Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Looking at the details of a certificate using the following:

openssl x509 -noout -text -purpose -in mycert.pem

I find a bunch of purpose flags (which I've discovered are set by the various extensions attached to a certificate).

One of these purpose flags is "Any Purpose". I can't seem to find ANY documentation on this flag and why or why not it is set.

Do any of you know where I can find more information on this purpose and what it means?

Thanks,

share|improve this question

4 Answers 4

In X.509 certificates, as in most other things, if a term is not explicitly defined then it inherits the meaning from its immediately-surrounding context. If that context is "life", then the phrase "Any Purpose" means literally that.

So, check the Certificate Policy, Subscriber Agreement, and Relying Party Agreement of the issuing CA, and if they say nothing about the flag then it means what it says on the box.

share|improve this answer
    
The policy, subscriber agreement, and relying party agreement shouldn't have any technical impact on the certificate's use. –  Falcon Momot Aug 20 '12 at 2:07
    
@Falcon - those documents are the immediate context for the certificate, and ultimately define how a human interprets it. There can be no "technical impact" other than "this flag is set" - human interpretation is all. –  mlp Aug 20 '12 at 3:14

The KeyUsage is a v3 extension, which may or may not be present in a certificate.

A useful (if slightly dated) summary of id-ce-keyUsage values: http://www.alvestrand.no/objectid/2.5.29.15.html [newly added values are 7 = encipherOnly and 8 = decipherOnly]

The trick is that this "OID=2.5.29.15 keyUsage extension" /might or might not/ be present in a particular certificate.

What OpenSSL probably presumes with PURPOSE_ANY, is that this extension was /not present/, and that it's therefore "up to your own policy" to decide what to use or not use it for. Otherwise, there's no bitmap value that corresponds to "ANY"...

share|improve this answer

From: http://en.wikipedia.org/wiki/Digital_certificate

Key-Usage: Purpose of the public key (e.g. encipherment, signature, certificate signing...).

See the -purpose flag in the openssl docs: http://www.openssl.org/docs/apps/x509.html#CERTIFICATE_EXTENSIONS

share|improve this answer
1  
I was not asking what all of the other purpose bools represented, I was asking what the "Any Purpose" was and how it was set. This is not defined in either of the two links you sent me. –  Nick Feb 10 '10 at 19:06
1  
Your are right, that flag is not explicitly documented, I assumed that "Any Purpose" would mean any of the purposes listed. I looked at the code in openssl/crypto/x509v3/v3_purp.c and crypto/x509v3/x509v3.h. grep the source tree for: X509_PURPOSE_ANY I interpret it as being an extension of the certificate that means the cert is suitable for any purpose. i.e. that flag is just another x.509 certificate extension. –  tajh Feb 10 '10 at 21:46

Most certificates are issued with a purpose (or set of purposes) to which they are restricted, such as client auth, server auth, key exchange, and code signing. If they are used for a purpose not endorsed (eg. using your email certificate to sign code), they are not valid.

The any purpose extension simply means the certificate should always pass usage constraints, which is the same as saying it is valid for all usages.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.