Nexus Certificate Manager

Create Hybrid CRLs in Certificate Manager

This article is new for CM 8.15.

A hybrid CA carries two keys — a primary and an alternative — and signs with both, according to Recommendation ITU-T X.509 (10/19) | ISO/IEC 9594-8 (also called Chimera or Catalyst). A CRL issued by a hybrid CA carries the alternative signature alongside the primary one, in the following extensions:

  • id-ce-altSignatureAlgorithm 2.5.29.73 — the algorithm of the alternative signature

  • id-ce-altSignatureValue 2.5.29.74 — the alternative signature value

Creating a hybrid CRL

A hybrid CRL is created exactly like a standard CRL

follow steps here: Create CRL procedure in Certificate Manager.

The only difference is the CRL issuer: select a hybrid-capable CA (see Create Hybrid CA in Certificate Manager).

When the selected CRL issuer is a hybrid-capable CA, an Alternative signature option with a Disable checkbox appears in the CRL procedure. No special CRL format is required — any CRL format detects the hybrid CA and adds the alternative signature accordingly.

  • Enabled (default) — the CRL is hybrid and carries both the primary and the alternative signature.

  • Disable checked — a standard CRL is produced, with the primary signature only.

If the CRL issuer is not a hybrid-capable CA, the option is not shown and a standard CRL is always produced.

Last updated: