RFC 2559 (rfc2559) - Page 2 of 13

Internet X

RFC 2559          PKIX Operational Protocols - LDAPv2         April 1999


   modify PKI information in a repository. A profile based on the LDAP
   version 2 protocol is provided to satisfy these requirements.

3.  Model

   The PKI components, as defined in PKIX Part 1, which are involved in
   PKIX operational protocol interactions include:

      -  End Entities
      -  Certification Authorities (CA)
      -  Repository

   End entities and CAs using LDAPv2, retrieve PKI information from the
   repository using a subset of the LDAPv2 protocol.

   CAs populate the repository with PKI information using a subset of
   the LDAPv2 protocol.

4.  Lightweight Directory Access Protocol (LDAP)

   The following sections examine the retrieval of PKI information from
   a repository and management of PKI information in a repository. A
   profile of the LDAPv2 protocol is defined for providing these
   services.

   Section 5 satisfies the requirement to retrieve PKI information (a
   certificate, CRL, or other information of interest) from an entry in
   the repository, where the retrieving entity (either an end entity or
   a CA) has knowledge of the name of the entry. This is termed
   "repository read".

   Section 6 satisfies the same requirement as 5 for the situation where
   the name of the entry is not known, but some other related
   information which may optionally be used as a filter against
   candidate entries in the repository, is known.  This is termed
   "repository search".

   Section 7 satisfies the requirement of CAs to add, delete and modify
   PKI information information (a certificate, CRL, or other information
   of interest)in the repository. This is termed "repository modify".

   The subset of LDAPv2 needed to support each of these functions is
   described below.  Note that the repository search service is a
   superset of the repository read service in terms of the LDAPv2
   functionality needed.

   Note that all tags are implicit by default in the ASN.1 definitions
   that follow.



Boeyen, et al.              Standards Track