I am willing to install a Root CA and an Issuing CA with AD CS for my private environment (test purpose).

Do I need to obtain public OIDs (i.e. from IANA) or can I skip this requirement since my CAs are private within my domain?


For private or test environments you can use fictional object identifiers.


  • public envrionments


  • there is a chance that you will create PKI trust relationships with another company (via cross-certification, for example)

I suggest to obtain a free publically-registered OID from IANA: https://pen.iana.org/pen/PenApplication.page


While it is possible to freely obtain an OID you should not apply it to your root CA.

OIDs are applied to certificate profiles (or templates in Microsoft speak) to align certificates created under that profile to a Certificate Policy.

A policy will specify the requirements for the generation and management of a certificate which comes under it, such as mandatory use of a smart card for storing a user's private key or the standard of identity checks to be carried out before a certificate can be issued.

Over the lifetime of your CA you may well have more than one policy and may well add more as time goes on. If you add an OID (or multiple OIDs) to the root CA them they will be set in stone and you can't change/add later without resigning your root CA certificate.

Even if you believe that you only need a few policies and therefore add them all to the root CA at the start, your organisation may well merge at some point in the future at which point your policies on your root may not be valid.

Far better to leave your root with no OIDs and assign them at the issuing CA and to end-entity certificates.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.