extended key usage extension

[maller]

Hi

I'm trying to generate server certificates and client certificates with extended key usage (EKU)(openssl) but I can't add it to the certificate. The EKU is necessary in order to specify server authentication usage or client authentication usage.

I´ve tried to modify my openssl.cnf file but without success.

Does anybody know how to do it?

thanks

[sbilgi]

I think IOS may not be able to understand the EKU.

[michaelr]

IOS understands the EKU. It is ignored unless the extension is marked critical. The reason I have been given for this is that there is no accepted standard for the contents of the extension so IOS wouldn't know what to accept or reject.

I have read some messages on IETF mailing lists which tend to indicate that use of EKU is discouraged in IKE. It may be used in other cases, though.

michael