[Servercert-wg] [cabfpub] Using OV TLS server certificate as TLS client certificates only
sleevi at google.com
Thu Apr 29 21:26:22 UTC 2021
On Thu, Apr 29, 2021 at 4:58 PM Kurt Roeckx <kurt at roeckx.be> wrote:
> id-kp-clientAuth is defined as "TLS WWW client authentication",
> but it's also being used for things that are not related to www.
> It would be better that for server to server authentication, you
> create a new EKU, and that it's specific to a certain use case.
Very much, yes.
This applies whether you're using a PKI special for your trust framework
(definitely, the recommended approach, same as you would use a separate PKI
for, say, passport issuance) or you're using a generic PKI. The combination
of both a distinct, per-trust framework EKU and certificatePolicy OID,
together, are necessary to ensure solid and secure technical
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Servercert-wg