java - 如果使用jdk7，是否必须在证书中包含keyusage

Question

我使用的是jdk1.7。我正在使用自签名证书进行 SSL 握手。如果我使用 jdk1.7，是否必须在证书中包含 keyusage。请让我知道我很困惑。

谢谢，拉胡尔

Answer 1

这就是 RFC 5280说:

Conforming CAs MUST include this extension in certificates that
contain public keys that are used to validate digital signatures on
other public key certificates or CRLs. When present, conforming CAs
SHOULD mark this extension as critical.

但是，RFC 6818 ，这是 RFC 5280 的更新，内容如下:

Consistent with Section 3.4.61 of X.509 (11/2008) [X.509], we notethat use of self-issued certificates and self-signed certificatesissued by entities other than CAs are outside the scope of thisspecification. Thus, for example, a web server or client mightgenerate a self-signed certificate to identify itself. Thesecertificates and how a relying party uses them to authenticateasserted identities are both outside the scope of RFC 5280.

因此，如果您以 CA 的身份行事，则应包括 key 使用情况。无论如何，包含它可能是一个好主意，尽管根据上面的段落并没有严格要求它。