I'm building a constrained PKI that specifies EKUs for the the entire hierarchy and want to document the OIDs required for PKI tree maintenance tasks.
I understand that clients may not validate the entire EKU tree, just as some clients may not even check CRLs or OCSP URLs. My intent is to create a baseline of infrastructure that I can use to test interoperability and document how 3rd parties validate (or don't validate) certificates used by CAs.
So assuming a client will validate a CRL, OSPF, or any other certificate that pertains to PKI infrastructure maintenance, what OIDs should I include at my Root EKU to enable a baseline of support + SMIME?
For example, a few OIDs that may relate to PKI infrastructure may include the signing of a sub CA (if such an OID exists), and also Qualified Subordination. However the issue I have is that all OIDs I can find fall under the Microsoft namespace of 184.108.40.206.4.1.311 or are simply listed on this web page. Since Microsoft didn't invent PKI, I don't want to create interoperability issues by only including their OIDs... I would want to include IBM's or Oracle's (Java's) implementation on CA validation.
The ideal answer would include a list of OIDs (in any format) and a description of what it's used for in as much detail as possible. The following is in "Capolicy.inf" format for Microsoft Certificate server, but all I care about is the information...
;OID = 220.127.116.11.4.1.318.104.22.168; Certificate Request Enrollment OID = 22.214.171.124.126.96.36.199.9; OCSP Signing (Required for OCSP) ;OID = 188.8.131.52.184.108.40.206.1.5; OCSP signing (SHOWS AS UNKNOWN in some software) OID = 220.127.116.11.18.104.22.168.4 ; SMIME ; OID = 1.2.840.113522.214.171.124 ; On MSFT.com... Safari reports SMIME ; Should I include timestamping OIDs?
Also if there are certain OIDs that I shouldn't include then please include them as well. For example the following appear to be controversial and may escalate a certificates rights unnecessarily
;OID = 126.96.36.199.4.1.3188.8.131.52 ; szOID_ROOT_LIST_SIGNER ;OID = 184.108.40.206.4.1.3220.127.116.11 ; szOID_KP_CTL_USAGE_SIGNING