Vadims Podāns 🇱🇻

And just to avoid any misunderstanding: I'm not saying that your wish is wrong. I'm just saying that it unlikely will happen.

I would say..forget it. Based on my past experience with their proprietary stuff -- no chance. At least not within X.509 ecosystem. Maybe in MTC or whatever they come with for signing.

I don't believe it will happen any time soon. And I believe that in MSFT there are people who share your wish, but business reality is as this. AAS even can't afford their custom extension, so they have to reuse EKU to include signer ID info.

Even more: GUI doesn't do anything, it queries CryptFormatObject and render whatever the function returns. And it is a breaking change I'm talking about.

"The certificate viewer is long overdue for improvements anyway" -- right, because it is too expensive from support and backward compatibility perspective. You need to realize how much 3rd party code rely on current renderer.

And just add: EKU and X.509 profile is very generic and isn't tied exclusively to authenticode, TLS, S/MIME or whatever. Leaking context there would be the worst thing they did to CryptoAPI.

But "whatever they want" would cost a hell of money. Rewriting CryptoAPI for something that can change any time is expensive given how deep it is integrated and what is core part of OS.

Except that this doesn't scale in code level, because RFC 5280 doesn't support such contextual parsing not to say that it is a breaking change in UI. Moreover, no APIs would support this.

I found that it is pretty common for gopher.

It doesn't seem that dead, lots of modern clients on any platform. And I really wanted something calm and not crowded.

OID resolution is based on local OID mapping database, OIDs alone don't carry this info. And I'm not sure how local OID db could be updated with dynamic data. In AD you can centralize this, but not in workgroups, it will be individual process.

What do you mean "no easy way"? Getting EKU is that hard? Or did I miss something?

Hey Twitter fellows! I've got some updates, I'm now available in Gopher Hole: `gopher://hole.sysadmins.lv`. It is my new space for random thoughts and PKI rants.

It is by design. And this is why I wrote SID Extension handling policy module: github.com/PKISolutions/ADCS…. Offline templates disable deep extension check on CA side.

Thanks!

Thanks!

It happened again! 19 years in the program! #mvpbuzz @MVPAward

There is a reason: vendor locking and a reminder that you don't own your data, they own.

Completely agree! Had experience with confluence in the past: never again. Ever.