OpenSSL's 'purpose' stuff isn't quite just a straight reflection of the Key-Usage extension of a v3 certificate.
OpenSSL defines a set of 'purposes' itself, and then has some logic that determines whether a given certificate is consistent with the chosen purpose based on the certificate extensions - including, but not limited to, the key usage and extended key usage extensions.
'Any Purpose' is what you get if you pass
-purpose any to
openssl verify or if you write code which sets the purpose of an OpenSSL context to the 'any' value using e.g.
Most of the purposes are documented in
man x509 section
CERTIFICATE EXTENSIONS - it explains what properties the certificate must have to be valid for the given purpose - but this doesn't document the
any purpose. In the source, at the top of
crypto/x509v3/v3_purp.c you can see that the check function run for
no_check(), which simply returns 1: effectively it disables purpose checking.
I'm not sure if you could possibly engineer a situation in which any certificate would not be valid for the
any purpose. I'm also not sure what the difference is between setting the purpose to
any and not setting a purpose at all, which should cause purpose checking to be entirely bypassed.
X509_PURPOSE_ANY / "Any Purpose" /
-purpose any concept is not the same thing as the RFC 5280 anyExtendedKeyUsage KeyPurposeId.