1

The following article has explained both differently. X.509 wiki

Now my question is:

  1. Can we use more than one extension in a certificate? Is it how there can be more than one use of extensions in a certificate?
  2. How are they differentiated by a server?
8

Certificate extensions are just additional information in the certificate, i.e. "extending" on the information which has to be provided at minimum. If you need these extensions you have to use X.509v3, without extensions you can use X.509v1. Typical extensions are usage restrictions, subject alternative names or links to CRL download and the OCSP resolver.

A certificate can contain multiple extensions and this is actually the common case. The server can differ between the various extensions because each has a type id which is contained in the X.509 file. For more detailed information about the variety of extensions which exist see Redhat: B.3. Standard X.509 v3 Certificate Extension Reference.

Certificate extensions have nothing to do with file name extension, hair extensions, loan extensions or any other kind of extensions.

  • While interesting, the blog post you link to is rather confusing in context, because it is primarily talking about file extensions (and formats for storing and transmitting certificate data), whereas the rest of your answer is, as your last sentence pithily explains, nothing to do with that. A better article, picked from the first page of DuckDuckGo, would be this Redhat reference. – IMSoP Jun 25 '17 at 21:08
  • @IMSoP: you are perfectly right. I've changed the link to the one you provided. Thanks a lot. – Steffen Ullrich Jun 25 '17 at 21:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.