Added a real key purpose OID as example

diff --git a/lib/includes/gnutls/x509.h b/lib/includes/gnutls/x509.h
index b54832a63effb4f5db96c9fb7edadfe5e7e7341a..a0b11f14181c133edc686150ce2221436b6fba50 100644 (file)
--- a/lib/includes/gnutls/x509.h
+++ b/lib/includes/gnutls/x509.h
@@ -72,6 +72,7 @@ extern "C"
 #define GNUTLS_KP_TLS_WWW_SERVER               "1.3.6.1.5.5.7.3.1"
 #define GNUTLS_KP_TLS_WWW_CLIENT                "1.3.6.1.5.5.7.3.2"
 #define GNUTLS_KP_CODE_SIGNING                 "1.3.6.1.5.5.7.3.3"
+#define GNUTLS_KP_MS_SMART_CARD_LOGON          "1.3.6.1.4.1.311.20.2.2"
 #define GNUTLS_KP_EMAIL_PROTECTION             "1.3.6.1.5.5.7.3.4"
 #define GNUTLS_KP_TIME_STAMPING                        "1.3.6.1.5.5.7.3.8"
 #define GNUTLS_KP_OCSP_SIGNING                 "1.3.6.1.5.5.7.3.9"

diff --git a/src/certtool-args.def b/src/certtool-args.def
index a3d45764d1206ffcf2ab3987090548a7ea67ea6b..6dcb11d37f022623be3753bd377091bb6f79bd4e 100644 (file)
--- a/src/certtool-args.def
+++ b/src/certtool-args.def
@@ -554,9 +554,6 @@ email = "none@@none.org"
 # Challenge password used in certificate requests
 challenge_passwd = 123456
 
-# key_purpose_oid = 1.2.3.4.5.6.7
-# key_purpose_oid = 1.2.3.4.5.6.7.9
-
 # An URL that has CRLs (certificate revocation lists)
 # available. Needed in CA certificates.
 #crl_dist_points = "http://www.getcrl.crl/getcrl/"
@@ -564,6 +561,11 @@ challenge_passwd = 123456
 # Whether this is a CA certificate or not
 #ca
 
+# for microsoft smart card logon
+# key_purpose_oid = 1.3.6.1.4.1.311.20.2.2
+
+### Other predefined key purpose OIDs
+
 # Whether this certificate will be used for a TLS client
 #tls_www_client
 
@@ -597,6 +599,8 @@ signing_key
 # Whether this key will be used for IPsec IKE operations.
 #ipsec_ike_key
 
+### end of key purpose OIDs
+
 # When generating a certificate from a certificate
 # request, then honor the extensions stored in the request
 # and store them in the real certificate.