Is it possible to include multiple public keys and the issuer's public key in one x509v3-certificate?
No.
X509v3 as per RFC 5280, section 4.1 only allows a single subjectPublicKeyInfo
field.
And this is the field that contains the public key. So no, you only get one.
MPK proposal didn't make it.
It seems that there was a proposal to introduce a Multiple-Public-Key (MPK) Certificate Format in 2001, but it never led anywhere.
According to RFC 2459, the public key is encoded as a sequence, which means that more than one should be possible. I don't think it is common, and I don't know if all software would handle such a certificate correctly.
The issuer's public key must be in a separate certificate, because it doesn't match your subject name. If the certificate is encoded in PEM format, you can often simply concatenate your own certificate, and the issuer's, into a single file.
-
It is a
SEQUENCE
, not aSEQUENCE OF
. So it is not "naturally" extensible to multiple public keys. TheSubjectPublicKeyInfo
structure contains anAlgorithmIdentifier
that identifies the algorithm, then the public key value as aBIT STRING
. If you want to include several keys, you should define a new identifier for an algorithm that says "several keys", then a new syntax for the value that will include the keys. Neither of this is currently defined, so it has zero chance of being already supported. – Thomas Pornin Oct 26 '15 at 12:39 -
@Kevin Keane Sorry, Thomas and Stackz are right... I made the same mistake as you...^^ – K. Biermann Oct 26 '15 at 12:51