Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

In some Microsoft articles like, I find some confusing statements like

Application policies are sometimes called extended key usage or enhanced key usage. Because some implementations of public key infrastructure (PKI) applications cannot interpret application policies, both application policies and enhanced key usage sections appear in certificates issued by a Windows Server–based certification authority (CA).

While the first sentence seems to suggest they are actually the same thing called different, the latter one suggest they are different things that may both appear in a CA certificate. The only difference seems to be using Microsoft specific OIDs though (more of them can be found here, mostly*).

So, in how far are they different things, should I bother, and if so how can I treat them correctly in openssl?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

In Microsoft terminology, "application policies" appears to be a custom extension with OID, which seems to be roughly similar in contents and goals to the standard Extended Key Usage. I see in an MS-produced certificate an "Extended Key Usage" extension which contains two OID, and an "application policies" extension which contains the two same OID, albeit each within an extra SEQUENCE layer, which probably means that the Microsoft-specific extension allows for some optional qualifiers. I could not find a public description of the extension. (Edit: this page says that the extension uses the "same encoding as szOID_CERT_POLICIES", which is, i.e. the standard Certificate Policies extension from RFC 5280.)

Given the lack of information on this extension, the best way to handle it is probably to ignore it altogether. The extension is not marked "critical" so you are allowed to ignore it if you do not understand it, as per X.509, section 4.2:

A non-critical extension MAY be ignored if it is not recognized, but MUST be processed if it is recognized.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.