X.509証明書の署名の計算範囲
code:x509syntax
Certificate ::= SEQUENCE {
tbsCertificate TBSCertificate,
signatureAlgorithm AlgorithmIdentifier,
signatureValue BIT STRING }
TBSCertificate ::= SEQUENCE {
version 0 EXPLICIT Version DEFAULT v1, serialNumber CertificateSerialNumber,
signature AlgorithmIdentifier,
issuer Name,
validity Validity,
subject Name,
subjectPublicKeyInfo SubjectPublicKeyInfo, (...)}
code:signatureValue
4.1.1.3. signatureValue
The signatureValue field contains a digital signature computed upon
the ASN.1 DER encoded tbsCertificate. The ASN.1 DER encoded
tbsCertificate is used as the input to the signature function.
結論
証明書の諸情報TBSCertificateは基本的に署名の元になるハッシュ計算範囲に含まれる
CAの秘密鍵が漏洩しない限り証明書の諸情報は改ざんできないことがわかる
ちなみにsignatureValueとsignatureは一致しなければならないので、事実上Certificate全体も改ざんできない