Is it possible to include multiple public keys and the issuer's public key in one x509v3-certificate?
No.
X509v3 as per RFC 5280, section 4.1 only allows a single subjectPublicKeyInfo field.
And this is the field that contains the public key. So no, you only get one.
MPK proposal didn't make it.
It seems that there was a proposal to introduce a Multiple-Public-Key (MPK) Certificate Format in 2001, but it never led anywhere.
answered Oct 26 '15 at 12:17
According to RFC 2459, the public key is encoded as a sequence, which means that more than one should be possible. I don't think it is common, and I don't know if all software would handle such a certificate correctly.
The issuer's public key must be in a separate certificate, because it doesn't match your subject name. If the certificate is encoded in PEM format, you can often simply concatenate your own certificate, and the issuer's, into a single file.
-
It is a
SEQUENCE, not aSEQUENCE OF. So it is not "naturally" extensible to multiple public keys. TheSubjectPublicKeyInfostructure contains anAlgorithmIdentifierthat identifies the algorithm, then the public key value as aBIT STRING. If you want to include several keys, you should define a new identifier for an algorithm that says "several keys", then a new syntax for the value that will include the keys. Neither of this is currently defined, so it has zero chance of being already supported. – Thomas Pornin Oct 26 '15 at 12:39 -
@Kevin Keane Sorry, Thomas and Stackz are right... I made the same mistake as you...^^ – K. Biermann Oct 26 '15 at 12:51
