2

Is there a standard order for the X.509 extensions of a certificate?

For example:

 [ myca_extensions ]
 basicConstraints = critical,CA:FALSE
 keyUsage = digitalSignature,keyEncipherment
 extendedKeyUsage = serverAuth
 subjectKeyIdentifier = hash
 authorityKeyIdentifier = keyid:always,issuer
 crlDistributionPoints = @crl_section
 authorityInfoAccess = @ocsp_section
 subjectAltName  = @alt_names

 [alt_names]
 DNS.0 = *.example.com
 DNS.1 = *.example1.com
 DNS.2 = example.com
 DNS.3 = example1.com
 IP.0 = 192.168.0.2
 IP.1 = 192.168.0.3
 IP.2 = 192.168.0.4
 IP.3 = 192.168.0.5
 IP.4 = 192.168.0.6
 IP.5 = 192.168.0.7

 [crl_section]
 URI.0 = http://pki.example.com/Example Intermediate Certificate Authority.crl

 [ocsp_section]
 OCSP;URI.0 = http://pki.example.com/ocsp/
 caIssuers;URI.0 = http://pki.example.com/Example Intermediate Certificate Authority.crt

If the extensions have a standard order to be placed, is my above config correct?

Improve this question

1 Answer 1

Reset to default
2

Extensions are unordered, so whatever order you prefer would be fine.

p.s. Does your organization own 4146 PEN number? As per IANA registry, this PEN number is owned by GlobalSign and you are not allowed to use it in certificate policies. And 2.23.140.1.2.2 is owned by CAB Forum, so you are not allowed to use this OID either.

Improve this answer
4
  • I had asked. But that guy told me I am allowed. Let me link that
    – Example person
    Commented Feb 7, 2021 at 12:53
  • security.stackexchange.com/questions/244417/…
    – Example person
    Commented Feb 7, 2021 at 12:54
  • Steffen Ullrich said: I have no idea what you want to achieve in the first place. OID are just a series of octets with a registered associated meaning. There are no restrictions on who can use these OID. The meaning should make sense though in the context used and the one reading the certificate need to actually check the value and behave accordingly. So it all depends on what you express at the end and who will interpret the certificate policies - which is unknown.
    – Example person
    Commented Feb 7, 2021 at 12:54
  • 1
    That comment by Steffen Ulrich is not correct, you are not allowed to use them. Your organization must register their own PEN at IANA (free of charge) or ANSI (fees apply). pen.iana.org/pen/PenApplication.page
    – Crypt32
    Commented Feb 7, 2021 at 12:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .