Usually I set "AnyPurpose" on Root CA (meaning this is root and can issue certificates to any other intermediate or sub CA), and then, when issuing the intermediates CA I set the restrictions...
My Root CA have:
- AnyPolice 18.104.22.168.0,
- CA:True 22.214.171.124,
- AnyPurpose 126.96.36.199,
- DigitalSignature 188.8.131.52.3,
- CRL Distribution Points 184.108.40.206,
On my intermediate TLS CA for Example I set:
- Web ServerAuth TLS 220.127.116.11.18.104.22.168.1,
- Web ClientAuth 22.214.171.124.126.96.36.199.2
This is limit the TLS CA from inheritance from all attributes from Root CA (the restrictive OIDs apllied here will allow only sign TLS certificates and with pathlen:0 I will forbidden sub CAs).
Everything depends how you set your PKI infrastructure.
On my network I do one intermediate CA per purpose, example:
- Intermediate CA for Emails
- Intermediate CA for TLS
- Intermediate CA for Software
- Intermediate CA for Identity
- Intermediate CA for Components
This way if there an problem with an mail certificate, I only need revoke the Email CA while all other Intermediate CA are fine.
Big Certification Authorities have for example an dedicated intermediate CA to EV.
Note: This is for personal PKI, if you wish do something following RFCs and best practices like big Certification Authorities do, then there a lot of extra stpes, like include much more OIDs and setup all them...
For example you can read some of the standards on this link:
Another example, for EV certificates there a lot of extra steps setup OIDs:
- Domain Validated 188.8.131.52.2.1
- Organization Validated 184.108.40.206.2.2
And since my setup do not need those, I don`t spended my time searching and testing the necessary OIDs for get this working