Display Ext Key Usage

certifikit-cli/src/main/kotlin/app/cash/certifikit/cli/certificateOutput.kt

@@ -56,6 +56,9 @@ fun Certificate.prettyPrintCertificate(
     keyUsage?.let {
       append("Key Usage: ${it.decodeKeyUsage().joinToString(", ")}\n")
     }
+    extKeyUsage?.let {
+      append("Ext Key Usage: ${it.joinToString(", ")}\n")
+    }
 
     append(
         "Valid: \t${

certifikit-cli/src/test/kotlin/app/cash/certifikit/cli/CertificateOutputTest.kt

@@ -75,6 +75,7 @@ class CertificateOutputTest {
       |SHA256:	43a60e5aecabd897cbbcf833150740e18ff0c3d90bde132354dc85a4869b3269
       |SAN: 	cash.app, www.cash.app
       |Key Usage: DigitalSignature, KeyEncipherment
+      |Ext Key Usage: serverAuth, clientAuth
       |Valid: 	2020-04-13T13:25:49Z..2021-04-12T13:55:49Z
       |CA: false
     """.trimMargin())

certifikit/src/main/kotlin/app/cash/certifikit/CertificateAdapters.kt

@@ -16,6 +16,7 @@
 package app.cash.certifikit
 
 import app.cash.certifikit.Adapters.BIT_STRING
+import app.cash.certifikit.Adapters.OBJECT_IDENTIFIER
 import app.cash.certifikit.attestation.AttestationAdapters
 import java.math.BigInteger
 import java.net.ProtocolException
@@ -211,6 +212,7 @@ object CertificateAdapters {
       ObjectIdentifiers.subjectAlternativeName -> subjectAlternativeName
       ObjectIdentifiers.basicConstraints -> basicConstraints
       ObjectIdentifiers.keyUsage -> BIT_STRING
+      ObjectIdentifiers.extKeyUsage -> extKeyUsage
       AttestationAdapters.KEY_DESCRIPTION_OID -> AttestationAdapters.keyDescription
       else -> null
     }
@@ -464,4 +466,13 @@ object CertificateAdapters {
         )
       }
   )
+
+  /**
+   * ```
+   *  ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId
+   *
+   *  KeyPurposeId ::= OBJECT IDENTIFIER
+   * ```
+   */
+  internal val extKeyUsage: BasicDerAdapter<List<String>> = OBJECT_IDENTIFIER.asSequenceOf()
 }

certifikit/src/main/kotlin/app/cash/certifikit/ExtKeyUsage.kt

@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2020 Square, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package app.cash.certifikit
+
+data class ExtKeyUsage(val objectIdentifier: String) {
+  override fun toString(): String {
+    return name ?: objectIdentifier
+  }
+
+  val name: String?
+  get() {
+    return Known[objectIdentifier]
+  }
+
+  companion object {
+    val Known = mapOf(
+        "1.3.6.1.5.5.7.3.1" to "serverAuth",
+        "1.3.6.1.5.5.7.3.2" to "clientAuth",
+        "1.3.6.1.5.5.7.3.3" to "codeSigning",
+        "1.3.6.1.5.5.7.3.4" to "emailProtection",
+        "1.3.6.1.5.5.7.3.8" to "timeStamping",
+        "1.3.6.1.5.5.7.3.9" to "ocspSigning",
+        "1.3.6.1.5.5.7.3.5" to "ipsecEndSystem",
+        "1.3.6.1.5.5.7.3.6" to "ipsecTunnel",
+        "1.3.6.1.5.5.7.3.7" to "ipsecUser"
+    )
+  }
+}

certifikit/src/main/kotlin/app/cash/certifikit/certificates.kt

@@ -59,11 +59,13 @@ data class Certificate(
           ?.value as BitString?
     }
 
-  val extKeyUsage: Any?
+  @Suppress("UNCHECKED_CAST")
+  val extKeyUsage: List<ExtKeyUsage>?
     get() {
-      return tbsCertificate.extensions
+      val list = tbsCertificate.extensions
           .firstOrNull { it.id == ObjectIdentifiers.extKeyUsage }
-          ?.value
+          ?.value as List<String>?
+      return list?.map { ExtKeyUsage(it) }
     }
 
   @Suppress("UNCHECKED_CAST")

certifikit/src/test/kotlin/app/cash/certifikit/DerCertificatesTest.kt

@@ -575,7 +575,7 @@ internal class DerCertificatesTest {
                     Extension(
                         id = extendedKeyUsage,
                         critical = false,
-                        value = "301406082b0601050507030106082b06010505070302".decodeHex()
+                        value = listOf("1.3.6.1.5.5.7.3.1", "1.3.6.1.5.5.7.3.2")
                     ),
                     Extension(
                         id = authorityInfoAccess,