I have an X509Certificate (say Certificate-A) for signing purpose. While validating this certificate, I have to check its path with Intermediate & Root certificate which I have implemented fully.

There is a custom extension in this Certificate-A which has a another signature as its value. While validating this Certificate-A, I am taking the signature from it's custom extension & do verify it with another Certificate-B that produced it. This all is being done well.

Now is there a way to add some Policy to Certificate-A by which a third party validator comes to know by reading this Policy (ONLY) that it has to take signature from Certificate-A & verify with Certificate-B?

Note- Certificate-A & B would be already available to third party validator (Certificate List in a PKCS#7 Signature).

1 Answer 1


By definition, "custom extensions" are custom: they are understood only by implementations which have been made aware of them; all other implementations consider such extensions as "unknown" and ignore them (unless the extension is marked "critical", in which case the implementations which do not recognize the extension must reject the complete certificate).

There is no standard method to encode within a certificate instructions about the processing of an unknown extension. The standard behaviour (ignore or reject, depending on the "critical" flag) is all you will get. Strangely enough, people who design X.509 have not (yet) made the validation algorithm Turing-equivalent (although no doubt some have been tempted to).

A consequence is that non-critical custom extensions are mostly comments (since they will be ignored by third-party implementations), while critical custom extensions make the certificates application-specific (since third-party implementations will refuse to process them).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .