Key Management Interoperability Protocol Specification Version 1.1

SHALL always have a valueInitially set byModifiable by serverModifiable by clientDeletable by clientMultiple instances permittedWhen implicitly setApplies to Object TypesYesServerNoNoNoNoRegister, Certify, Re-certifyCertificates594595596597598Table 53: Certificate Type Attribute Rules3.9 Certificate LengthThe length in bytes of the Certificate object. The Certificate Length SHALL be set by the server when theobject is created or registered, and then SHALL NOT be changed or deleted before the object isdestroyed.ObjectCertificate LengthIntegerEncoding599Table 54: Certificate Length AttributeSHALL always have a valueInitially set byModifiable by serverModifiable by clientDeletable by clientMultiple instances permittedWhen implicitly setApplies to Object TypesYesServerNoNoNoNoRegister, Certify, Re-certifyCertificates600601602603604605606607608Table 55: Certificate Length Attribute Rules3.10 X.509 Certificate IdentifierThe X.509 Certificate Identifier attribute is a structure (see Table 56) used to provide the identification ofan X.509 public key certificate. The X.509 Certificate Identifier contains the Issuer Distinguished Name(i.e., from the Issuer field of the X.509 certificate) and the Certificate Serial Number (i.e., from the SerialNumber field of the X.509 certificate). The X.509 Certificate Identifier SHALL be set by the server whenthe X.509 certificate is created or registered and then SHALL NOT be changed or deleted before theobject is destroyed.Object Encoding REQUIREDX.509 Certificate Identifier StructureIssuer DistinguishedNameCertificate SerialNumberByte StringByte Stringkmip-spec-v1.1-cos01 21 September 2012Standards Track Work Product Copyright © OASIS Open 2012. All Rights Reserved. Page 38 of 164YesYes