anyExtendedKeyUsage

anyExtendedKeyUsage is a value in the X.509 Extended Key Usage (EKU) extension, identified by the OID 2.5.29.37.0. Its presence signals that there are no specific EKU restrictions on the certificate’s key; in other words, the certificate may be used for any EKU purpose supported by the validation policy, subject to other constraints in the certificate such as KeyUsage bits or policy constraints.

The EKU extension typically contains a sequence of EKU OIDs for purposes like serverAuth, clientAuth, codeSigning, emailProtection, or timestamping. When the anyExtendedKeyUsage OID is included, it indicates an unconstrained EKU. Some implementations treat this as equivalent to having no EKU restrictions, while others may still enforce certain checks depending on the platform or policy in use.

Usage scenarios vary: anyExtendedKeyUsage is relatively uncommon in end-entity certificates and is more often seen in certain CA or intermediate certificates where an issuer wants to permit downstream certificates to define their own EKUs. However, behavior can differ between libraries and deployments; some systems may ignore this value if other EKUs are present or may apply additional policy constraints.

Security considerations include the potential broadening of acceptable uses for the certificate’s key. Because any EKU reduces granular control, it should be used with caution and in alignment with organizational PKI policy, typically alongside other constraints such as BasicConstraints, KeyUsage, and certificate policies.

See also: Extended Key Usage, OID 2.5.29.37.0, RFC 5280.