[Q] AuthorityKeyIdentifier Question

[dmitry@xxxxxxxxxxxxxx (Dmitry Dolinsky)]

Hi all,

I have a question about matching authorityCertIssuer in
AuthorityKeyIdentifier extension with authority certificate.

I understand authorityCertIssuer has to match issuer (and/or?)
issuerAltName of the issuer certificate. Since authorityCertIssuer is
GeneralNames and issuer is a Name (distinguished name), in what manner one
should be matched against the other?

Alternatively, if authorityCertIssuer is supposed to be matched only with
issuerAltName, which is GeneralNames, doesn't it mean that presence of
authorityCertIssuer in the subject's certificate requires the presence of
issuerAltName in the issuer's certificate and the presence of
subjectAltName in the issuer issuer's certificate.

The clarification will be really appreciated.

--Dmitry