Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite

X.509 certificates can be used for servers, clients, email, code signing and more applications. http://twitpic.com/6gdxaq indicates that a certificate can have different of these 'capabilities' on it - but how do you see those? What X.509 field denotes these different uses?

share|improve this question

2 Answers

up vote 5 down vote accepted

X.509 "Key Usage" defines what the issuer allows the certificate to be used for. Remember that not all applications follow this requirement however.

share|improve this answer
1  
Thanks. I've looked it up on tools.ietf.org/html/rfc5280#section-4.2.1.3. Sounds as if billing more for code signing certs than for 'webserver' certs has no technical basis... – chris Sep 5 '11 at 12:55
3  
@chris: usually, billing on certificates is more about authentication procedures used to make sure of the requester's identity; it also relates to insurance coverage, and other legal stuff. Or sometimes this is just plain extortion. – Thomas Pornin Sep 5 '11 at 19:17
1  
While there is no technical reason why code signing certificates should cost more, as Thomas noted, the insurance and risk aspects of code signing certificates may have a much larger impact than a web site certificate. Applications have the ability to dynamically and continuously modify and distribute information and perform transactions that potentially effect assets. The line between application and web site is being blurred with the advent of webapps, so the difference is less important than it used to be. – this.josh Sep 7 '11 at 6:25
up vote 1 down vote

There is a summary of the extensions used for TLS/SSL in NSS Technical Note: 3, by Nelson B. Bolyard.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.