Add documentation page for our OIDs

Author: aarongable

content/base-l10n/docs/oids.md

@@ -0,0 +1,9 @@
+---
+title: Object Identifiers
+slug: oids
+date: 2025-09-08
+lastmod: 2025-09-08
+show_lastmod: false
+untranslated: 1
+---
+

content/ca/docs/oids.md

@@ -0,0 +1,9 @@
+---
+title: Object Identifiers
+slug: oids
+date: 2025-09-08
+lastmod: 2025-09-08
+show_lastmod: false
+untranslated: 1
+---
+

content/cs/docs/oids.md

@@ -0,0 +1,9 @@
+---
+title: Object Identifiers
+slug: oids
+date: 2025-09-08
+lastmod: 2025-09-08
+show_lastmod: false
+untranslated: 1
+---
+

content/da/docs/oids.md

@@ -0,0 +1,9 @@
+---
+title: Object Identifiers
+slug: oids
+date: 2025-09-08
+lastmod: 2025-09-08
+show_lastmod: false
+untranslated: 1
+---
+

content/de/docs/oids.md

@@ -0,0 +1,9 @@
+---
+title: Object Identifiers
+slug: oids
+date: 2025-09-08
+lastmod: 2025-09-08
+show_lastmod: false
+untranslated: 1
+---
+

content/el/docs/oids.md

@@ -0,0 +1,9 @@
+---
+title: Object Identifiers
+slug: oids
+date: 2025-09-08
+lastmod: 2025-09-08
+show_lastmod: false
+untranslated: 1
+---
+

content/en/certificates.md

@@ -24,6 +24,7 @@ Note that Root CAs don't have expiration dates in quite the same way that other
   * Certificate details (self-signed): [crt.sh](https://crt.sh/?id=9314791), [der](/certs/isrgrootx1.der), [pem](/certs/isrgrootx1.pem), [txt](/certs/isrgrootx1.txt)
   * Certificate details (cross-signed by DST Root CA X3): [crt.sh](https://crt.sh/?id=3958242236), [der](/certs/isrg-root-x1-cross-signed.der), [pem](/certs/isrg-root-x1-cross-signed.pem), [txt](/certs/isrg-root-x1-cross-signed.txt) (retired)
   * Test websites: [valid](https://valid-isrgrootx1.letsencrypt.org/), [revoked](https://revoked-isrgrootx1.letsencrypt.org/), [expired](https://expired-isrgrootx1.letsencrypt.org/)
+  * OID: 1.3.6.1.4.1.44947.1.2.1
 * **ISRG Root X2**
   * Subject: `O = Internet Security Research Group, CN = ISRG Root X2`
   * Key type: `ECDSA P-384`
@@ -33,6 +34,7 @@ Note that Root CAs don't have expiration dates in quite the same way that other
   * Certificate details (cross-signed by ISRG Root X1): [crt.sh](https://crt.sh/?id=3334561878), [der](/certs/isrg-root-x2-cross-signed.der), [pem](/certs/isrg-root-x2-cross-signed.pem), [txt](/certs/isrg-root-x2-cross-signed.txt)
   * Certificate details (second cross-sign by ISRG Root X1): [der](/certs/gen-y/root-x2-by-x1.der), [pem](/certs/gen-y/root-x2-by-x1.pem), [txt](/certs/gen-y/root-x2-by-x1.txt)
   * Test websites: [valid](https://valid-isrgrootx2.letsencrypt.org/), [revoked](https://revoked-isrgrootx2.letsencrypt.org/), [expired](https://expired-isrgrootx2.letsencrypt.org/)
+  * OID: 1.3.6.1.4.1.44947.1.2.2
 
 These roots are not yet included in Root Program Trust Stores, but will be submitted for inclusion soon:
 
