X.509 / Certificate OIDs
Searchable reference for common X.509 OIDs. RDN attribute types (CN, O, C), certificate extensions (KU, EKU, SAN, BC), signature algorithms (RSA, ECDSA), and FIDO attestation extensions.
What this reference covers
Spec
RFC 5280 (X.509); RFC 8410 (Ed25519/Ed448); FIDO Alliance attestation specs.
Companion tool
Reading
What this reference does not cover
This resolves the OIDs you meet most often in PKIX certificates. It is not the full registry: the OID space is unbounded and largely delegated, so any organisation with an arc under 1.3.6.1.4.1 can define values that will never appear in a general reference.
An OID you cannot resolve is not automatically a problem. What matters is whether the extension carrying it is marked critical: a critical extension a verifier does not understand must cause rejection, while a non-critical one may safely be ignored. Check the critical flag before treating an unknown OID as an error.
Frequently asked questions
What is an OID?
An Object Identifier — a globally unique dotted-number name from a hierarchical registry, used throughout X.509 to name attributes, extensions and algorithms.
Why does PKIX use OIDs rather than names?
Because they are unambiguous and extensible without central coordination beyond arc allocation. Anyone with an arc can define new values that will never collide.
What do the common RDN attribute OIDs mean?
2.5.4.3 is common name, 2.5.4.6 country, 2.5.4.10 organisation and 2.5.4.11 organisational unit. These are the components of a distinguished name.
Which arcs will I see most often?
2.5.29 for standard certificate extensions, 1.2.840.113549 for RSA algorithms, 1.2.840.10045 for ECDSA, and 1.3.6.1.4.1 for private enterprise arcs.
What should I do with an OID I cannot resolve?
Treat it as vendor-specific and check whether it is marked critical. A critical unknown extension must cause rejection; a non-critical one may be ignored.