Frequently Used Extended Key Usages and Issuance Policies

The following is a list of commonly used extended key usage and issuance policies that are used repeatedly in practice to restrict certificate authority certificates.

Frequently used extended key usages:

Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the Application of regulationsto realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can downloaded via GitHub and can be used free of charge. Professional maintenance is also offered.

The extended key usages are also referred to in some documentation as Application Policies called.

OID	Description
1.3.6.1.4.1.311.20.2.1	Certificate Request Agent
1.3.6.1.5.5.7.3.2	Client Authentication
1.3.6.1.5.5.7.3.3	Code Signing
1.3.6.1.4.1.311.10.3.13	Lifetime Signing
1.3.6.1.4.1.311.10.3.12	Document Signing
1.3.6.1.4.1.311.80.1	Document Encryption
1.3.6.1.4.1.311.10.3.4	Encrypting file system
1.3.6.1.4.1.311.10.3.4.1	File Recovery
1.3.6.1.5.5.7.3.5	IP Security End System
1.3.6.1.5.5.8.2.2	IP Security IKE Intermediate
1.3.6.1.5.5.7.3.6	IP Security Tunnel Endpoint
1.3.6.1.5.5.7.3.7	IP Security User
1.3.6.1.4.1.311.10.3.11	Key Recovery
1.3.6.1.5.2.3.5	KDC Authentication
1.3.6.1.4.1.311.10.3.1	Microsoft Trust List Signing
1.3.6.1.4.1.311.10.3.10	Qualified Subordination
1.3.6.1.4.1.311.10.3.9	Root List Signer
1.3.6.1.5.5.7.3.4	Secure E-mail
1.3.6.1.5.5.7.3.1	Server Authentication
1.3.6.1.4.1.311.20.2.2	Smartcard Logon
1.3.6.1.5.5.7.3.8	Time Stamping according to RFC 3161
1.3.6.1.5.5.7.3.9	OCSP Signing
1.3.6.1.4.1.311.54.1.2	Remote Desktop Authentication
1.3.6.1.4.1.311.21.5	Private Key Archival
2.16.840.1.113741.1.2.3	Intel Advanced Management Technology (AMT) Provisioning

Frequently used issuance policies (Issuance Policies):

OID	Description
2.5.29.32.0	All Issuance Policies (AnyPolicy)
1.3.6.1.4.1.311.21.32	TPM Key AttestationUser Credentials: (Low Assurance)
1.3.6.1.4.1.311.21.31	TPM Key AttestationEndorsement Certificate: (Medium Assurance)
1.3.6.1.4.1.311.21.30	TPM Key AttestationEndorsement Key: (High Assurance)

Related links:

• Basics: Restricting Extended Key Usage (EKU) in Certification Authority Certificates
• Restrict extended key usage (EKU) for imported root certification authority certificates
• Configuring the Trusted Platform Module (TPM) Key Attestation
• Basics of online responders (Online Certificate Status Protocol, OCSP)

External sources

• TPM Key Attestation (Microsoft)
• Setting up TPM protected certificates using a Microsoft Certificate Authority - Part 3: Key Attestation (Microsoft)
• Object IDs associated with Microsoft cryptography (Microsoft, archive link)
• Object Identifiers (OID) in PKI (PKI Solutions, Inc.)