Home Library Learn Downloads Support Community
Sign in | United States - English | |
This topic has not yet been rated - Rate this topic

Supported Extensions

You can use the IX509Extension interface to define an arbitrary extension. The Certificate Enrollment API also provides interfaces derived from IX509Extension to enable you to easily create any of the most common extensions. The following list identifies the common extensions supported by Microsoft certification authorities, and the object identifiers and interfaces that you can use to create them.

AlternativeNames

The alternative names extension can be used to define one or more alternative name forms for the subject of the certificate request. Example alternative forms include email addresses, DNS names, IP addresses, and URIs.

OID:  XCN_OID_SUBJECT_ALT_NAME2 (2.5.29.17)

AuthorityInformationAccess

The authority information access extension identifies how to access CA information and services. The extension value contains a sequence of URIs.

Interface:  IX509Extension
OID:   XCN_OID_AUTHORITY_INFO_ACCESS (1.3.6.1.5.5.7.1.1)

AuthorityKeyIdentifier

The authority key identifier extension enables identification of the CA public key that corresponds to the CA private key that signed an issued certificate. It is used by certificate path building software on a Windows server to find the CA certificate. When a CA issues a certificate, the extension value is set equal to the SubjectKeyIdentifier extension in the CA signing certificate. The value is typically a SHA-1 hash of the public key.

OID:   XCN_OID_AUTHORITY_KEY_IDENTIFIER2 (2.5.29.35)

BasicConstraints

The basic constraints extension can be used to identify whether the entity can be used as a certification authority (CA) and, if so, the number of subordinate CAs that can exist beneath it in the certificate chain.

OID:   XCN_OID_BASIC_CONSTRAINTS2 (2.5.29.19)

CertificatePolicies

The certificate policies extension can be used to identify the policies under which the certificate has been issued and the purposes for it can be used. These are identified by a collection of object identifiers (OIDs). Policies are customized for the requirements of an organization.

OID:   XCN_OID_CERT_POLICIES (2.5.29.32)

CrlDistributionPoints

The certificate revocation list (CRL) distribution points extension contains the URI of the base certificate revocation list (CRL).

Interface:  IX509Extension
OID:   XCN_OID_CRL_DIST_POINTS (2.5.29.31)

EnhancedKeyUsage

The enhanced key usage extension can be used to define one or more uses of the public key contained in the certificate.

OID:   XCN_OID_ENHANCED_KEY_USAGE (2.5.29.37)

FreshestCRL

The freshest CRL extension contains the URI of the delta CRL. The same ASN.1 syntax is used for this extension and the CrlDistributionPoints extension.

Interface:  IX509Extension
OID:   XCN_OID_FRESHEST_CRL (2.5.29.46)

KeyUsage

The key usage extension can be used to define restrictions on the operations that can be performed by the public key contained in the certificate. For example, you can specify that the public key be used only to create a digital signature, sign a certificate revocation list (CRL), or encrypt another key.

Interface:  IX509ExtensionKeyUsage
OID:   XCN_OID_KEY_USAGE (2.5.29.15)

MSApplicationPolicies

The Microsoft application policies extension can be used by an application to filter certificates on the basis of permitted use. Permitted uses are identified by OIDs. This extension is similar to the EnhancedKeyUsage extension but with stricter semantics applied to the parent CA. The extension is Microsoft specific.

OID:   XCN_OID_APPLICATION_CERT_POLICIES (1.3.6.1.4.1.311.21.10)

NameConstraints

The name constraints extension is used to identify the namespace within which all subject names of certificates in a certificate hierarchy must be located. The extension is used only in a CA certificate.

Interface:  IX509Extension
OID:   XCN_OID_NAME_CONSTRAINTS (2.5.29.30)

PolicyConstraints

The policy constraints extension is added to CA certificates to constrain path validation by prohibiting policy mapping or by requiring that each certificate in the hierarchy contain an acceptable policy identifier.

Interface:  IX509Extension
OID:   XCN_OID_POLICY_CONSTRAINTS (2.5.29.36)

PolicyMappings

The policy mappings extension is used to identify the policies in a subordinate CA that correspond to policies in the issuing CA. The extension value contains a sequence of issuing CA and subordinate CA policy mappings represented by object identifiers.

Interface:  IX509Extension
OID:   XCN_OID_POLICY_MAPPINGS (2.5.29.33)

PrivateKeyUsagePeriod

The private key usage period extension is used to specify a different validity period for the private key than for the certificate with which the key is associated.

Interface:  IX509Extension
OID:   XCN_OID_PRIVATEKEY_USAGE_PERIOD (2.5.29.16)

SmimeCapabilities

The Secure/Multipurpose Internet Mail Extensions (S/MIME) capabilities extension can be used to report an email recipient's decryption capabilities to the sender of the email message so that the sender can choose the most secure encryption algorithm supported by both parties. The extension value contains a collection of symmetric encryption algorithm OIDs and an optional encryption strength for each.

OID:   XCN_OID_RSA_SMIMECapabilities (1.2.840.113549.1.9.15)

SubjectDirectoryAttributes

The subject directory attributes extension can be used to convey identification attributes such as the nationality of the certificate subject. The extension value is a sequence of OID-value pairs.

Interface:  IX509Extension
OID:   XCN_OID_SUBJECT_DIR_ATTRS (2.5.29.9)

SubjectKeyIdentifier

The subject key identifier extension can be used to differentiate between multiple public keys held by the certificate subject. The extension value is typically a SHA-1 hash of the key.

OID:   XCN_OID_SUBJECT_KEY_IDENTIFIER (2.5.29.14)

Template

The template extension can be used to identify the version 2 template to use when issuing or renewing a certificate. The extension value contains the template OID and optional version information. The extension is Microsoft specific.

Interface:  IX509ExtensionTemplate
OID:   XCN_OID_CERTIFICATE_TEMPLATE (1.3.6.1.4.1.311.21.7)

TemplateName

The template name extension can be used to identify the version 1 template to use when issuing or renewing a certificate. The extension value contains the name of the template. The extension is Microsoft specific.

OID:   XCN_OID_ENROLL_CERTTYPE_EXTENSION (1.3.6.1.4.1.311.20.2)

Related topics

Extensions

 

 

Send comments about this topic to Microsoft

Build date: 2/3/2012

Did you find this helpful?
(1500 characters remaining)
Community Content Add
Annotations FAQ