DEREncodable

     crossCertificatePairATTRIBUTE::={
       WITH SYNTAX   CertificatePair
       EQUALITY MATCHING RULE certificatePairExactMatch
       ID joint-iso-ccitt(2) ds(5) attributeType(4) crossCertificatePair(40)}
 

The forward elements of the crossCertificatePair attribute of a CA's directory entry shall be used to store all, except self-issued certificates issued to this CA. 

 CompleteRevocationRefs ::= SEQUENCE OF CrlOcspRef
 

 CRLListID ::= SEQUENCE {
     crls SEQUENCE OF CrlValidatedID }
 

 CrlValidatedID ::= SEQUENCE {
   crlHash OtherHash,
   crlIdentifier CrlIdentifier OPTIONAL }
 

   id-it-caProtEncCert    OBJECT IDENTIFIER ::= {id-it 1}
      CAProtEncCertValue      ::= CMPCertificate
   id-it-signKeyPairTypes OBJECT IDENTIFIER ::= {id-it 2}
     SignKeyPairTypesValue   ::= SEQUENCE OF AlgorithmIdentifier
   id-it-encKeyPairTypes  OBJECT IDENTIFIER ::= {id-it 3}
     EncKeyPairTypesValue    ::= SEQUENCE OF AlgorithmIdentifier
   id-it-preferredSymmAlg OBJECT IDENTIFIER ::= {id-it 4}
      PreferredSymmAlgValue   ::= AlgorithmIdentifier
   id-it-caKeyUpdateInfo  OBJECT IDENTIFIER ::= {id-it 5}
      CAKeyUpdateInfoValue    ::= CAKeyUpdAnnContent
   id-it-currentCRL       OBJECT IDENTIFIER ::= {id-it 6}
      CurrentCRLValue         ::= CertificateList
   id-it-unsupportedOIDs  OBJECT IDENTIFIER ::= {id-it 7}
      UnsupportedOIDsValue    ::= SEQUENCE OF OBJECT IDENTIFIER
   id-it-keyPairParamReq  OBJECT IDENTIFIER ::= {id-it 10}
      KeyPairParamReqValue    ::= OBJECT IDENTIFIER
   id-it-keyPairParamRep  OBJECT IDENTIFIER ::= {id-it 11}
      KeyPairParamRepValue    ::= AlgorithmIdentifer
   id-it-revPassphrase    OBJECT IDENTIFIER ::= {id-it 12}
      RevPassphraseValue      ::= EncryptedValue
   id-it-implicitConfirm  OBJECT IDENTIFIER ::= {id-it 13}
      ImplicitConfirmValue    ::= NULL
   id-it-confirmWaitTime  OBJECT IDENTIFIER ::= {id-it 14}
      ConfirmWaitTimeValue    ::= GeneralizedTime
   id-it-origPKIMessage   OBJECT IDENTIFIER ::= {id-it 15}
      OrigPKIMessageValue     ::= PKIMessages
   id-it-suppLangTags     OBJECT IDENTIFIER ::= {id-it 16}
      SuppLangTagsValue       ::= SEQUENCE OF UTF8String

 where

   id-pkix OBJECT IDENTIFIER ::= {
      iso(1) identified-organization(3)
      dod(6) internet(1) security(5) mechanisms(5) pkix(7)}
 and
      id-it   OBJECT IDENTIFIER ::= {id-pkix 4}
 

 IssuingDistributionPoint ::= SEQUENCE { 
   distributionPoint          [0] DistributionPointName OPTIONAL, 
   onlyContainsUserCerts      [1] BOOLEAN DEFAULT FALSE, 
   onlyContainsCACerts        [2] BOOLEAN DEFAULT FALSE, 
   onlySomeReasons            [3] ReasonFlags OPTIONAL, 
   indirectCRL                [4] BOOLEAN DEFAULT FALSE,
   onlyContainsAttributeCerts [5] BOOLEAN DEFAULT FALSE }
 

 OcspIdentifier ::= SEQUENCE {
     ocspResponderID ResponderID, -- As in OCSP response data
     producedAt GeneralizedTime -- As in OCSP response data
 }
 

 OcspResponsesID ::= SEQUENCE {
    ocspIdentifier OcspIdentifier,
    ocspRepHash OtherHash OPTIONAL
 }
 

 OtherHash ::= CHOICE {
    sha1Hash  OtherHashValue, -- This contains a SHA-1 hash
   otherHash  OtherHashAlgAndValue
  }
 

 OtherRevVals ::= SEQUENCE {
    otherRevValType OtherRevValType,
    otherRevVals ANY DEFINED BY OtherRevValType
 }
 
 OtherRevValType ::= OBJECT IDENTIFIER
 

 PKIFailureInfo ::= BIT STRING {
 badAlg               (0),
   -- unrecognized or unsupported Algorithm Identifier
 badMessageCheck      (1), -- integrity check failed (e.g., signature did not verify)
 badRequest           (2),
   -- transaction not permitted or supported
 badTime              (3), -- messageTime was not sufficiently close to the system time, as defined by local policy
 badCertId            (4), -- no certificate could be found matching the provided criteria
 badDataFormat        (5),
   -- the data submitted has the wrong format
 wrongAuthority       (6), -- the authority indicated in the request is different from the one creating the response token
 incorrectData        (7), -- the requester's data is incorrect (for notary services)
 missingTimeStamp     (8), -- when the timestamp is missing but should be there (by policy)
 badPOP               (9)  -- the proof-of-possession failed
 certRevoked         (10),
 certConfirmed       (11),
 wrongIntegrity      (12),
 badRecipientNonce   (13), 
 timeNotAvailable    (14),
   -- the TSA's time source is not available
 unacceptedPolicy    (15),
   -- the requested TSA policy is not supported by the TSA
 unacceptedExtension (16),
   -- the requested extension is not supported by the TSA
 addInfoNotAvailable (17)
   -- the additional information requested could not be understood
   -- or is not available
 badSenderNonce      (18),
 badCertTemplate     (19),
 signerNotTrusted    (20),
 transactionIdInUse  (21),
 unsupportedVersion  (22),
 notAuthorized       (23),
 systemUnavail       (24),    
 systemFailure       (25),
   -- the request cannot be handled due to system failure
 duplicateCertReq    (26) 
 

    PrivateKeyUsagePeriod ::= SEQUENCE {
      notBefore       [0]     GeneralizedTime OPTIONAL,
      notAfter        [1]     GeneralizedTime OPTIONAL }
 

 RevocationValues ::= SEQUENCE {
    crlVals [0] SEQUENCE OF CertificateList OPTIONAL,
    ocspVals [1] SEQUENCE OF BasicOCSPResponse OPTIONAL,
    otherRevVals [2] OtherRevVals OPTIONAL}
 

     Name ::= CHOICE {
                       RDNSequence }

     RDNSequence ::= SEQUENCE OF RelativeDistinguishedName

     RelativeDistinguishedName ::= SET SIZE (1..MAX) OF AttributeTypeAndValue

     AttributeTypeAndValue ::= SEQUENCE {
                                   type  OBJECT IDENTIFIER,
                                   value ANY }