nss tech note3
r set of required cert type and key usage for all the ca certs in the cert chain. to determine if a cert is valid for a given cert usage, it must have the the cert type and key usage required for that cert usage, and all the ca certs in the cert chain must have the cert type and key usage required for ca certs for that cert usage. ...
...gnature govt_approved key_agreement key_encipherment non_repudiation there are 9 cert types: email email_ca object_signing object_signing_ca ssl_ca ssl_client ssl_server status_responder time_stamp for the cert being checked, the requirements are: cert usage requried key usage required cert type -------------------- -------------------- ----------------------- sslclient: digital_signature; ssl_client; sslserver: key_agreement or key_encipherment; ssl_server; sslserverwithstepup: govt_approved and ssl_server key_agreement or key_encipherment sslca: cert_sign; ssl_ca; emailsigner: digital_signature; email; emailrecipient: key_agreement or key_encipherment; email; objectsigner: digital_signature; object_signing; statusresponder: digital_signature; ...
...ent authentication certs with email addresses to also be used as email certs (provded they have adequate key usage). a cert with the extended key usage extension and the netscape cert type extension that as cert type ssl_ca is also always given cert type email_ca. this allows all ssl intermediate cas to also be used as email intermediate cas. ...

Python binding for NSS
mode nss.set_ocsp_timeout nss.clear_ocsp_cache nss.set_ocsp_default_responder nss.enable_ocsp_default_responder nss.disable_ocsp_default_responder the following files were added: src/py_traceback.h doc/examples/verify_cert.py test/test_misc.py the following constants were added: nss.ku_digital_signature nss.ku_non_repudiation nss.ku_key_encipherment nss.ku_data_encipherment nss.ku_key_agreement nss.ku_key_cert_sign nss.ku_crl_sign nss.ku_encipher_only nss.ku_all nss.ku_digital_signature_or_non_repudiation nss.ku_key_agreement_or_encipherment nss.ku_ns_govt_approved nss.pk11certlistunique nss.pk11certlistus...

PKCS #11 Netscape Trust Objects - Network Security Services
rotection purpose. cka_trust_ipsec_end_system ck_trust level of trust for ipsec end system purpose. cka_trust_ipsec_tunnel ck_trust level of trust for ipsec tunnel purpose. cka_trust_ipsec_user ck_trust level of trust for ipsec user purpose. cka_trust_time_stamping ck_trust level of trust for time stamping purpose. cka_trust_digital_signature ck_trust level of trust for digital signature key usage purpose. cka_trust_non_repudiation ck_trust level of trust for non-repudiation key usage purpose. cka_trust_key_encipherment ck_trust level of trust for key-encipherment key usage purpose. cka_trust_key_agreement ck_trust level of trust for key-agreement key usage purpose. ...