list the OIDs in the certtool cfg file documentation

diff --git a/src/certtool-args.def b/src/certtool-args.def
index 8e4662dda92457143599a793f728577c0e269467..b21d7bb7870ee12b520c52a2506ff90496033ee1 100644 (file)
--- a/src/certtool-args.def
+++ b/src/certtool-args.def
@@ -674,18 +674,22 @@ challenge_password = 123456
 # The following key usage flags are used by CAs and end certificates
 
 # Whether this certificate will be used to sign data (needed
-# in TLS DHE ciphersuites).
+# in TLS DHE ciphersuites). This is the digitalSignature flag
+# in RFC5280 terminology.
 signing_key
 
 # Whether this certificate will be used to encrypt data (needed
 # in TLS RSA ciphersuites). Note that it is preferred to use different
-# keys for encryption and signing.
+# keys for encryption and signing. This is the keyEncipherment flag
+# in RFC5280 terminology.
 encryption_key
 
-# Whether this key will be used to sign other certificates.
+# Whether this key will be used to sign other certificates. The
+# keyCertSign flag in RFC5280 terminology.
 #cert_signing_key
 
-# Whether this key will be used to sign CRLs.
+# Whether this key will be used to sign CRLs. The
+# cRLSign flag in RFC5280 terminology.
 #crl_signing_key
 
 
@@ -695,31 +699,35 @@ encryption_key
 # to clarify its purpose. Some CAs also use it to indicate
 # the types of certificates they are purposed to sign.
 
+
 # Whether this certificate will be used for a TLS client;
-# this sets the id-kp-serverAuth of extended key usage.
+# this sets the id-kp-serverAuth (1.3.6.1.5.5.7.3.1) of 
+# extended key usage.
 #tls_www_client
 
 # Whether this certificate will be used for a TLS server;
-# This sets the id-kp-clientAuth of extended key usage.
+# This sets the id-kp-clientAuth (1.3.6.1.5.5.7.3.2) of 
+# extended key usage.
 #tls_www_server
 
 # Whether this key will be used to sign code. This sets the
-# id-kp-codeSigning of extended key usage extension.
+# id-kp-codeSigning (1.3.6.1.5.5.7.3.3) of extended key usage
+# extension.
 #code_signing_key
 
 # Whether this key will be used to sign OCSP data. This sets the
-# id-kp-OCSPSigning of extended key usage extension.
+# id-kp-OCSPSigning (1.3.6.1.5.5.7.3.9) of extended key usage extension.
 #ocsp_signing_key
 
 # Whether this key will be used for time stamping. This sets the
-# id-kp-timeStamping of extended key usage extension.
+# id-kp-timeStamping (1.3.6.1.5.5.7.3.8) of extended key usage extension.
 #time_stamping_key
 
 # Whether this key will be used for email protection. This sets the
-# id-kp-emailProtection of extended key usage extension.
+# id-kp-emailProtection (1.3.6.1.5.5.7.3.4) of extended key usage extension.
 #email_protection_key
 
-# Whether this key will be used for IPsec IKE operations.
+# Whether this key will be used for IPsec IKE operations (1.3.6.1.5.5.7.3.17).
 #ipsec_ike_key
 
 ## adding custom key purpose OIDs