nss tech note3
there are 8 key usages: cert_sign crl_sign data_encipherment digital_signature govt_approved key_agreement key_encipherment non_repudiation there are 9 cert types: email email_ca object_signing object_signing_ca ssl_ca ssl_client ssl_server status_responder time_stamp for the cert being checked, the requirements are: cert usage requried key usage required cert type -------------------- -------------------- ----------------------- sslclient: digital...
..._signature; ssl_client; sslserver: key_agreement or key_encipherment; ssl_server; sslserverwithstepup: govt_approved and ssl_server key_agreement or key_encipherment sslca: cert_sign; ssl_ca; emailsigner: digital_signature; email; emailrecipient: key_agreement or key_encipherment; email; objectsigner: digital_signature; object_signing; statusresponder: digital_signature; status_responder; verifyca cert_sign ssl_ca or email_ca or object_signing_ca or status_responder for ca certs in the cert chain, the requirements are: cert usage requried key usage required cert type -------------------- -------------------- ----------------------- sslserverwithstepup: govt_approved and cert_sign; ssl_ca; sslclient: cert_sign; ssl_ca; sslserver: ce...
... /* x.509 v3 key usage extension flags */ #define ku_digital_signature (0x80) /* bit 0 */ #define ku_non_repudiation (0x40) /* bit 1 */ #define ku_key_encipherment (0x20) /* bit 2 */ #define ku_data_encipherment (0x10) /* bit 3 */ #define ku_key_agreement (0x08) /* bit 4 */ #define ku_key_cert_sign (0x04) /* bit 5 */ #define ku_crl_sign (0x02) /* bit 6 */ #define...

Python binding for NSS
mode nss.set_ocsp_timeout nss.clear_ocsp_cache nss.set_ocsp_default_responder nss.enable_ocsp_default_responder nss.disable_ocsp_default_responder the following files were added: src/py_traceback.h doc/examples/verify_cert.py test/test_misc.py the following constants were added: nss.ku_digital_signature nss.ku_non_repudiation nss.ku_key_encipherment nss.ku_data_encipherment nss.ku_key_agreement nss.ku_key_cert_sign nss.ku_crl_sign nss.ku_encipher_only nss.ku_all nss.ku_digital_signature_or_non_repudiation nss.ku_key_agreement_or_encipherment nss.ku_ns_govt_approved nss.pk11certlistunique nss.pk11certlistus...

PKCS #11 Netscape Trust Objects - Network Security Services
cka_trust_digital_signature ck_trust level of trust for digital signature key usage purpose.