Certificate OIDs and Key Usage

Certificate OIDs and Key Usage Extensions

Zertifikate

Wichtige OIDs und Zertifikatserweiterungen

Diese Tabellen zeigen die wichtigsten Informationen rund um die Object Identifiers und den Extensions an.

Object IdentifiersOID
Any Purpose2.5.29.37.0
Attestation Identity Key Certificate2.23.133.8.3
Certificate Request Agent1.3.6.1.4.1.311.20.2.1
Client Authentication1.3.6.1.5.5.7.3.2
Code Signing1.3.6.1.5.5.7.3.3
CTL Usage1.3.6.1.4.1.311.20.1
Digital Rights1.3.6.1.4.1.311.10.5.1
Directory Service Email Replication1.3.6.1.4.1.311.21.19
Disallowed List1.3.6.1.4.1.311.10.3.30
Document Encryption1.3.6.1.4.1.311.80.1
Document Signing1.3.6.1.4.1.311.10.3.12
Domain Name System (DNS) Server Trust1.3.6.1.4.1.311.64.1.1
Dynamic Code Generator1.3.6.1.4.1.311.76.5.1
Early Launch Antimalware Driver1.3.6.1.4.1.311.61.4.1
Embedded Windows System Component Verification1.3.6.1.4.1.311.10.3.8
Encrypting File System1.3.6.1.4.1.311.10.3.4
Endorsement Key Certificate2.23.133.8.1
File Recovery1.3.6.1.4.1.311.10.3.4.1
HAL Extension1.3.6.1.4.1.311.61.5.1
IP security end system1.3.6.1.5.5.7.3.5
IP security IKE intermediate1.3.6.1.5.5.8.2.2
IP security tunnel termination1.3.6.1.5.5.7.3.6
IP security user1.3.6.1.5.5.7.3.7
KDC Authentication1.3.6.1.5.2.3.5
Kernel Mode Code Signing1.3.6.1.4.1.311.61.1.1
Key Pack Licenses1.3.6.1.4.1.311.10.6.1
Key Recovery1.3.6.1.4.1.311.10.3.11
Key Recovery Agent1.3.6.1.4.1.311.21.6
License Server Verification1.3.6.1.4.1.311.10.6.2
Lifetime Signing1.3.6.1.4.1.311.10.3.13
Microsoft Publisher1.3.6.1.4.1.311.76.8.1
Microsoft Time Stamping1.3.6.1.4.1.311.10.3.2
Microsoft Trust List Signing1.3.6.1.4.1.311.10.3.1
OCSP Signing1.3.6.1.5.5.7.3.9
OEM Windows System Component Verification1.3.6.1.4.1.311.10.3.7
Platform Certificate2.23.133.8.2
Preview Build Signing1.3.6.1.4.1.311.10.3.27
Private Key Archival1.3.6.1.4.1.311.21.5
Protected Process Light Verification1.3.6.1.4.1.311.10.3.22
Protected Process Verification1.3.6.1.4.1.311.10.3.24
Qualified Subordination1.3.6.1.4.1.311.10.3.10
Remote Desktop Authentication1.3.6.1.4.311.54.1.2
Revoked List Signer1.3.6.1.4.1.311.10.3.19
Root List Signer1.3.6.1.4.1.311.10.3.9
Secure Email1.3.6.1.5.5.7.3.4
Server Authentication1.3.6.1.5.5.7.3.1
Smart Card Logon1.3.6.1.4.1.311.20.2.2
SpcEncryptedDigestRetryCount1.3.6.1.4.1.311.2.6.2
SpcRelaxedPEMarkerCheck1.3.6.1.4.1.311.2.6.1
Time Stamping1.3.6.1.5.5.7.3.8
Windows Hardware Driver Attested Verification1.3.6.1.4.1.311.10.3.5.1
Windows Hardware Driver Extended Verification1.3.6.1.4.1.311.10.3.39
Windows Hardware Driver Verification1.3.6.1.4.1.311.10.3.5
Windows Kits Component1.3.6.1.4.1.311.10.3.20
Windows RT Verification1.3.6.1.4.1.311.10.3.21
Windows Software Extension Verification1.3.6.1.4.1.311.10.3.26
Windows Store1.3.6.1.4.1.311.76.3.1
Windows System Component Verification1.3.6.1.4.1.311.10.3.6
Windows TCB Component1.3.6.1.4.1.311.10.3.23
Windows Third Party Application Component1.3.6.1.4.1.311.10.3.25
Windows Update1.3.6.1.4.1.311.76.6.1
Microsoft CertSrv InfrastructureOID
Certificate services Certification Authority (CA) version1.3.6.1.4.1.311.21.1
