Coding With Fun
Home Docker Django Node.js Articles Python pip guide FAQ Policy

Is the eku certificate valid in windows certificate viewer?


Asked by Jordyn Brewer on Nov 30, 2021 Windows



We see that certificate is valid only to two weird OIDs which are certificate policy OIDs, not EKU usages. This means that this particular certificate is not valid for any usage. However, Windows Certificate Viewer doesn’t show any errors in presented certificate.
Additionally,
Windows Certificate Viewer does not validate EKUs for certificate, but includes information about validation in constrained mode. In this example we will evaluate my website’s SSL certificate. SSL certificate chain includes three certificates, leaf, intermediate CA and root CA: Leaf certificate is valid for Client and Server Authentication:
And, To view the EKU for a certificate in the Certificates snap-in, in the contents pane, double-click the certificate, click the Details tab, and then click the Enhanced Key Usage field.
Furthermore,
There is no EKU extension. Since CA certificate does not include EKU extension, we would expect that CA certificate is valid for all usages. Where the list of usages in General tab came from? Microsoft Windows uses Windows Certificate Store to hold personal, globally trusted CA and other certificates.
Likewise,
Extended Key Usage (EKU). The EKU filter allows you to choose which EKUs must be present in the certificate. When you configure the EKU filter, you can specify that computers that are running Windows 8 must enumerate all EKU properties for all certificates that are present in the certificate store on the local computer.