SubjectKeyIdentifier

SubjectKeyIdentifier is an X.509 v3 certificate extension (OID 2.5.29.14) that provides a compact identifier for the certificate’s subject public key. The extension value is an octet string and is typically included to simplify key lookups and certificate path building. It is usually marked non-critical.

The keyIdentifier contained in this extension is commonly derived as a hash of the subject's public key information. The most common approach is a SHA-1 hash of the SubjectPublicKeyInfo (the DER-encoded public key along with its algorithm). While SHA-1-based forms are prevalent in many deployments, the standard allows alternative methods, and some environments may adopt newer hash algorithms or representations.

Purpose and use

SubjectKeyIdentifier serves to map a certificate to the corresponding public key and to assist in locating the correct certificate in a chain or across a PKI repository. It helps in efficient key lookup during certificate verification, cross-certificate references, and certain protocols that rely on identifying the key material associated with a certificate. Because it is an identifier for the subject’s public key, it can be used in contexts such as validating key continuity across certificate renewals or for matching to an issuer’s authority key identifier.

Relation to other identifiers

The subjectKeyIdentifier complements the AuthorityKeyIdentifier, which identifies the public key of the certificate’s issuer. In a chain, the issuer’s AuthorityKeyIdentifier can be used to find the signing key, while the subjectKeyIdentifier helps locate the certificate containing a particular subject public key. Together, these identifiers aid in certificate management and path construction without requiring name or key material comparisons.