I have some question about the X.509 v3 extensions. What extensions should appear in a proper certificate for a SSL server ?
No extension is strictly necessary in the SSL server certificate, but some extensions can only help:
Authority Key Identifierextension will help clients link the certificate with the issuing CA.
CRL Distribution Pointsextension (non critical) should be used to point to the URL where the CRL should be found.
Authority Information Accessextension can be used to include a pointer (URL) to the certificate for the issuing CA itself; the same extension can point to an OCSP responder, if applicable.
- If a
Key Usageextension is used, it should include some flags:
keyEnciphermentfor RSA keys to use with TLS_RSA_* cipher suites,
digitalSignaturefor RSA and DSA keys to use with the TLS_DHE_* cipher suites (there is some confusion about whether
keyEnciphermentshould be used in the case of RSA-based key exchange, so it is safest to include both flags).
- If you have a formally defined certificate policy, have a pointer to it (OID + download URL) included in all certificates in the path, or at least the SSL server certificate itself: it will give you some legal protection, should disputes arise.
Subject Alt Nameextension should be used to indicate the SSL server name. In the absence of such an extension, all browsers will fallback to the CN component of the subjectDN, but this extension is still nominally "preferred" (see RFC 2818 for details).
Of course, all these extensions are supposed to be enforced by the issuing CA, so if you already have the CA, there should be no extra question here.
If in doubt, consult the Internet X.509 PKI Profile. The profile defines what you should morally follow. If you fully conform to it, your certificates will work everywhere. Browsers are actually much more lenient than that.
Hope the below link could help you, http://www.mozilla.org/projects/security/pki/nss/tech-notes/tn3.html