@@ -43,13 +45,15 @@ These roots are not yet included in Root Program Trust Stores, but will be submi
   * Certificate details (self-signed): [der](/certs/gen-y/root-ye.der), [pem](/certs/gen-y/root-ye.pem), [txt](/certs/gen-y/root-ye.txt)
   * Certificate details (cross-signed by ISRG Root X2): [der](/certs/gen-y/root-ye-by-x2.der), [pem](/certs/gen-y/root-ye-by-x2.pem), [txt](/certs/gen-y/root-ye-by-x2.txt)
   * Test websites: Forthcoming
+  * OID: 1.3.6.1.4.1.44947.1.2.3
 * **ISRG Root YR**
   * Subject: `O = ISRG, CN = Root YR`
   * Key type: `RSA 4096`
   * Trusted until: N/A (generated 2025-09-03)
   * Certificate details (self-signed): [der](/certs/gen-y/root-yr.der), [pem](/certs/gen-y/root-yr.pem), [txt](/certs/gen-y/root-yr.txt)
   * Certificate details (cross-signed by ISRG Root X1): [der](/certs/gen-y/root-yr-by-x1.der), [pem](/certs/gen-y/root-yr-by-x1.pem), [txt](/certs/gen-y/root-yr-by-x1.txt)
   * Test websites: Forthcoming
+  * OID: 1.3.6.1.4.1.44947.1.2.4
 
 For additional information on the compatibility of our root certificates with various devices and trust stores, see [Certificate Compatibility](/docs/cert-compat).
 
@@ -66,25 +70,29 @@ All intermediate certificate Subjects have a Country field of `C = US`.
   * CA details: [crt.sh](https://crt.sh/?caid=295813), [issued certs](https://crt.sh/?Identity=%25&iCAID=295813)
   * Certificate details (signed by ISRG Root X2): [der](/certs/2024/e7.der), [pem](/certs/2024/e7.pem), [txt](/certs/2024/e7.txt)
   * Certificate details (cross-signed by ISRG Root X1): [der](/certs/2024/e7-cross.der), [pem](/certs/2024/e7-cross.pem), [txt](/certs/2024/e7-cross.txt)
+  * OID: 1.3.6.1.4.1.44947.1.2.2.5
 * **Let's Encrypt E8**
   * Subject: `O = Let's Encrypt, CN = E8`
   * Key type: `ECDSA P-384`
   * Valid until: 2027-03-12
   * CA details: [crt.sh](https://crt.sh/?caid=295809), [issued certs](https://crt.sh/?Identity=%25&iCAID=295809)
   * Certificate details (signed by ISRG Root X2): [der](/certs/2024/e8.der), [pem](/certs/2024/e8.pem), [txt](/certs/2024/e8.txt)
   * Certificate details (cross-signed by ISRG Root X1): [der](/certs/2024/e8-cross.der), [pem](/certs/2024/e8-cross.pem), [txt](/certs/2024/e8-cross.txt)
+  * OID: 1.3.6.1.4.1.44947.1.2.2.6
 * **Let's Encrypt R12**
   * Subject: `O = Let's Encrypt, CN = R12`
   * Key type: `RSA 2048`
   * Valid until: 2027-03-12
   * CA details: [crt.sh](https://crt.sh/?caid=295816), [issued certs](https://crt.sh/?Identity=%25&iCAID=295816)
   * Certificate details (signed by ISRG Root X1): [der](/certs/2024/r12.der), [pem](/certs/2024/r12.pem), [txt](/certs/2024/r12.txt)
+  * OID: 1.3.6.1.4.1.44947.1.2.1.5
 * **Let's Encrypt R13**
   * Subject: `O = Let's Encrypt, CN = R13`
   * Key type: `RSA 2048`
   * Valid until: 2027-03-12
   * CA details: [crt.sh](https://crt.sh/?caid=295817), [issued certs](https://crt.sh/?Identity=%25&iCAID=295817)
   * Certificate details (signed by ISRG Root X1): [der](/certs/2024/r13.der), [pem](/certs/2024/r13.pem), [txt](/certs/2024/r13.txt)
+  * OID: 1.3.6.1.4.1.44947.1.2.1.6
 
 Click below for details on additional intermediates which are not part of the active issuance hierarchy:
 
