @@
          X509v3 Authority Key Identifier:
              keyid:BB:AF:7E:02:3D:FA:A6:F1:3C:84:8E:AD:EE:38:98:EC:D9:32:32:D4
      ----
      ...
      Issuer: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority