Subject: [pkix] EKU for intermediate certificates

From: Koichi Sugimoto <[email-masked]>
Date: Thu, 4 Feb 2016 13:08:53 +0000

Hello.

I hope the following definition should be changed.

>4.2.1.12.  Extended Key Usage
>
>   This extension indicates one or more purposes for which the certified
>   public key may be used, in addition to or in place of the basic
>   purposes indicated in the key usage extension.  In general, this
>   extension will appear only in end entity certificates.

Now CABF (CA Browser Forum) specified Extended Key Usage as:

P9:
Technically Constrained Subordinate CA Certificate: A Subordinate CA certificate which uses a
combination of Extended Key Usage settings and Name Constraint settings to limit the scope within which the
Subordinate CA Certificate may issue Subscriber or additional Subordinate CA Certificates.

P34:
** Generally Extended Key Usage will only appear within end entity certificates (as highlighted in RFC 5280
(4.2.1.12)), however, Subordinate CAs MAY include the extension to further protect relying parties until the
use of the extension is consistent between Application Software Suppliers whose software is used by a
substantial portion of Relying Parties worldwide.

P38-39:
For a Subordinate CA Certificate to be considered Technically Constrained, the certificate MUST include an
Extended Key Usage (EKU) extension specifying all extended key usages that the Subordinate CA Certificate is
authorized to issue certificates for. The anyExtendedKeyUsage KeyPurposeId MUST NOT appear within this
extension.

Major browsers already support this specification, therefore, the next RFC should reflect this notation, I think.
This notation is very important because we can restrict the range of influence when end-entity certificates are
unwillingly issued by attacks etc.

Please see below:
https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.3.2.pdf

Regards,
Koichi Sugimoto.