X.509 extension reference database
Common X.509 v3 extensions — what they are, criticality, and what they encode. Pair with the X.509 viewer to walk live certs.
What this reference covers
What this reference does not cover
This lists the extensions you will commonly meet and what they mean. It does not tell you which ones a given profile requires — that comes from the issuing CA's certificate policy, from CA/Browser Forum requirements for public TLS, or from a scheme profile such as PIV or eIDAS. The same extension can be mandatory in one profile and forbidden in another.
It is also not a validation guide. Path building, name constraints, policy mapping and revocation checking are where certificates actually fail, and a certificate whose extensions all look correct here can still be rejected for any of those reasons.
Frequently asked questions
What is an X.509 v3 extension?
An optional typed field carrying policy or identity information beyond the basic certificate fields, each identified by an OID and marked critical or non-critical.
What does marking an extension critical mean?
That a verifier which does not understand it must reject the certificate. Marking too much critical breaks interoperability; marking too little weakens the constraints you meant to impose.
What is the difference between key usage and extended key usage?
Key usage constrains the cryptographic operations the key may perform; extended key usage constrains the purpose, such as TLS server or client authentication. A certificate can fail validation on either.
Why do modern clients ignore Common Name?
Because the Subject Alternative Name extension replaced it for identity. A certificate without SAN will not validate in any current browser regardless of its CN.
What does Basic Constraints do?
Declares whether the subject is a CA and optionally limits the path length below it. A missing or false CA flag on an intermediate breaks the entire chain.