<html><head><title>Re: [gnutls-help] Server and client OID</title>
</head>
<body>
<br><br>
<br>
<span style=" font-family:'courier new'; font-size: 9pt; color: #800000;"><b>NM> On Thu, May 23, 2019 at 1:17 AM Gregory Sloop <</b></span><a style=" font-family:'courier new'; font-size: 9pt;" href="mailto:gregs@sloop.net">gregs@sloop.net</a><span style=" font-family:'courier new'; font-size: 9pt; color: #800000;"><b>> wrote:<br>
<br>
>> I am using certtool to create some certificates and keys.<br>
>> These certs and keys will be used on Windows systems - and I've run into some confusion.<br>
<br>
>> As far as I can tell, MS [and Cisco and others] expect the OID 1.3.6.1.5.5.7.3.1 to be a "server" certificate.<br>
<br>
>> However, from the GNUTLS docs for certtool, I see this:<br>
<br>
>> # Whether this certificate will be used for a TLS client;<br>
>> # this sets the id-kp-serverAuth (1.3.6.1.5.5.7.3.1) of<br>
>> # extended key usage.<br>
>> tls_www_client<br>
<br>
>> # Whether this certificate will be used for a TLS server;<br>
>> # This sets the id-kp-clientAuth (1.3.6.1.5.5.7.3.2) of<br>
>> # extended key usage.<br>
>> tls_www_server<br>
<br>
NM> Hi,<br>
NM> Thank you for bringing this up. It seems that the comments in the<br>
NM> configuration file are incorrect. Checking the OIDs set by these two<br>
NM> options, they are reversed and match what you mention above.<br>
<br>
NM> regards,<br>
NM> Nikos<br>
<br>
</b><span style=" color: #000000;">Thanks, I was pretty sure, as I did review some certs I created with another tool and it was as I expected - but I wanted to do it a second time, being super careful to be sure I was right. It's great to get your confirmation! Now I don't need to do that.<br>
<br>
Thanks for fixing it in the comments/docs for a future version!<br>
It looks like it's in the docs too:<br>
</span></span><a style=" font-family:'Courier New'; font-size: 9pt;" href="https://www.gnutls.org/manual/gnutls.html">https://www.gnutls.org/manual/gnutls.html</a><br>
<br>
<span style=" font-family:'Courier New'; font-size: 9pt;">..and thanks for a great tool! [I should say that part first!!! Seriously, I really do appreciate your work!]<br>
<br>
-Greg</body></html>