I'm building a constrained PKI that specifies EKUs for the the entire hierarchy and want to document the OIDs required for PKI tree maintenance tasks.
I understand that clients may not validate the entire EKU tree, just as some clients may not even check CRLs or OCSP URLs. My intent is to create a baseline of infrastructure that I can use to test interoperability and document how 3rd parties validate (or don't validate) certificates used by CAs.
So assuming a client will validate a CRL, OSPF, or any other certificate that pertains to PKI infrastructure maintenance, what OIDs should I include at my Root EKU to enable a baseline of support + SMIME?
For example, a few OIDs that may relate to PKI infrastructure may include the signing of a sub CA (if such an OID exists), and also Qualified Subordination. However the issue I have is that all OIDs I can find fall under the Microsoft namespace of 220.127.116.11.4.1.311 or are simply listed on this web page. Since Microsoft didn't invent PKI, I don't want to create interoperability issues by only including their OIDs... I would want to include IBM's or Oracle's (Java's) implementation on CA validation.
The ideal answer would include a list of OIDs (in any format) and a description of what it's used for in as much detail as possible. The following is in "Capolicy.inf" format for Microsoft Certificate server, but all I care about is the information...
;OID = 18.104.22.168.4.1.322.214.171.124; Certificate Request Enrollment OID = 126.96.36.199.188.8.131.52.9; OCSP Signing (Required for OCSP) ;OID = 184.108.40.206.220.127.116.11.1.5; OCSP signing (SHOWS AS UNKNOWN in some software) OID = 18.104.22.168.22.214.171.124.4 ; SMIME ; OID = 1.2.840.1135126.96.36.199 ; On MSFT.com... Safari reports SMIME ; Should I include timestamping OIDs?
Also if there are certain OIDs that I shouldn't include then please include them as well. For example the following appear to be controversial and may escalate a certificates rights unnecessarily
;OID = 188.8.131.52.4.1.3184.108.40.206 ; szOID_ROOT_LIST_SIGNER ;OID = 220.127.116.11.4.1.318.104.22.168 ; szOID_KP_CTL_USAGE_SIGNING