Required Authority key identifiers are required elements in end entity certificates to properly establish the trust chain.
CRL Distribution Points
URI:http://{crl-server}{:crl-port}{/crl-path}
URI:ldap://{crl-server}{:crl-port}{/crl-dn} URLS and DNs that identify the location of CRLs in LDAP directories can be complex. Entities must be able to handle characters as defined by the LDAP URI specification in RFC 4516.
Recommended
Recommended
Extended Key Usage
id-kp-serverAuth = 1.3.6.1.5.5.7.3.2.1
id-kp-clientAuth = 1.3.6.1.5.5.7.3.2.2
id-kp-sipDomain = 1.3.6.1.5.5.7.3.20
Required
Optional Required if the same Identity Certificate is used when the server is acting as a client.
Contraindicated Validation of the presence of the id-kp-sipDomain extended key usage as described in RFC 5924 is discouraged, as it limits use of the certificate to SIP only and forces certificate proliferation.
Key Usage
digitalSignature
nonRepudiation
keyEncipherment
dataEncipherment
All values are Optional. Values may vary as specified in RFC 5280 and RFC 3279.
Subject
CN={fqdn}
Required
Subject Alternative Name
IP:{ip}
URI:sip:{domain}
DNS:{domain}
DNS:{fqdn}
Optional
Required The SIP domain may not be known at install time, so the URI:sip:{domain} Subject Alternative Name value suggested by RFC 5922 is not likely to be present.
Required See Footnote 6. Also, the 96xx endpoints require the SIP domain to be present in the CN or as a DNS:{domain} entry in the Subject Alternative Name field.
