Certificate Issuance List - CIL

In comparison to a CRL, that lists all revoked certificates, a CIL contains all certificates issued by the signing CA. Expired certificates are not removed and therefore the list contains a definite statement whether a specific certificate serial number has ever been issued. Together with CRLs, CILs are used to support the extended revoked definition in OCSP as defined in RFC 6960 X.509 Internet Public Key Infrastructure Online Certificate Status Protocol – OCSP.

The goal of the CIL is to enable applications, like Nexus OCSP Responder, to verify in an efficient way that a given certificate serial number has been issued without having to contact the CA. This establishes a common understanding of the concept of CILs.

The scope of a CIL is either the set of all certificates that have ever been issued by the CA or the sub-set of those certificates that have been OCSP activated. Only one CIL, that is, one scope, can be configured for each CA subject name. The issuer of a CIL is also the issuer of all certificates listed in the CIL. The responsibility is not delegated to any other authority, trusted or not. Therefore no indirect CILs are issued.

As for CRL, CIL supports deltas. A delta references to a base, complete CIL and contains all certificates that have been issued since the status of the base CIL. As for complete CILs, deltas are signed by the same CA as the certificates it contains. A private extension, the CilDistributionSegment extension distinguishes the CIL from a CRL. See section "Segmentation" below.

To limit the maximum size of the distribution files, a CIL is built and distributed in several segments. The segment size is specified in the CIL procedure (see Create CIL procedure in Certificate Manager). Once a segment reaches the specified size its content will not change until the CIL procedure is changed. The current (last) segment is issued on regular basis.

A CIL with a segment size 0 will contain all certificates issued in a single file and can be seen as the CIL representation of a complete CRL. In this article, a complete CIL is referred to as the CIL representation of a complete CRL.

When the segment number is a positive integer greater than 0, all CIL segments together are handled like a single, complete CIL with a certain version and number. The CIL number changes with every new issuance of the list just as the CRL number. If the segment size is changed then all segments will be reissued again with a new segment version value.

A CIL segment is identified with the critical CilDistributionSegment extension.

CilDistributionSegment extension

Besides common CRL extensions, like the CRL number and delta related extensions, a CIL related format always includes the critical CilDistributionSegment extension.

The CIL distribution segment contains the following information:

The segment version	The segment version (1..m). If the segmentation size is changed then this field must be increased and all segments of the CIL must be re-issued. The version number of the CIL procedure can be used as value. All segments must have the same version value when issuing and assembling a CIL.
The segment number	The segment number (1..n). The segments of a CIL are numbered from 1 to n, where 1 to n-1 are full segments and n is the number of the current segment.
The full segment indicator	All full segments (that is, all segments except the current) must have completeSegment=true and the current segment must have completeSegment=false. Although the parameter is called completeSegment, a CIL segment that is "complete" is referred to as a full CIL segment, to avoid confusion with the definition of a complete CIL.
The only activated certificates indicator	If the scope of the CIL only includes OCSP activated certificates, then onlyActivatedCerts must be set to true. The following ASN.1 structure defines the CilDistributionSegment: CODE id-cm-internal OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) technologynexus(31086) certificate-manager(10) 1 } id-cilDistributionSegment OBJECT IDENTIFIER ::= { id-cm-internal 2 } CilDistributionSegment ::= SEQUENCE { segmentVersion INTEGER, segmentNumber INTEGER, completeSegment BOOLEAN DEFAULT FALSE, onlyActivatedCerts [0] BOOLEAN DEFAULT FALSE, ... }

A delta CIL is not segmented and its segment number is set to zero. See section "Encoding" below.

Current segment

Full segments in CIL are static segments that do not change. The current segment is the last segment that is not full yet. It is updated with new certificate entries when issuing a CIL. This segment defines the next update of the CIL and the CIL number. See section "Encoding" below.

Since full segments do not change, CM normally only builds and distributes the current segment.

The X.509 v2 CRL syntax is used to encode a CIL. The following field and extension are only used in the current segment.

• Next Update
• CRL Number

This table shows the usage of the different fields in the segmentation of a CIL:

A complete and valid CIL consists of n segments with the same segment version, where:

1. The current segment (n) is valid (nextUpdate) and
2. Optional n-1 complete segments, numbered 1 to n-1.

Or

1. A delta CIL which is valid (nextUpdate) and
2. A base complete CIL, constructed from n segments or delta recursion.