szOID_CERTSRV_PREVIOUS_CERT_HASH1.3.6.1.4.1.311.21.2
szOID_CRL_VIRTUAL_BASE1.3.6.1.4.1.311.21.3
szOID_CRL_NEXT_PUBLISH1.3.6.1.4.1.311.21.4
szOID_KP_CA_EXCHANGE1.3.6.1.4.1.311.21.5
szOID_KP_KEY_RECOVERY_AGENT1.3.6.1.4.1.311.21.6
szOID_CERTIFICATE_TEMPLATE1.3.6.1.4.1.311.21.7
szOID_ENTERPRISE_OID_ROOT1.3.6.1.4.1.311.21.8
szOID_RDN_DUMMY_SIGNER1.3.6.1.4.1.311.21.9
szOID_APPLICATION_CERT_POLICIES1.3.6.1.4.1.311.21.10
szOID_APPLICATION_POLICY_MAPPINGS1.3.6.1.4.1.311.21.11
szOID_APPLICATION_POLICY_CONSTRAINTS1.3.6.1.4.1.311.21.12
szOID_ARCHIVED_KEY_ATTR1.3.6.1.4.1.311.21.13
szOID_CRL_SELF_CDP1.3.6.1.4.1.311.21.14
szOID_REQUIRE_CERT_CHAIN_POLICY1.3.6.1.4.1.311.21.15
szOID_ARCHIVED_KEY_CERT_HASH1.3.6.1.4.1.311.21.16
szOID_ISSUED_CERT_HASH1.3.6.1.4.1.311.21.17
szOID_DS_EMAIL_REPLICATION1.3.6.1.4.1.311.21.19
szOID_REQUEST_CLIENT_INFO1.3.6.1.4.1.311.21.20
szOID_ENCRYPTED_KEY_HASH1.3.6.1.4.1.311.21.21
szOID_CERTSRV_CROSSCA_VERSION1.3.6.1.4.1.311.21.22
Key storage provider name1.3.6.1.4.1.311.21.25
CertificateOIDDescription
subjectKeyIdentifier2.5.29.14Subject key identifier
keyUsage2.5.29.15Key usage
privateKeyUsagePeriod2.5.29.16Private key usage period
issuerAltName2.5.29.18Issuer alternative name (SAN)
basicConstraints2.5.29.19Basic constraints
cRLNumber2.5.29.20CRL (Certificate Revocation List) number
reasonCode2.5.29.21Reason code
invalidityDate2.5.29.24Invalidity Date
deltaCRLIndicator2.5.29.27Certificate Revocation List indicator
certificateIssuer2.5.29.29Certificate Issuer
cRLDistributionPoints2.5.29.31Certificate Revocation List distribution points
authorityKeyIdentifier2.5.29.35Authority key identifier.
Certificate ExtensionsOID
Authority Key Identifier2.5.29.19
Basic Constraints2.5.29.35
Certificate Policies2.5.29.32
CRL Distribution Points2.5.29.31
Enhanced Key Usage2.5.29.46
Issuer Alternative Name2.5.29.8
Key Usage2.5.29.15
Name Constraints2.5.29.30
Policy Constraints2.5.29.36
Policy Mappings2.5.29.33
Private Key Usage Period2.5.29.16
Subject Alternative Name2.5.29.17
Subject Directory Attributes2.5.29.9
Subject Key Identifier2.5.29.14

Welche Key Usage Extensions müssen für ein Zertifikat aktiviert sein

Extended KeyEnable Key Usage Extensions
Web Server CertificateDigital Signature, Key Encipherment or Key Agreement
Web Client CertificateDigital Signature and/or Key Agreement
File Signing .exeDigital Signature
E-Mail ProtectionDigital Signature, non-Repudiation, and/or Key Encipherment or Key Agreement
IPSEC Host or RouterDigital Signature, Key Encipherment or Key Agreement
IPSEC TunnelDigital Signature, Key Encipherment or Key Agreement
TimestampingDigital Signature, non-Repudiation

Welcher Typ von Zertifikat setzt welche Key Usage Extensions voraus

ApplicationKey Usage Extensions
SSL Certificate for ClientDigital signature
SSL Certificate for ServerKey encipherment
S/MIME SigningDigital signature
S/MIME EncryptionKey encipherment
Certificate SigningCertificate signing
Object SigningDigital signature

https://www.der-windows-papst.de/2019/07/06/eigenschaften-eines-x-509-v3-zertifikats/