Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've seen both the terms Enhanced Key Usage and Extended Key Usage, and both were abbreviated as EKU. Do both refer to the same extension or property?

share|improve this question
up vote 6 down vote accepted

The correct name for the standard extension is Extended Key Usage; see section of RFC 5280. Its OID is

Confusion comes from Microsoft documentation and software:

  • They use "extended key usage" and "enhanced key usage" interchangeably.
  • They defined a Microsoft-specific extension called "Application Policies" (OID which contains the same information as Extended Key Usage, but with the ASN.1 syntax of "Certificate Policies" (another unrelated extension).
  • Documentation repeatedly talks of storing extended/enhanced key usageS into the Application Policies extension. That is, they use the two expressions "extended key usage" and "enhanced key usage" to designate both the extension and the OID they can put in that extension, or in its clone extension "Application Policies".

Since Microsoft-specific extensions are Microsoft-specific, Microsoft's CA ("Certificate Services") usually includes both extensions (the standard one and the Microsoft one) in issued certificates.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.