Is it possible to include multiple public keys and the issuer's public key in one x509v3-certificate?



X509v3 as per RFC 5280, section 4.1 only allows a single subjectPublicKeyInfo field.

And this is the field that contains the public key. So no, you only get one.

MPK proposal didn't make it.

It seems that there was a proposal to introduce a Multiple-Public-Key (MPK) Certificate Format in 2001, but it never led anywhere.

| improve this answer | |

According to RFC 2459, the public key is encoded as a sequence, which means that more than one should be possible. I don't think it is common, and I don't know if all software would handle such a certificate correctly.

The issuer's public key must be in a separate certificate, because it doesn't match your subject name. If the certificate is encoded in PEM format, you can often simply concatenate your own certificate, and the issuer's, into a single file.

| improve this answer | |
  • It is a SEQUENCE, not a SEQUENCE OF. So it is not "naturally" extensible to multiple public keys. The SubjectPublicKeyInfo structure contains an AlgorithmIdentifier that identifies the algorithm, then the public key value as a BIT STRING. If you want to include several keys, you should define a new identifier for an algorithm that says "several keys", then a new syntax for the value that will include the keys. Neither of this is currently defined, so it has zero chance of being already supported. – Thomas Pornin Oct 26 '15 at 12:39
  • @Kevin Keane Sorry, Thomas and Stackz are right... I made the same mistake as you...^^ – K. Biermann Oct 26 '15 at 12:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.