With the release of wolfSSL 5.9.4, Extended Key Usage (EKU) support for SSH X509 certificates was added. Under RFC 6187, two SSH key purposes are specified: id-kp-secureShellClient (1.3.6.1.5.5.7.3.21) and id-kp-secureShellServer (1.3.6.1.5.5.7.3.22). Previously the default ASN.1 template parser omitted SSH purposes and neither parser recognized the server purpose; both are now fully parsed. Builds configured with --enable-wolfssh introduce the EXTKEYUSE_SSH_SERVER_AUTH bit within the extExtKeyUsageSsh field of DecodedCert. This enables assigning a certificate specifically for server purposes on hosts or client use with cases such as Smart Card Logon purposes.
Additionally, this update improves the reliability of EKU OID matching. To identify OIDs, wolfSSL calculates a checksum over their encoded bytes. Because different OIDs can yield identical checksums, such as 1.3.6.1.5.5.7.3.1.16256 sharing a sum with id-kp-serverAuth, the EKU decoder now performs a full byte-for-byte comparison following an initial checksum match. This ensures key purpose bits are assigned strictly when authentic OIDs are present, while maintaining existing behavior for tracking and parsing unrecognized purposes.
Thanks to Satoru Kanno (GMO Connect Inc / GMO Internet Group Inc.) for reporting the OID collision issue. Implemented via GitHub pull request 11361, these improvements are available in wolfSSL 5.9.4. You can download the latest version from wolfssl.com, or reach out to facts@wolfssl.com or +1 425 245 8247 for further information.
Download wolfSSL Now