1

I'm creating a self signed certificate for a practice dev system data encipherment keystore and am unable to determine which OID I'm supposed to use.

Google result show the following as options:

  • 1.3.6.1.4.1.311.80.1 but 311.80 doesn't exist anymore.
  • 1.3.6.1.4.1.311.10 is for Crypto 2.0, but I can't determine which child to use.
  • 1.3.6.1.4.1.45.5.48.1.4.1.21 doesn't exist anymore.

There's https://oidref.com/ but I'm coming up short there.

#2.5.29.37 = Enhanced Key Usage Identifiers
-TextExtension "2.5.29.37={text}1.3.6.1.4.1.311.10.???"
2
  • Can you use openssl and see what OID it creates? Commented Feb 28, 2023 at 17:02
  • I haven't got an OpenSSL installation and have yet to work through building a copy from the github. (Seemed overkill if the capability is already baked into powershell 7)
    – Reahreic
    Commented Mar 1, 2023 at 17:25

2 Answers 2

1

OIDs are just numbers in an official registry. So the answer depends on what you want or need the OID for. You describe you want it for data encipherment keystore, it sounds like you want PKI Mechanisms:

So you're looking for OIDs defining a certificate's purpose, for PKI Mechanisms and Purposes 1.3.6.1.5.5.7.3 is probably the root ID you're needing.

For more clarification, OID's like 1.3.6.1.4.1.45.5.48.1.4.1.21 is a private organization's OID registered publicly for a purpose use. Specifically this one looks like it's a nortel networks certificates OID which may or may not exist anymore (and may have been moved).

Under 1.3.6.1.4 for internet private organizations.

  • 1.3.6.1.4.1 is for enterprises.
    • 1.3.6.1.4.1.45 is Nortel Networks OIDs, specifically related to their SNMP MIB response numbers. Anything under this is going to be related to items responding in SNMP requests.
    • 1.3.6.1.4.1.311 is Microsoft
      • 1.3.6.1.4.1.311.10 is Microsoft's crypto 2.0 (oid-info.com say's see OIDs associated with Microsoft's Cryptography: link was broken, probably also why a lot of the OID's under 311 is moved or broken.)

If you're creating a organization ID like an entierprise ID, you can just make it up for a non public use; 1.3.6.1.4.1.995 or something can be your fake enterprise's OID.

But certain devices and systems may expect certain OIDs to exists in the certificate for it to be accepted.

5
  • So the OID isn't a hard requirement? I was under the impression that you'd have to define the appropriate OID for the appropriate task. Like the SSL Auth OID's which have clearly documented purposes. If there's no general/common file encryption OID then I guess I leave it empty?
    – Reahreic
    Commented Mar 1, 2023 at 17:24
  • The OID might be a requirement for the application looking at the certificate. For example, outlook would need the OID for email signing and encryption to show it's a valid cert for that purpose. So knowing the purpose, and looking through those purposes in the OID root 1.3.6.1.5.5.7.3 is what you need to do. rfc-editor.org/rfc/rfc3279 You can use the OIDs for the particular encryption you intend to allow the cert to be used for, and those OIDs may have optional parameters to define their use. But no, there is no "general encryption" OID, you must specify what you want to use. Commented Mar 1, 2023 at 17:50
  • Looking at stack exchange's https cert, I was able to pull this TLS WWW Server Authentication (OID.1.3.6.1.5.5.7.3.1) TLS WWW Client Authentication (OID.1.3.6.1.5.5.7.3.2) Commented Mar 1, 2023 at 18:01
  • The OIDs in my email cert: Secure Email (1.3.6.1.5.5.7.3.4) Document Signing (1.3.6.1.4.1.311.10.3.12) Commented Mar 1, 2023 at 18:05
  • As this keystore is for a desktop application that encrypts and decrypts file packages locally it didn't seem like I should use the SSL client/server auth OID's.
    – Reahreic
    Commented Mar 1, 2023 at 20:01
0

After much digging, it appears that both of the OID databases at https://oidref.com/ and http://oid-info.com/ are out of date/not maintained/unreliable as neither indicate that child 80 exists under node 311.

If one were to generate a certificate using the document encipherment policy OID "2.5.29.37={text}1.3.6.1.4.1.311.80.1" that's referenced by several articles, the certificate is generated with the correct policy information in the enhanced key usage field.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .