Subject: Application Recognition and Use of the anyExtendedKeyUsage OID in a Certificate's EKU Extension

From: "Price, Bill" <[email-masked]>
Date: Fri, 16 Feb 2007 16:40:06 -0500

This may be slightly off topic, but does anyone have any information
regarding what "major" vendors/applications recognize the
anyExtendedKeyUsage purpose described in 3280's EKU extension?
 
Some interpretations of 3280 are that applications that consider the
EKU extension should accept the anyExtendedKeyUsage purpose rather than
require the specific purpose targeted to their application. So for
example, a certificate with the anyExtendedKeyUsage purpose should be
accepted for TLS client or server authentication or e-mail protection
regardless of whether the specific EKU purposes were present or not.
Similarly, a certificate with the anyExtendedKeyUsage should be
accepted when used for code, ocsp, or time-stamp signing regardless of
whether the specific purposes were asserted in the EKU.
 
Has anyone either tested major applications or seen vendor
descriptions/disclosures about the acceptance or use of the
anyExtendedKeyUsage purpose? We have found that at least one major
vendor does not accept the anyExtendedKeyUsage as a substitute for a
specific EKU. We would like to avoid having to test to determine
whether other applications use it and whether asserting the
anyExtendedKeyUsage purpose in certificates is useful. 
 
Thanks.
 
============================================ 

Bill Price

The MITRE Corporation