Extended\Enhanced Key usage in Sub CA Certificates

bonjour, 

i had made test 5 level ca , doing microsoft smart card logon end tier ca, had big big problem sub cas did not have smart card logon extension in eku, end entity certificates unable sc logon. error client certificate & chain certificates not valid intended usage. sc logon extension missing in upper layer sub ca certs. diagnosed after long time , included desired extension in subca certs. microsoft deals constraint if extension not present.

as there lot of extensions , thinking evolution, many extensions created n used in future, if add particular set of extension in sub ca certs in future set constraint on pki solution , not able use these new extensions in end entity.

is best solutionto remove eku in sub ca certs avoid constraints ?

waiting reply

regards

scott

i never add eku constraints in subordinate ca certificates reason.

i typically deploy application policies oid in eku extension ekus allowed.

the cases eku populated in ca certificates have seen are:

- root signing - customer has received subordinate ca certificate commercial provider. commercial provider limits eku through eku extension.

- cross certification. customer limits purposes partner's certificate trusted including eku oids in eku extension

hth,

brian

Windows Server  >  Security