[1] RFC 5280 - Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile (2018-07-29 16:13:13 +09:00) https://tools.ietf.org/html/rfc5280#section-4.2.1.2

[2] Certificate Error: How to validate the Subject Key Identifier (SKI) from a X509 certificate (2018-05-28 10:06:09 +09:00) http://certificateerror.blogspot.com/2011/02/how-to-validate-subject-key-identifier.html

[3] basic constraints の cA が真なら、必須です。

[4] EE証明書でも指定できます。

[5] AKI も参照。