Comment Comment by arcfour Rare in public PKIs, yes; not so much in private ones, I would imagine.From my limited experience (using them at home) they seem to be fairly well supported in client libraries, actually!- OpenSSL has full support, https://docs.openssl.org/master/man5/x509v3_config/- GnuTLS has full support, https://www.gnutls.org/manual/html_node/X509-certificate-API...- go (crypto/x509) supports everything except DirectoryName constraints, https://pkg.go.dev/crypto/x509#Certificate.Verify- Python (pyca/cryptography) has full support, https://cryptography.io/en/stable/x509/reference/#cryptograp...- Windows/Schannel has full support, https://learn.microsoft.com/en-us/windows/win32/seccertenrol...- Java has full support, https://docs.oracle.com/en/java/javase/21/docs/api/java.base...- I know that NSS also supports them from experience but (sorry!) couldn't find the docs in a few seconds of searching- I know that Strongswan supports them well because I actually opened an issue about it a few years back and got it fixed :-)(Just a few off the top of my head) parent arcfour 11 days ago
From my limited experience (using them at home) they seem to be fairly well supported in client libraries, actually!
- OpenSSL has full support, https://docs.openssl.org/master/man5/x509v3_config/
- GnuTLS has full support, https://www.gnutls.org/manual/html_node/X509-certificate-API...
- go (crypto/x509) supports everything except DirectoryName constraints, https://pkg.go.dev/crypto/x509#Certificate.Verify
- Python (pyca/cryptography) has full support, https://cryptography.io/en/stable/x509/reference/#cryptograp...
- Windows/Schannel has full support, https://learn.microsoft.com/en-us/windows/win32/seccertenrol...
- Java has full support, https://docs.oracle.com/en/java/javase/21/docs/api/java.base...
- I know that NSS also supports them from experience but (sorry!) couldn't find the docs in a few seconds of searching
- I know that Strongswan supports them well because I actually opened an issue about it a few years back and got it fixed :-)
(Just a few off the top of my head)