Which certificate value can FortiGate use to determine the relationship between the issuer and the certificate?

FortiGate, like other systems implementing Public Key Infrastructure (PKI), builds and validates certificate chains by linking a certificate to its issuer. This is primarily achieved using the Authority Key Identifier (AKI) and Subject Key Identifier (SKI) extensions. The AKI extension within a signed certificate contains a value that matches the SKI value of the issuing Certificate Authority's (CA) certificate. This direct correspondence allows FortiGate to unambiguously identify the specific issuer certificate and key used for signing, which is essential for constructing the correct chain of trust.

B. S/MIME Capabilities value: This extension is specific to the S/MIME standard and describes the cryptographic capabilities of an email client, not the issuer-subject relationship in a certificate chain.

C. Subject value: The Subject field identifies the entity to whom the certificate is issued. While the Issuer field of this certificate must match the Subject field of the CA's certificate, the SKI provides a more precise link to the specific key used.

D. Subject Alternative Name value: This extension lists additional identities (like hostnames or IP addresses) for the certificate's subject, but it does not provide any information about the certificate's issuer.

1. Fortinet FortiOS 7.0.1 Handbook - Public Key Infrastructure: In the "Certificate verification" section

it states

"The Authority Key Identifier (AKI) extension in a certificate points to the Subject Key Identifier (SKI) of the certificate that signed it. This allows the FortiGate to build the certificate chain of trust." (p. 21).

2. IETF RFC 5280 - Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile:

Section 4.2.1.1

"Authority Key Identifier

" explains that this extension identifies the public key used to sign a certificate

typically by referencing the issuer's Subject Key Identifier.

Section 4.2.1.2

"Subject Key Identifier

" defines this extension as a means of identifying certificates that contain a particular public key

which is then referenced by the AKI of certificates it issues.