EKU TsingYao Client - 清曜客户端证书扩展密钥用法 —— 仅用于客户端或最终用户身份认证，不得用于服务器认证或代码签名

Go back Parent node: Eku - 扩展密钥用法（EKU）弧 —— 用于限定证书用途范围的清曜私有 EKU 标识 (1.3.6.1.4.1.59719.5.3)

Technical information

Dot notation:	`1.3.6.1.4.1.59719.5.3.2`
ASN.1 notation:	`{ iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) tsingyao(59719) pki-certificate-system(5) eku(3) eku-tsingyao-client(2) }`
OID-IRI notation:	`/ISO/Identified-Organization/6/1/4/1/TsingYao/PKICertificateSystem/Eku/EkuTsingyaoClient`
WEID notation:	`weid:P-1A2V-5-3-2-1`
DER encoding:	`06:0B:2B:06:01:04:01:83:D2:47:05:03:02`

Description

English:
Extended Key Usage (EKU) for TsingYao client certificates, indicating that the certificate may only be used for identity authentication of TsingYao clients or end users and shall not be used for server authentication or code signing purposes.
Status: registered but unused. No certificate has carried this EKU; when used, place it together with the end-user certificate policy (1.3.6.1.4.1.59719.5.1.800) and the end-user certificate type (1.3.6.1.4.1.59719.5.800). The unused state shall be re-verified at each revision of this file.
Recommendation: combine this private EKU with the standard client authentication EKU so that standard TLS, VPN and 802.1X stacks accept the certificate for client authentication.
See also: 1.3.6.1.4.1.59719.5.3, 1.3.6.1.4.1.59719.5.800, 1.3.6.1.4.1.59719.5.1.800.
Verification: 2026-10-22 — this arc and all its sub-ordinates are confirmed unused; re-verify the unused state at each revision of this file.

中文:
清曜客户端证书扩展密钥用法，表示该证书仅可用于清曜客户端或最终用户的身份认证，不得用于服务器认证或代码签名等用途。
状态：已注册但未使用。尚未有证书携带该 EKU；使用时应与最终用户证书策略（1.3.6.1.4.1.59719.5.1.800）及最终用户证书类型（1.3.6.1.4.1.59719.5.800）一并出现。本文件每次修订时须重新核验该未使用状态。
建议：应将本私有 EKU 与标准客户端认证 EKU 并用，使标准 TLS、VPN 与 802.1X 栈接受该证书完成客户端认证。
关联节点：1.3.6.1.4.1.59719.5.3、1.3.6.1.4.1.59719.5.800、1.3.6.1.4.1.59719.5.1.800。
核验：2026-10-22 —— 本弧及其全部下级标识均确认未使用，本文件每次修订时须重新核验该未使用状态。

Registration Authority

tsingyao
E-Mail: op@tsingyao.net
JunQing Gu
TsingYao Technology Limited

The RA does not want to publish their personal information.

Subordinate objects

ID	Base36	ASN.1 IDs (comma sep.)	IRI IDs (comma sep.)	RA	Comment	Created	Updated
No items available

Alternative Identifiers

Identifier	Description
aid:D276000186B200054278A5EC2581D748 (No PIX allowed)	OIDplus Information Object Application Identifier (ISO/IEC 7816)
guid:4278a5ec-0000-8000-a6d3-0cbfdea3b20d	OIDplus Information Object Custom UUID (RFC 9562)
guid:e3537a56-081b-34a4-ac0f-98b8012522fb	Name based version 3 / MD5 UUID with namespace UUID_NAMEBASED_NS_OID
guid:f11a8c18-e37f-5bac-87fd-5a87a20d606b	Name based version 5 / SHA1 UUID with namespace UUID_NAMEBASED_NS_OID
mac:B2-39-A5-81-D7-48	OIDplus Information Object MAC address, Unicast (AAI)
mac:B3-39-A5-81-D7-48	OIDplus Information Object MAC address, Multicast (AAI)
weid:P-1A2V-5-3-2-1	WEID notation
x500dn:/dc=com/dc=example/cn=oidplus/1.3.6.1.4.1.37476.2.5.2.9.4.1=1115203052/1.3.6.1.4.1.37476.2.5.2.9.4.2=629266248	OIDplus Information Object X.500 DN