This schema specifies the XML namespace:
http://lxistandard.org/schemas/LXICertificateRequest/1.0,
version: 1.0
Editorial date: September 28, 2023
LXICertificateRequest contains attributes that a client may request be used for a device certificate.
The LXICertificateRequest complex type has no attributes
The following must occur in this order:
| Element | Type | Cardinality | Requirements |
|---|---|---|---|
| SubjectName | lxi:SubjectName | Optional |
SubjectName specifies the attributes of the distinguished name to be used in the subject of the certificate. The subject of the certificate indicates the identity of the LXI device. |
| AltDnsName | xs:string | Optional unbounded |
AltDnsName specifies the alternate DNS name to be used in the certificate. |
| AltIPAddress | xs:string | Optional unbounded |
AltIPAddress specifies the alternate IP Address to be used in the certificate. Multiple IP addresses may be specified as a comma separated list. |
| ExpirationDateTime | xs:string | Optional |
ExpirationDateTime indicates the time at which the requested certificate will expire. RULE: The expiration date and time shall be expressed in ASN.1 format using ASN.1 GeneralizedTime per RFC5280. OBSERVATION: The device will need to convert GeneralizedTime to UTC time if the year is between 1950 and 2050. |
| SignatureAlgorithm | xs:string | Optional |
SignatureAlgorithm specifies the signature algorithm that the certificate keyset should use. The string is the Object IDentifier (OID) string specified in RFC 3279 or its hierarchy of successors. The OID uniquely identifies the signature algorithm and is a string of integers separated by decimal points. For instance the OID string for SHA256 with RSA Encryption is "1.2.840.113549.1.1.11". Vendors are encouraged to use state of the art cryptographic algorithms when generating certificates or signing requests and thus keep the software up-to-date. Failure to do so may result in devices being easily compromised. For instance, the MD5 and SHA-1 algorithms have been deprecated and are known to be inadequate and should not be used to generated new certificates or sign requests. However, existing certificates should be supported. If absent the signature algorithm is device dependent. This differs from sending an empty string which produces an error. RULE: If the device does not support the requested signature algorithm, then the certificate request shall fail. The returned LXIProblemDetails/Title element shall contain an indication that the SignatureAlgorithm was invalid. The LXIProblemDetails/Instance shall have a comma separated list of accepted values. OBSERVATION: Clients can determine the supported signature algorithms by sending the SignatureAlgorithm element with an empty string for the SignatureAlgorithm. The LXICertificateRequest schema with the SignatureAlgorithm is used in both the LXI Create Certificate API and LXI CSR GET API.
|
| CertificateExtension | lxi:CertificateExtension | Optional unbounded |
CertificateExtension permits the user to request arbitrary certificate fields based on the object identifier and field values. |
SubjectName contains the various attributes of the requested certificate subject.
RULE: The default fields for the subject name shall be the values used in the device IDevID.
The SubjectName complex type has no attributes
The following must occur in this order:
| Element | Type | Cardinality | Requirements |
|---|---|---|---|
| CommonName | xs:string | Optional |
CommonName specifies the common name subject attribute. |
| Organization | xs:string | Optional |
Organization specifies the organization subject attribute. |
| OrganizationalUnit | xs:string | Optional unbounded |
OrganizationUnit specifies the organization unit subject attribute. |
| Locality | xs:string | Optional |
Locality specifies the locality subject attribute. |
| State | xs:string | Optional |
State specifies the state subject attribute. |
| Country | xs:string | Optional |
Country specifies the country subject attribute. |
| SerialNumber | xs:string | Optional |
SerialNumber specifies the serial number subject attribute. |
| ExtraSubjectAttribute | lxi:ExtraSubjectAttribute | Optional unbounded |
ExtraSubjectAttribute specifies additional subject attributes not included in LXICertificateRequest using the Object ID and value. |
The ExtraSubjectAttribute complex type has no attributes
The following must occur in this order:
| Element | Type | Cardinality | Requirements |
|---|---|---|---|
| ObjectID | xs:string | Required |
ObjectID is the object ID that indicates the subject attribute as specified by the OpenGroup. The format of this string is a series of dot-separated integers. RULE: ObjectID shall be included. |
| ObjectValue | xs:string | Required |
ObjectValue is the subject value associated with the specified attribute. RULE: ObjectValue shall be included. |
The CertificateExtension complex type has no attributes
The following must occur in this order:
| Element | Type | Cardinality | Requirements |
|---|---|---|---|
| ObjectID | xs:string | Required |
ObjectID is the object ID that indicates the certificate extension as specified by the OpenGroup. The format of this string is a series of dot-separated integers. RULE: ObjectID shall be included. |
| Critical | xs:boolean | Optional |
Critical indicates that this certificate extension is critical. |
| ObjectValue | xs:base64Binary | Required |
ObjectValue is the subject value associated with the certificate field. RULE: ObjectValue shall be included. |