This article is new for CM 8.15.
A hybrid CA carries two keys — a primary and an alternative — and signs with both, according to Recommendation ITU-T X.509 (10/19) | ISO/IEC 9594-8 (also called Chimera or Catalyst). A CRL issued by a hybrid CA carries the alternative signature alongside the primary one, in the following extensions:
-
id-ce-altSignatureAlgorithm 2.5.29.73 — the algorithm of the alternative signature
-
id-ce-altSignatureValue 2.5.29.74 — the alternative signature value
Creating a hybrid CRL
A hybrid CRL is created exactly like a standard CRL
follow steps here: Create CRL procedure in Certificate Manager.
The only difference is the CRL issuer: select a hybrid-capable CA (see Create Hybrid CA in Certificate Manager).
When the selected CRL issuer is a hybrid-capable CA, an Alternative signature option with a Disable checkbox appears in the CRL procedure. No special CRL format is required — any CRL format detects the hybrid CA and adds the alternative signature accordingly.
-
Enabled (default) — the CRL is hybrid and carries both the primary and the alternative signature.
-
Disable checked — a standard CRL is produced, with the primary signature only.
If the CRL issuer is not a hybrid-capable CA, the option is not shown and a standard CRL is always produced.
Related information