Skip to main content
edited tags
Link
Thomas Pornin
  • 328.6k
  • 60
  • 800
  • 969
Source Link
Tobias Kienzler
  • 8k
  • 11
  • 45
  • 73

What is the difference between `extendedKeyUsage` and an application policy?

In some Microsoft articles like http://technet.microsoft.com/en-us/library/cc731792%28v=ws.10%29.aspx, I find some confusing statements like

Application policies are sometimes called extended key usage or enhanced key usage. Because some implementations of public key infrastructure (PKI) applications cannot interpret application policies, both application policies and enhanced key usage sections appear in certificates issued by a Windows Server–based certification authority (CA).

While the first sentence seems to suggest they are actually the same thing called different, the latter one suggest they are different things that may both appear in a CA certificate. The only difference seems to be using Microsoft specific OIDs though (more of them can be found here, mostly 1.3.6.1.4.1.311.10.3.*).

So, in how far are they different things, should I bother, and if so how can I treat them correctly in openssl?