@@ -100,12 +108,14 @@ These intermediate CAs have currently-valid certificates, but are not being issu
   * CA details: [crt.sh](https://crt.sh/?caid=295812), [issued certs](https://crt.sh/?Identity=%25&iCAID=295812)
   * Certificate details (signed by ISRG Root X2): [der](/certs/2024/e9.der), [pem](/certs/2024/e9.pem), [txt](/certs/2024/e9.txt)
   * Certificate details (cross-signed by ISRG Root X1): [der](/certs/2024/e9-cross.der), [pem](/certs/2024/e9-cross.pem), [txt](/certs/2024/e9-cross.txt)
+  * OID: 1.3.6.1.4.1.44947.1.2.2.7
 * **Let's Encrypt R14**
   * Subject: `O = Let's Encrypt, CN = R14`
   * Key type: `RSA 2048`
   * Valid until: 2027-03-12
   * CA details: [crt.sh](https://crt.sh/?caid=295818), [issued certs](https://crt.sh/?Identity=%25&iCAID=295818)
   * Certificate details (signed by ISRG Root X1): [der](/certs/2024/r14.der), [pem](/certs/2024/r14.pem), [txt](/certs/2024/r14.txt)
+  * OID: 1.3.6.1.4.1.44947.1.2.1.7
 
 </details>
 
@@ -119,31 +129,37 @@ These intermediate CAs were issued in 2025, and we expect to begin issuing from
   * Key type: `ECDSA P-384`
   * Valid until: 2028-09-02
   * Certificate details: [der](/certs/gen-y/int-ye1.der), [pem](/certs/gen-y/int-ye1.pem), [txt](/certs/gen-y/int-ye1.txt)
+  * OID: 1.3.6.1.4.1.44947.1.2.3.1
 * **Let's Encrypt YE2**
   * Subject: `O = Let's Encrypt, CN = YE2`
   * Key type: `ECDSA P-384`
   * Valid until: 2028-09-02
   * Certificate details: [der](/certs/gen-y/int-ye2.der), [pem](/certs/gen-y/int-ye2.pem), [txt](/certs/gen-y/int-ye2.txt)
+  * OID: 1.3.6.1.4.1.44947.1.2.3.2
 * **Let's Encrypt YE3**
   * Subject: `O = Let's Encrypt, CN = YE3`
   * Key type: `ECDSA P-384`
   * Valid until: 2028-09-02
   * Certificate details: [der](/certs/gen-y/int-ye3.der), [pem](/certs/gen-y/int-ye3.pem), [txt](/certs/gen-y/int-ye3.txt)
+  * OID: 1.3.6.1.4.1.44947.1.2.3.3
 * **Let's Encrypt YR1**
   * Subject: `O = Let's Encrypt, CN = YR1`
   * Key type: `RSA 2048`
   * Valid until: 2028-09-02
   * Certificate details: [der](/certs/gen-y/int-yr1.der), [pem](/certs/gen-y/int-yr1.pem), [txt](/certs/gen-y/int-yr1.txt)
+  * OID: 1.3.6.1.4.1.44947.1.2.4.1
 * **Let's Encrypt YR2**
   * Subject: `O = Let's Encrypt, CN = YR2`
   * Key type: `RSA 2048`
   * Valid until: 2028-09-02
   * Certificate details: [der](/certs/gen-y/int-yr2.der), [pem](/certs/gen-y/int-yr2.pem), [txt](/certs/gen-y/int-yr2.txt)
+  * OID: 1.3.6.1.4.1.44947.1.2.4.2
 * **Let's Encrypt YR3**
   * Subject: `O = Let's Encrypt, CN = YR3`
   * Key type: `RSA 2048`
   * Valid until: 2028-09-02
   * Certificate details: [der](/certs/gen-y/int-yr3.der), [pem](/certs/gen-y/int-yr3.pem), [txt](/certs/gen-y/int-yr3.txt)
+  * OID: 1.3.6.1.4.1.44947.1.2.4.3
 
