Table of Contents
Advertisement
Standard X.509 v3 Certificate Extensions
CMS Version Support
Refer to "ExtendedKeyUsageExt Plug-in Module" on page 169.
•
CMS 4.1: Not supported
•
CMS 4.2: Supported
•
CMS 4.2-SP2: Supported
Netscape Recommendations
Netscape recommends that this extension be supported for all certificates, and
requires it for all certificates that support step-up, or Server Gated Crypto (SGC).
OCSP Signing should be included in all certificates issued to OCSP responders.
Microsoft Recommendations
Microsoft products interpret this extension as follows. If the extension is not
present, the certificate is considered to be valid for any usage (to support backward
compatibility with certificates that did not use this extension). Otherwise,
interpretation depends on usage, as follows:
•
Authenticode requires that Code Signing be the unique usage specified.
•
SGC operation requires that the SGC usage be specified.
•
Timestamping requires that timestamping usage be specified.
Microsoft allows users to control certificate properties that correspond to Extended
Key Usage specifications. For example, from the Internet Explorer 4.0 user
interface, the user may deselect a CA certificate in a list of CA certificates otherwise
trusted for a given usage. Note that the user may only restrict uses, and not add
uses that are not supported by the certificate itself. These user settings affect only
the interpretation of the certificate on the computer where they are set. They do not
affect the certificate itself.
A given certificate is valid only for the intersection of key usages of all the
certificates in the chain to its root (as determined by both the Extended Key Usage
extension for each certificate and the corresponding user settings). To be valid for a
particular usage, the end-entity certificate and all certificates in the chain must all
be valid for that usage.
issuerAltName
OID
2.5.29.18
348
Netscape Certificate Management System Plug-ins Guide • October 2001
Advertisement
Table of Contents
