D
Extensions

OracleAS Certificate Authority is compliant with the X.509 V3 and IETF's PKIX standards, and supports the following extensions:

1. OCA's CA certificates contain the following extensions
   1. Basic Constraints Extension: Critical
      • CA flag set to true

      • PathLength for root (self-sign) certificate is hardcoded to 3.

      • PathLength for sub CA is between 0 and 2, depending on the pathlength of issuer's (upper CA) certificate.

   2. KeyUsage Extension: Critical

   The following bits are set on:

   • Digital Signature

   • Key Cert Sign

   • CRL Sign

   • Non-Repudiation

2. OCA's End-Entity SSL/Encryption Certificates
   1. Key Usage Extension: Non-Critical

   The following bits set on:

   • Digital Signature

   • Key Encipherment

   • Key Agreement

   • Non-Repudiation

3. Code signing certificates
   1. Key Usage Extension: Non-Critical

   The following bits set on:

   • + Digital Signature

4. SMIME-Signing Certificates
   1. Key Usage Extension: Non-Critical

   The following bits set on:

   • Digital Signature

   • Data Encipherment

   • Non-Repudiation