Re: [lamps] struggling with CSRAttrs

[Russ Housley <[e-mail]>]

David:

> I believe we should clarify that 
> There MUST be at most one attribute describing X.509 extensions,
> i.e., one bearing the OID extensionRequest (1.2.840.113549.1.9.14) as its type.
> The set in such an X.509 extension value MUST contain exactly one element.
> The value of such an attribute MUST be of type Extensions, i.e., a sequence of Extension.
Those all make sense to me.

Recall that the syntax for Extension is:

	Extension  ::=  SEQUENCE  {
	     extnID      OBJECT IDENTIFIER,
	     critical    BOOLEAN DEFAULT FALSE,
	     extnValue   OCTET STRING
                 -- contains the DER encoding of an ASN.1 value
                 -- corresponding to the extension type identified
                 -- by extnID
	     }

I suggest an additional bullet:

 * An extnID object identifier MUST appear at most once in the extensionRequest attribute.

Russ