If a certificate has an extendedKeyUsage extension, a TLS client requires serverAuth in it. The CA/Browser Forum Baseline Requirements (§7.1.2.7.10) require serverAuth in subscriber TLS certificates, allow clientAuth, and forbid codeSigning, emailProtection, timeStamping and OCSPSigning alongside it.
1.3.6.1.5.5.7.3.1
id-kp-serverAuth
id-kp-serverAuth: the extended key usage for TLS server certificates.
1.3.6.1.5.5.7.3.1 identifies id-kp-serverAuth, an extended key usage. DER: 06082b06010505070301.
- Dotted notation
1.3.6.1.5.5.7.3.1- DER encoding
06082b06010505070301- Category
- an extended key usage
- Also known as
serverAuth, TLS Web Server Authentication- OpenSSL short name
serverAuth- OpenSSL long name
TLS Web Server Authentication- Parent
- 1.3.6.1.5.5.7.3 id-kp
- Listed by
- the ecdsa.com catalog, an IANA SMI registry