Netscape MANAGEMENT SYSTEM 6.0 - PLUG-IN Manual page 335

Recommendations for Use of Certificate Extensions with CMS (Continued)
Table C-1
Certificate type CA root
S/MIME client authorityKeyIdentifier
certificate
(dual key pair)
extKeyUsage:
keyUsage:
keyCertSign, cRLSign
subjectKeyIdentifier
Intermediate CA
authorityKeyIdentifier
cRLDistributionPoints
extKeyUsage:
Email
keyUsage:
keyCertSign,
cRLSign
subjectKeyIdentifier
Recommendations for Certificate Extension Use
Issued certificate
authorityKeyIdentifier
cRLDistributionPoints
extKeyUsage:
Email
keyUsage, signing
certificate:
digitalSignature
(required)
keyUsage, encryption
certificate:
keyEncipherment
(required)
subjectAltName
subjectKeyIdentifier
Appendix C Certificate and CRL Extensions
Email
335