Eku - 扩展密钥用法（EKU）弧 —— 用于限定证书用途范围的清曜私有 EKU 标识

Go back Parent node: PKI Certificate System - 公钥基础设施（PKI）证书系统子树 —— 证书策略、类型标识、私有扩展、EKU、属性与协议 (1.3.6.1.4.1.59719.5)

Technical information

Dot notation:	`1.3.6.1.4.1.59719.5.3`
ASN.1 notation:	`{ iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) tsingyao(59719) pki-certificate-system(5) eku(3) }`
OID-IRI notation:	`/ISO/Identified-Organization/6/1/4/1/TsingYao/PKICertificateSystem/Eku`
WEID notation:	`weid:P-1A2V-5-3-8`
DER encoding:	`06:0A:2B:06:01:04:01:83:D2:47:05:03`

Description

English:
Extended Key Usage (EKU) arc. Defines TsingYao private extended key usage identifiers that restrict the purposes for which a certificate may be used; when an EKU is present, the relying party shall reject the certificate for purposes not covered by the EKU.
Usage rule: private EKU identifiers may be combined with standard EKU identifiers, but shall never replace them where a standard EKU is expected by common software; keep private EKU consistent with the certificate policy and document its semantics in the Certification Practice Statement (CPS).
Status: registered but unused. No private EKU has been placed in an issued certificate; allocate identifiers in ascending order and publish the semantics before use. The unused state shall be re-verified at each revision of this file.
Recommendation: EKU semantics are consumed by relying parties for authorization decisions; changing the meaning of an allocated EKU is a security relevant change and requires a new identifier.
See also: 1.3.6.1.4.1.59719.5.3.1, 1.3.6.1.4.1.59719.5.3.2, 1.3.6.1.4.1.59719.5.1.
Verification: 2026-10-22 — this arc and all its sub-ordinates are confirmed unused; re-verify the unused state at each revision of this file.

中文:
扩展密钥用法（Extended Key Usage，EKU）弧。定义清曜私有扩展密钥用法标识，用于限定证书的用途范围；当证书包含 EKU 时，依赖方应拒绝将该证书用于 EKU 未涵盖的用途。
使用规则：私有 EKU 标识可与标准 EKU 标识并用，但在通用软件期望标准 EKU 的场景下不得替代标准 EKU；应保持私有 EKU 与证书策略一致，并在认证业务声明（CPS）中说明其语义。
状态：已注册但未使用。尚未有已签发证书携带本弧私有 EKU；分配标识应按升序进行，并在使用前公布语义。本文件每次修订时须重新核验该未使用状态。
建议：EKU 语义被依赖方用于授权判定，变更已分配 EKU 的含义属于安全相关变更，必须启用新标识。
关联节点：1.3.6.1.4.1.59719.5.3.1、1.3.6.1.4.1.59719.5.3.2、1.3.6.1.4.1.59719.5.1。
核验：2026-10-22 —— 本弧及其全部下级标识均确认未使用，本文件每次修订时须重新核验该未使用状态。

Registration Authority

tsingyao
E-Mail: op@tsingyao.net
JunQing Gu
TsingYao Technology Limited

The RA does not want to publish their personal information.

Subordinate objects

ID	Base36	ASN.1 IDs (comma sep.)	IRI IDs (comma sep.)	RA	Comment	Created	Updated
1	1	eku-tsingyao-device	EkuTsingyaoDevice	tsingyao
2	2	eku-tsingyao-client	EkuTsingyaoClient	tsingyao

Alternative Identifiers

Identifier	Description
aid:D276000186B200054278A5EC3289A0C8 (No PIX allowed)	OIDplus Information Object Application Identifier (ISO/IEC 7816)
aid:D276000186F62B0601040183D2470503 (No PIX allowed)	Application Identifier (ISO/IEC 7816)
guid:4278a5ec-0000-8000-a6d3-a11b9c63eafa	OIDplus Information Object Custom UUID (RFC 9562)
guid:82fd3a9b-de3c-3a1f-a9e1-fa5ead48f7cf	Name based version 3 / MD5 UUID with namespace UUID_NAMEBASED_NS_OID
guid:cd9bec78-039e-54af-a74e-6f3c80edf10b	Name based version 5 / SHA1 UUID with namespace UUID_NAMEBASED_NS_OID
mac:E2-A1-32-89-A0-C8	OIDplus Information Object MAC address, Unicast (AAI)
mac:E3-A1-32-89-A0-C8	OIDplus Information Object MAC address, Multicast (AAI)
weid:P-1A2V-5-3-8	WEID notation
x500dn:/dc=com/dc=example/cn=oidplus/1.3.6.1.4.1.37476.2.5.2.9.4.1=1115203052/1.3.6.1.4.1.37476.2.5.2.9.4.2=847880392	OIDplus Information Object X.500 DN