GB/T 19771-2005 in English

《GB/T 19771-2005信息技术 安全技术 公钥基础设施 PKI 组件最小互操作规范》由TC260（全国网络安全标准化技术委员会）归口，主管部门为国家标准化管理委员会
本标准支持大规模公钥基础设施（PKI负责发布、撤销和管理用于数字签名及密钥管理的公钥证书）的互操作性。本标准为不同的PKI开发者所开发的组件产品提供了基本的互操作性参考。

Scope

This standard supports the interoperability of large-scale public key infrastructure (PKI is responsible for issuing, revoking and managing public key certificates for digital signature and key management). This standard provides a basic interoperability reference for component products developed by different PKI developers. The content of this standard involves: · Public key certificate generation, renewal and revocation; · Signature generation and verification; · Certificate and certificate certification path verification. This standard mainly includes the description of certificates, certificate revocation list (CRL) extensions and a set of transactions. These transactions include certificate requests, certificate renewals, certificate revocations, and retrieval of certificates and CRLs from repositories. This standard mainly looks at the interoperability of PKI from the perspective of end users, that is, how to apply for and obtain a certificate; how to sign documents, how to retrieve other people's certificates; how to verify signatures. As mentioned below, the "internal" operating specifications of PKI have not yet reached sufficient maturity, so they are not specified in detail. In this standard, PKI is divided into five components: Certificate Authority (Cas) that issues and revokes certificates; Registration Authority (Ras) that ensures the binding between the public key and the identity of the certificate holder and other attributes; · Certificate holders who obtain certificates and sign documents; · Clients who verify signatures and execute key management protocols and verify certificate certification paths; · Store and provide databases for certificate and CRL queries.