Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

3
  • Thanks this is very useful. Quick question. If I understand you correctly, an otherwise valid server certificate is invalid according to the Extended Key Usage if it both contains an Extended Key Usage Extention and does not contain "server authentication" in it's Key Usage Extension. To state it another way, the (otherwise valid) server certificate is valid if it either does not contain an Extended Key Usage Extension, or it does contains one and the extension contains a "server authentication" indicator. Is that correct? Commented May 14, 2014 at 21:20
  • 1
    Yes, that's the idea. An absent EKU extension is considered equivalent to an EKU which contains the special "any usage" indicator, thereby allowing all usages. Commented May 14, 2014 at 21:44
  • Thanks Thomas! FWIW I think this is the section that covers that point: tools.ietf.org/html/rfc5280#section-4.2.1.12 "If the extension is present, then the certificate MUST only be used for one of the purposes indicated." Commented May 14, 2014 at 23:18