Constants for Netscape Extensions

The following Netscape extensions are used with encode and decode operations. The Netscape predefined constants and object identifier strings are not be used directly with the encoding or decoding functions, CryptEncodeObject, CryptEncodeObjectEx, CryptSignAndEncodeCertificate, CryptDecodeObject, or CryptDecodeObjectEx. Instead, these extensions require the use of the lpszStructType shown.

For additional details that apply to some Netscape extensions, see the remarks following the table.

For all encoding functions that use either the X509_ANY_STRING or the X5O9_UNICODE_ANY_STRING lpszStructType, X509_ANY_STRING is used if the string format in the Value member's pbData member is ASCII, and X509_UNICODE_ANY_STRING is used if the string format is UNICODE. In the Unicode case, the string must be converted to an IA5_STRING before encoding by setting the dwValueType member of the CERT_NAME_VALUE structure to CERT_RDN_IA5_STRING.

For decoding functions, the user selects the format of the output string. Use X509_ANY_STRING if the desired string format is ASCII, and X509_UNICODE_ANY_STRING if the desired string format is Unicode.

For the szOID_NETSCAPE_CERT_RENEWAL_URL extension, the data structure contains a relative or absolute URL that points to a certificate renewal form. The renewal form will be accessed with an HTTP GET method using a URL that is the concatenation of the renewal-URL and certificate-serial-number. The certificate-serial-number is encoded as a string of ASCII hexadecimal digits. For example, if the netscape-base-url is https://certification authority URL/, the netscape-cert-renewal-url is cgi-bin/check-renew.cgi?, and the certificate serial number is 173420, the resulting URL would be: https://certification authority URL/cgi-bin/check-renew.cgi?02a56c. The document returned should be an HTML form that will allow the user to request a renewal of their certificate.

For the szOID_NETSCAPE_CERT_SEQUENCE extension using X509_ASN_ENCODING, the certificate is encoded as a PKCS_CONTENT_INFO structure wrapping a sequence of ANY. The value of the contentType member is pszObjId, while the content field is the following structure:

SequenceOfAny ::= SEQUENCE OF ANY

The CRYPT_DER_BLOBs in the CRYPT_CONTENT_INFO_SEQUENCE_OF_ANY's rgValue member point to encoded X509 certificates.

For szOID_NETSCAPE_CERT_TYPE extensions, the following bits are defined.

For the szOID_NETSCAPE_REVOCATION_URL extensions, a relative or absolute URL can be used to check the revocation status of a certificate. The revocation check will be performed as an HTTP GET method using a URL that is the concatenation of revocation-URL and certificate-serial-number. The certificate-serial-number is encoded as a string of ASCII hexadecimal digits. For example, if the netscape-base-url is https://www.certs-r-us.com/, the netscape-revocation-url is cgi-bin/check-rev.cgi?, and the certificate serial number is 173420, the resulting URL would be: https://www.certs-r-us.com/cgi-bin/check-rev.cgi?02a56c.

The server should return a document with a Content-Type of application/x-netscape-revocation. The document should contain a single ASCII digit, "1" if the certificate is not currently valid, and "0" if it is currently valid.

Note that for all of the URLs that include the certificate serial number, the serial number will be encoded as a string that consists of an even number of hexadecimal digits. If the number of significant digits is odd, the string will have a single leading zero to ensure an even number of digits is generated.