Internet X.509 PKI Certificate and CRL Profile

Note

IETF specification defining the profile of X.509 v3 certificates and X.509 v2 certificate revocation lists for the Internet, with a path validation algorithm.

Summary

Purpose

IETF RFC 5280 (May 2008) profiles, for the Internet, the X.509 version 3 certificate and the X.509 version 2 certificate revocation list (CRL):

It describes the certificate format, its standard extensions, the CRL format and a certification path validation algorithm RFC 5280, Abstract.

Who it applies to

The RFC itself imposes nothing under eIDAS. Three acts in the corpus refer to it, each with its own scope.

• Qualified certificates. Implementing Regulation 2025/1943 sets the reference standards for qualified certificates for electronic signatures (Annex I) and for electronic seals (Annex II) Art. 1. In both annexes, an adaptation of standard ETSI EN 319 412-2 refers to the RFC Annex I Annex II. A qualified certificate that meets these standards, specifications and procedures is “presumed” to comply with the requirements of Annex I (signature) or Annex III (seal) of Regulation 910/2014 Art. 28(6) Art. 38(6).
• Conformity assessment reports. Implementing Regulation 2025/2162 provides that the conformity assessment report on qualified trust service providers complies with the specifications in its Annex III Art. 7(1). That annex uses notions defined in the RFC Annex III.
• Trusted lists. Implementing Decision 2015/1505 requires Member States to have trusted lists that comply with its Annex I Art. 1. Where a human-readable version is established and published, it displays at least certain certificate fields, including the “CRL Distribution Points”, with a footnote referring to RFC 5280 Annex I.

Key points

• Unique serial number. The adaptation in 2025/1943 (requirement GEN-4.2.6-01) requires each certificate issued by the provider to have a unique serial number, within the meaning of clause 4.1.2.2 of the RFC Annex I. That clause requires a positive integer, unique for each certificate issued by a given certification authority, and of no more than 20 octets RFC 5280, § 4.1.2.2. Serial Number.
• Subject Key Identifier. Where the qualified trust service is based on a public key infrastructure (PKI), the assessment report lists its digital identities, in particular by the Subject Key Identifier defined in the RFC Annex III. Where applicable, it also describes the PKI hierarchy and identifies each certification authority by that same identifier Annex III. This extension makes it possible to identify the certificates that contain a particular public key RFC 5280, § 4.2.1.2. Subject Key Identifier.
• Certificate policies. In this description of the hierarchy, provided where applicable, the report gives, for each set of certificates of an issuing authority, identification criteria: either the policy identifiers contained in the certificate policy extension defined in the RFC, or other criteria set out in the implementing acts on trusted lists Annex III Art. 22(5). In the RFC, this extension contains one or more policy object identifiers (OIDs) RFC 5280, § 4.2.1.4. Certificate Policies.
• CRL distribution points. This extension identifies how revocation information is obtained RFC 5280, § 4.2.1.13. CRL Distribution Points.

Clauses referred to by the acts

• Clause 4.1.2.2 (serial number): named by requirement GEN-4.2.6-01, in the adaptation of standard EN 319 412-2, Annexes I and II of Implementing Regulation 2025/1943 Annex I Annex II.
• Subject Key Identifier and certificate policy extension: reference to the RFC without a clause number, Annex III of Implementing Regulation 2025/2162 Annex III.
• CRL distribution points: general reference, through a footnote, Implementing Decision 2015/1505 Annex I.

Links

• Acts that refer to it: Implementing Regulations 2025/1943 Implementing Regulation (EU) 2025/1943 and 2025/2162 Implementing Regulation (EU) 2025/2162, Implementing Decision 2015/1505 Implementing Decision (EU) 2015/1505 — consolidated version of 29/04/2026.
• Intermediate standard: ETSI EN 319 412-2 ETSI EN 319 412-2 V2.4.1.
• Related standards: RFC 3739, qualified certificates profile RFC 3739; ETSI TS 119 612, trusted lists, cited by Annex III of Implementing Regulation 2025/2162 ETSI TS 119 612 V2.4.1 Annex III.
• Learning path: step 4, trust services.

Written by Asphalia.