 </details>
 
@@ -158,52 +174,60 @@ These intermediate CAs are no longer being used to issue Subscriber certificates
   * Valid until: 2025-09-15
   * CA details: [crt.sh](https://crt.sh/?caid=183283), [issued certs](https://crt.sh/?Identity=%25&iCAID=183283)
   * Certificate details (signed by ISRG Root X2): [crt.sh](https://crt.sh/?id=3334671964), [der](/certs/lets-encrypt-e1.der), [pem](/certs/lets-encrypt-e1.pem), [txt](/certs/lets-encrypt-e1.txt)
+  * OID: 1.3.6.1.4.1.44947.1.2.2.1
 * **Let's Encrypt E2**
   * Subject: `O = Let's Encrypt, CN = E2`
   * Key type: `ECDSA P-384`
   * Valid until: 2025-09-15
   * CA details: [crt.sh](https://crt.sh/?caid=183284), [issued certs](https://crt.sh/?Identity=%25&iCAID=183284)
   * Certificate details (signed by ISRG Root X2): [crt.sh](https://crt.sh/?id=3334671963), [der](/certs/lets-encrypt-e2.der), [pem](/certs/lets-encrypt-e2.pem), [txt](/certs/lets-encrypt-e2.txt)
+  * OID: 1.3.6.1.4.1.44947.1.2.2.2
 * **Let's Encrypt E5**
   * Subject: `O = Let's Encrypt, CN = E5`
   * Key type: `ECDSA P-384`
   * Valid until: 2027-03-12
   * CA details: [crt.sh](https://crt.sh/?caid=295810), [issued certs](https://crt.sh/?Identity=%25&iCAID=295810)
   * Certificate details (signed by ISRG Root X2): [der](/certs/2024/e5.der), [pem](/certs/2024/e5.pem), [txt](/certs/2024/e5.txt)
   * Certificate details (cross-signed by ISRG Root X1): [der](/certs/2024/e5-cross.der), [pem](/certs/2024/e5-cross.pem), [txt](/certs/2024/e5-cross.txt)
+  * OID: 1.3.6.1.4.1.44947.1.2.2.3
 * **Let's Encrypt E6**
   * Subject: `O = Let's Encrypt, CN = E6`
   * Key type: `ECDSA P-384`
   * Valid until: 2027-03-12
   * CA details: [crt.sh](https://crt.sh/?caid=295819), [issued certs](https://crt.sh/?Identity=%25&iCAID=295819)
   * Certificate details (signed by ISRG Root X2): [der](/certs/2024/e6.der), [pem](/certs/2024/e6.pem), [txt](/certs/2024/e6.txt)
   * Certificate details (cross-signed by ISRG Root X1): [der](/certs/2024/e6-cross.der), [pem](/certs/2024/e6-cross.pem), [txt](/certs/2024/e6-cross.txt)
+  * OID: 1.3.6.1.4.1.44947.1.2.2.4
 * **Let's Encrypt R3**
   * Subject: `O = Let's Encrypt, CN = R3`
   * Key type: `RSA 2048`
   * Valid until: 2025-09-15
   * CA details: [crt.sh](https://crt.sh/?caid=183267), [issued certs](https://crt.sh/?Identity=%25&iCAID=183267)
   * Certificate details (signed by ISRG Root X1): [crt.sh](https://crt.sh/?id=3334561879), [der](/certs/lets-encrypt-r3.der), [pem](/certs/lets-encrypt-r3.pem), [txt](/certs/lets-encrypt-r3.txt)
   * Certificate details (cross-signed by IdenTrust): [crt.sh](https://crt.sh/?id=3479778542), [der](/certs/lets-encrypt-r3-cross-signed.der), [pem](/certs/lets-encrypt-r3-cross-signed.pem), [txt](/certs/lets-encrypt-r3-cross-signed.txt)
+  * OID: 1.3.6.1.4.1.44947.1.2.1.1
 * **Let's Encrypt R4**
   * Subject: `O = Let's Encrypt, CN = R4`
   * Key type: `RSA 2048`
   * Valid until: 2025-09-15
   * CA details: [crt.sh](https://crt.sh/?caid=183268), [issued certs](https://crt.sh/?Identity=%25&iCAID=183268)
   * Certificate details (signed by ISRG Root X1): [crt.sh](https://crt.sh/?id=3334561877), [der](/certs/lets-encrypt-r4.der), [pem](/certs/lets-encrypt-r4.pem), [txt](/certs/lets-encrypt-r4.txt)
   * Certificate details (cross-signed by IdenTrust): [crt.sh](https://crt.sh/?id=3479778543), [der](/certs/lets-encrypt-r4-cross-signed.der), [pem](/certs/lets-encrypt-r4-cross-signed.pem), [txt](/certs/lets-encrypt-r4-cross-signed.txt)
+  * OID: 1.3.6.1.4.1.44947.1.2.1.2
 * **Let's Encrypt R10**
   * Subject: `O = Let's Encrypt, CN = R10`
   * Key type: `RSA 2048`
   * Valid until: 2027-03-12
   * CA details: [crt.sh](https://crt.sh/?caid=295814), [issued certs](https://crt.sh/?Identity=%25&iCAID=295814)
   * Certificate details (signed by ISRG Root X1): [der](/certs/2024/r10.der), [pem](/certs/2024/r10.pem), [txt](/certs/2024/r10.txt)
+  * OID: 1.3.6.1.4.1.44947.1.2.1.3
 * **Let's Encrypt R11**
   * Subject: `O = Let's Encrypt, CN = R11`
   * Key type: `RSA 2048`
   * Valid until: 2027-03-12
   * CA details: [crt.sh](https://crt.sh/?caid=295815), [issued certs](https://crt.sh/?Identity=%25&iCAID=295815)
   * Certificate details (signed by ISRG Root X1): [der](/certs/2024/r11.der), [pem](/certs/2024/r11.pem), [txt](/certs/2024/r11.txt)
+  * OID: 1.3.6.1.4.1.44947.1.2.1.4
 * **Let's Encrypt Authority X1**
   * Subject: `O = Let's Encrypt, CN = Let's Encrypt Authority X1`
   * Key type: `RSA 2048`

