What is the difference between `extendedKeyUsage` and an application policy?

Question

In some Microsoft articles like http://technet.microsoft.com/en-us/library/cc731792%28v=ws.10%29.aspx, I find some confusing statements like

Application policies are sometimes called extended key usage or enhanced key usage. Because some implementations of public key infrastructure (PKI) applications cannot interpret application policies, both application policies and enhanced key usage sections appear in certificates issued by a Windows Server–based certification authority (CA).

While the first sentence seems to suggest they are actually the same thing called different, the latter one suggest they are different things that may both appear in a CA certificate. The only difference seems to be using Microsoft specific OIDs though (more of them can be found here, mostly 1.3.6.1.4.1.311.10.3.*).

So, in how far are they different things, should I bother, and if so how can I treat them correctly in openssl?

Answer 1

In Microsoft terminology, "application policies" appears to be a custom extension with OID 1.3.6.1.4.1.311.21.10, which seems to be roughly similar in contents and goals to the standard Extended Key Usage. I see in an MS-produced certificate an "Extended Key Usage" extension which contains two OID, and an "application policies" extension which contains the two same OID, albeit each within an extra SEQUENCE layer, which probably means that the Microsoft-specific extension allows for some optional qualifiers. I could not find a public description of the extension. (Edit: this page says that the extension uses the "same encoding as szOID_CERT_POLICIES", which is 2.5.29.32, i.e. the standard Certificate Policies extension from RFC 5280.)

Given the lack of information on this extension, the best way to handle it is probably to ignore it altogether. The extension is not marked "critical" so you are allowed to ignore it if you do not understand it, as per X.509, section 4.2:

A non-critical extension MAY be ignored if it is not recognized, but MUST be processed if it is recognized.