Certificates - Extensions (X509v3 extensions)

About

extensions are key values that are part of a certificate.

They are also known as the X509v3 extensions because they are defined in the x509 certificate format.

Most Known

The most known and extension are:

• the Basic Constraint ¹⁾ determines if the certificate is a ca certificate or not and the maximum chain depth validation
• the keyUsage that determines the principal usage
• the extended keyUsage that determines the purpose of the usage
• the Subject Alternative Name that determines the DNS name if the certificat is used for a server

To know more about the extensions, you can read the section 4.2 of the specification or the openssl documentation

How to see the extensions ?

• with portcle

• With Openssl x509 ²⁾

openssl x509 -in cert.pem -noout -text # the whole cert
openssl x509 -in cert.pem -noout -ext subjectAltName,nsCertType # only a subset