How is one supposed to determine which IOD to use in a certificate?

Question

I'm creating a self signed certificate for a practice dev system data encipherment keystore and am unable to determine which OID I'm supposed to use.

Google result show the following as options:

• 1.3.6.1.4.1.311.80.1 but 311.80 doesn't exist anymore.
• 1.3.6.1.4.1.311.10 is for Crypto 2.0, but I can't determine which child to use.
• 1.3.6.1.4.1.45.5.48.1.4.1.21 doesn't exist anymore.

There's https://oidref.com/ but I'm coming up short there.

#2.5.29.37 = Enhanced Key Usage Identifiers
-TextExtension "2.5.29.37={text}1.3.6.1.4.1.311.10.???"

Answer 1

OIDs are just numbers in an official registry. So the answer depends on what you want or need the OID for. You describe you want it for data encipherment keystore, it sounds like you want PKI Mechanisms:

• 1.3.6.1.5.5 are internet security mechanisms:
  • 1.3.6.1.5.5.7 are PKI mechanisms:
    • 1.3.6.1.5.5.7.3 are Key Purposes:
      • .1 Is for a server authentication certificate. https://oidref.com/1.3.6.1.5.5.7.3.1
      • .2 Is for client authentication. https://oidref.com/1.3.6.1.5.5.7.3.2
      • .36 Is for document signing http://oid-info.com/get/1.3.6.1.5.5.7.3.36
      • .21 is an SSH Client Certificate
      • .22 is SSH Server

So you're looking for OIDs defining a certificate's purpose, for PKI Mechanisms and Purposes 1.3.6.1.5.5.7.3 is probably the root ID you're needing.

For more clarification, OID's like 1.3.6.1.4.1.45.5.48.1.4.1.21 is a private organization's OID registered publicly for a purpose use. Specifically this one looks like it's a nortel networks certificates OID which may or may not exist anymore (and may have been moved).

Under 1.3.6.1.4 for internet private organizations.

• 1.3.6.1.4.1 is for enterprises.
  • 1.3.6.1.4.1.45 is Nortel Networks OIDs, specifically related to their SNMP MIB response numbers. Anything under this is going to be related to items responding in SNMP requests.
  • 1.3.6.1.4.1.311 is Microsoft
    • 1.3.6.1.4.1.311.10 is Microsoft's crypto 2.0 (oid-info.com say's see OIDs associated with Microsoft's Cryptography: link was broken, probably also why a lot of the OID's under 311 is moved or broken.)

If you're creating a organization ID like an entierprise ID, you can just make it up for a non public use; 1.3.6.1.4.1.995 or something can be your fake enterprise's OID.

But certain devices and systems may expect certain OIDs to exists in the certificate for it to be accepted.

Answer 2

After much digging, it appears that both of the OID databases at https://oidref.com/ and http://oid-info.com/ are out of date/not maintained/unreliable as neither indicate that child 80 exists under node 311.

If one were to generate a certificate using the document encipherment policy OID "2.5.29.37={text}1.3.6.1.4.1.311.80.1" that's referenced by several articles, the certificate is generated with the correct policy information in the enhanced key usage field.