To limit the maximum size of the distribution files, a CIL is built and distributed in several segments. The segment size is specified in the CIL procedure (see Create CIL procedure in Certificate Manager). Once a segment reaches the specified size its content will not change until the CIL procedure is changed. The current (last) segment is issued on regular basis.
A CIL with a segment size 0 will contain all certificates issued in a single file and can be seen as the CIL representation of a complete CRL. In this article, a complete CIL is referred to as the CIL representation of a complete CRL.
When the segment number is a positive integer greater than 0, all CIL segments together are handled like a single, complete CIL with a certain version and number. The CIL number changes with every new issuance of the list just as the CRL number. If the segment size is changed then all segments will be reissued again with a new segment version value.
A CIL segment is identified with the critical CilDistributionSegment
extension.
CilDistributionSegment extension
Besides common CRL extensions, like the CRL number and delta related extensions, a CIL related format always includes the critical CilDistributionSegment
extension.
The CIL distribution segment contains the following information:
The segment version | The segment version (1..m). If the segmentation size is changed then this field must be increased and all segments of the CIL must be re-issued. The version number of the CIL procedure can be used as value. All segments must have the same version value when issuing and assembling a CIL. |
---|
The segment number | The segment number (1..n). The segments of a CIL are numbered from 1 to n, where 1 to n-1 are full segments and n is the number of the current segment. |
---|
The full segment indicator | All full segments (that is, all segments except the current) must have completeSegment=true and the current segment must have completeSegment=false .
Although the parameter is called completeSegment , a CIL segment that is "complete" is referred to as a full CIL segment, to avoid confusion with the definition of a complete CIL.
|
---|
The only activated certificates indicator | If the scope of the CIL only includes OCSP activated certificates, then onlyActivatedCerts must be set to true. The following ASN.1 structure defines the CilDistributionSegment :
CODE
id-cm-internal OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6)
internet(1) private(4) enterprise(1)
technologynexus(31086)
certificate-manager(10) 1 }
id-cilDistributionSegment OBJECT IDENTIFIER ::= { id-cm-internal 2 }
CilDistributionSegment ::= SEQUENCE {
segmentVersion INTEGER,
segmentNumber INTEGER,
completeSegment BOOLEAN DEFAULT FALSE,
onlyActivatedCerts [0] BOOLEAN DEFAULT FALSE,
...
}
|
---|
A delta CIL is not segmented and its segment number is set to zero. See section "Encoding" below.
Current segment
Full segments in CIL are static segments that do not change. The current segment is the last segment that is not full yet. It is updated with new certificate entries when issuing a CIL. This segment defines the next update of the CIL and the CIL number. See section "Encoding" below.
Since full segments do not change, CM normally only builds and distributes the current segment.