Client Authentication (1.3.6.1.5.5.7.3.2) OID in server certificates

Question

For a project I'm working on I have to generate web server certificate. As I understand it, server certificates should contain the Server Authentication OID (1.3.6.1.5.5.7.3.1). But as I see all server certificates issued by well known issuers like Verisign contain also Client Authentication OID (1.3.6.1.5.5.7.3.2).

I tried to use certificate with only server authentication OID - seems it works fine.

Questions

• Why is the client authentication OID needed for server certificates?
• Is it needed for some legacy support or there is another reason for it?

Answer 1

The difference between the two is exactly how they're described.

For using a certificate as a server (on the receiving end of the connection), it must have the Server extended key usage.

In a 2-way SSL connection, where the client (on the initiating end of the connection) presents a certificate back to the server, it must have the Client extended key usage.

If you're never using the certificate as a client cert, you won't need the Client Authentication OID.

Answer 2

I think it is also useful to point out that one of the main distinctions between Client and Server certificates is that:

1. Server Certificates are used for encryption and decryption of data;
2. Client Certificates represent a user identity. That is, to prove the client's identity to a remote server.