AuthorityKeyIdentifier

AuthorityKeyIdentifier is an X.509 certificate extension used to identify the public key that corresponds to the private key used to sign a certificate. It assists certificate path construction and validation by enabling an application to locate the issuing CA’s certificate within a trust store or chain.

The extension can contain several fields, typically including a keyIdentifier, and optionally authorityCertIssuer and authorityCertSerialNumber. The keyIdentifier is an octet string that uniquely identifies the issuing CA’s public key. The authorityCertIssuer and authorityCertSerialNumber fields, when present, provide additional information to locate the exact issuer certificate, especially in complex PKI deployments with multiple certificates for the same issuer name.

Relation to other identifiers: the keyIdentifier in the AuthorityKeyIdentifier is often the same value as the issuer’s SubjectKeyIdentifier, but this is not guaranteed. The AKI itself is primarily a means to identify the issuer’s public key, while the SKI is a key identifier for the subject’s own public key.

Usage and impact: AKI is used during certificate verification to find the issuer’s certificate in a set of known/trusted certificates or in intermediate certificates presented during a TLS handshake or other PKI operations. It helps handle scenarios with cross-certificates, multiple certificates for a single issuer name, or missing issuer names.

Encoding and specification: The AKI extension has the OID 2.5.29.35 and is defined in RFC 5280. It is typically encoded in DER within the certificate and may be absent if not required by the issuing CA.