[pkix] RFC 5280 Extended Key Usage - explanation

[Peter Miškovič <[e-mail]>]

Hello

I want to ask you for an explanation of this part of RFC5280:

4.2.1.12. Extended use of the key

"If a certificate contains both a key usage extension and an extended key usage extension, then both extensions MUST be processed independently and the certificate MUST only be used for a purpose consistent with both extensions."

Means this that if I have the "digitalSignature" extension in the Key Usage certificate and the "id-kp-clientAuth" extension in the Extended Key Usage extension, I can use such certificate for TLS WWW client authentication only and not for digitally signing documents, for example PDF?

Or it can be understood that I can use such certificate only for digitally signing or TLS WWW client authentication, but not for anything else, e.g. Email protection, code signing?

What does "then both extensions MUST be processed independently" mean, if I should take into account their common connection as a result?

Thank you in advance.

Regards
Peter Miskovic
---------------------------------
Peter Miskovic
CA Chief Operating Officer

Disig, a.s.
Zahradnicka 151, 821 08 Bratislava 2, Slovakia

phone  [phone]
cell phone [phone]
[e-mail]
www.disig.sk