Supported Extensions

You can use the IX509Extension interface to define an arbitrary extension. The Certificate Enrollment API also provides interfaces derived from IX509Extension to enable you to easily create any of the most common extensions. The following list identifies the common extensions supported by Microsoft certification authorities, and the object identifiers and interfaces that you can use to create them.

AlternativeNames

The alternative names extension can be used to define one or more alternative name forms for the subject of the certificate request. Example alternative forms include email addresses, DNS names, IP addresses, and URIs.

Interface: IX509ExtensionAlternativeNames

OID: XCN_OID_SUBJECT_ALT_NAME2 (2.5.29.17)

AuthorityInformationAccess

The authority information access extension identifies how to access CA information and services. The extension value contains a sequence of URIs.

Interface: IX509Extension

OID: XCN_OID_AUTHORITY_INFO_ACCESS (1.3.6.1.5.5.7.1.1)

AuthorityKeyIdentifier

The authority key identifier extension enables identification of the CA public key that corresponds to the CA private key that signed an issued certificate. It is used by certificate path building software on a Windows server to find the CA certificate. When a CA issues a certificate, the extension value is set equal to the SubjectKeyIdentifier extension in the CA signing certificate. The value is typically a SHA-1 hash of the public key.

Interface: IX509ExtensionAuthorityKeyIdentifier

OID: XCN_OID_AUTHORITY_KEY_IDENTIFIER2 (2.5.29.35)

BasicConstraints

The basic constraints extension can be used to identify whether the entity can be used as a certification authority (CA) and, if so, the number of subordinate CAs that can exist beneath it in the certificate chain.

Interface: IX509ExtensionBasicConstraints

OID: XCN_OID_BASIC_CONSTRAINTS2 (2.5.29.19)

CertificatePolicies

The certificate policies extension can be used to identify the policies under which the certificate has been issued and the purposes for it can be used. These are identified by a collection of object identifiers (OIDs). Policies are customized for the requirements of an organization.

Interface: IX509ExtensionCertificatePolicies

OID: XCN_OID_CERT_POLICIES (2.5.29.32)

CrlDistributionPoints

The certificate revocation list (CRL) distribution points extension contains the URI of the base certificate revocation list (CRL).

Interface: IX509Extension

OID: XCN_OID_CRL_DIST_POINTS (2.5.29.31)

EnhancedKeyUsage

The enhanced key usage extension can be used to define one or more uses of the public key contained in the certificate.

Interface: IX509ExtensionEnhancedKeyUsage

OID: XCN_OID_ENHANCED_KEY_USAGE (2.5.29.37)

FreshestCRL

The freshest CRL extension contains the URI of the delta CRL. The same ASN.1 syntax is used for this extension and the CrlDistributionPoints extension.

Interface: IX509Extension

OID: XCN_OID_FRESHEST_CRL (2.5.29.46)

KeyUsage

The key usage extension can be used to define restrictions on the operations that can be performed by the public key contained in the certificate. For example, you can specify that the public key be used only to create a digital signature, sign a certificate revocation list (CRL), or encrypt another key.

Interface: IX509ExtensionKeyUsage

OID: XCN_OID_KEY_USAGE (2.5.29.15)

MSApplicationPolicies

The Microsoft application policies extension can be used by an application to filter certificates on the basis of permitted use. Permitted uses are identified by OIDs. This extension is similar to the EnhancedKeyUsage extension but with stricter semantics applied to the parent CA. The extension is Microsoft specific. For non-Windows-based verifiers that do not support this extension, this extension can be ignored—even when marked critical—if the ExtendedKeyUsage extension is also present.

Interface: IX509ExtensionMSApplicationPolicies

OID: XCN_OID_APPLICATION_CERT_POLICIES (1.3.6.1.4.1.311.21.10)

NameConstraints

The name constraints extension is used to identify the namespace within which all subject names of certificates in a certificate hierarchy must be located. The extension is used only in a CA certificate.

Interface: IX509Extension

OID: XCN_OID_NAME_CONSTRAINTS (2.5.29.30)

PolicyConstraints

The policy constraints extension is added to CA certificates to constrain path validation by prohibiting policy mapping or by requiring that each certificate in the hierarchy contain an acceptable policy identifier.

Interface: IX509Extension

OID: XCN_OID_POLICY_CONSTRAINTS (2.5.29.36)

PolicyMappings

The policy mappings extension is used to identify the policies in a subordinate CA that correspond to policies in the issuing CA. The extension value contains a sequence of issuing CA and subordinate CA policy mappings represented by object identifiers.

Interface: IX509Extension

OID: XCN_OID_POLICY_MAPPINGS (2.5.29.33)

PrivateKeyUsagePeriod

The private key usage period extension is used to specify a different validity period for the private key than for the certificate with which the key is associated.

Interface: IX509Extension

OID: XCN_OID_PRIVATEKEY_USAGE_PERIOD (2.5.29.16)

SmimeCapabilities

The Secure/Multipurpose Internet Mail Extensions (S/MIME) capabilities extension can be used to report an email recipient's decryption capabilities to the sender of the email message so that the sender can choose the most secure encryption algorithm supported by both parties. The extension value contains a collection of symmetric encryption algorithm OIDs and an optional encryption strength for each.

Interface: IX509ExtensionSmimeCapabilities

OID: XCN_OID_RSA_SMIMECapabilities (1.2.840.113549.1.9.15)

SubjectDirectoryAttributes

The subject directory attributes extension can be used to convey identification attributes such as the nationality of the certificate subject. The extension value is a sequence of OID-value pairs.

Interface: IX509Extension

OID: XCN_OID_SUBJECT_DIR_ATTRS (2.5.29.9)

SubjectKeyIdentifier

The subject key identifier extension can be used to differentiate between multiple public keys held by the certificate subject. The extension value is typically a SHA-1 hash of the key.

Interface: IX509ExtensionSubjectKeyIdentifier

OID: XCN_OID_SUBJECT_KEY_IDENTIFIER (2.5.29.14)

Template

The template extension can be used to identify the version 2 template to use when issuing or renewing a certificate. The extension value contains the template OID and optional version information. The extension is Microsoft specific.

Interface: IX509ExtensionTemplate

OID: XCN_OID_CERTIFICATE_TEMPLATE (1.3.6.1.4.1.311.21.7)

TemplateName

The template name extension can be used to identify the version 1 template to use when issuing or renewing a certificate. The extension value contains the name of the template. The extension is Microsoft specific.

Interface: IX509ExtensionTemplateName

OID: XCN_OID_ENROLL_CERTTYPE_EXTENSION (1.3.6.1.4.1.311.20.2)

Related topics

Extensions