content/en/docs/oids.md

@@ -0,0 +1,40 @@
+---
+title: Object Identifiers
+slug: oids
+lastmod: 2025-09-09
+show_lastmod: false
+---
+
+An Object Identifier (OID) is a dotted-separated sequence of numbers used to uniquely identify various objects within the WebPKI. For example, every _extension_ within an X.509 certificate is identified by an OID, and the OID `2.5.29.15` is defined to represent the [Key Usage](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.3) extension.  Similarly, the OID `2.23.140.1.2.1` can be placed within the body of the [Certificate Policies](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.4) extension to indicate that the certificate was validated according to the [CA/Browser Forum's "Domain Validated" criteria](https://github.com/cabforum/servercert/blob/main/docs/BR.md#12-document-name-and-identification).
+
+This page lists the OIDs used by Let's Encrypt, documents what each OID means, and points to where we use them.
+
+* **1.3.6.1.4.1.44947**: Internet Security Research Group. Parent arc for all ISRG OIDs.
+  * 1.3.6.1.4.1.44947.**1**: Let's Encrypt. Parent arc for all LE OIDs.
+    * 1.3.6.1.4.1.44947.1.**1**: Certificate Policies.
+      * 1.3.6.1.4.1.44947.1.1.**1**: Domain Validated. This OID is equivalent to 2.23.140.1.2.1, the CA/BF Domain Validated Certificate Policy OID. It [used to appear in our issuing intermediates](/certs/lets-encrypt-e1.txt), but we have stopped doing so to remove redundancy and reduce certificate size.
+    * 1.3.6.1.4.1.44947.1.**2**: Issuers. Parent arc for all "trust anchors" ([CA keypairs](/certificates)), which can be used by the [Trust Anchor Identifiers](https://datatracker.ietf.org/doc/draft-ietf-tls-trust-anchor-ids/) and [Merkle Tree Certificates](https://datatracker.ietf.org/doc/draft-davidben-tls-merkle-tree-certs/) draft standards.
+      * 1.3.6.1.4.1.44947.1.2.**1**: ISRG Root X1
+        * 1.3.6.1.4.1.44947.1.2.1.**1**: Let's Encrypt R3
+        * 1.3.6.1.4.1.44947.1.2.1.**2**: Let's Encrypt R4
+        * 1.3.6.1.4.1.44947.1.2.1.**3**: Let's Encrypt R10
+        * 1.3.6.1.4.1.44947.1.2.1.**4**: Let's Encrypt R11
+        * 1.3.6.1.4.1.44947.1.2.1.**5**: Let's Encrypt R12
+        * 1.3.6.1.4.1.44947.1.2.1.**6**: Let's Encrypt R13
+        * 1.3.6.1.4.1.44947.1.2.1.**7**: Let's Encrypt R14
+      * 1.3.6.1.4.1.44947.1.2.**2**: ISRG Root X2
+        * 1.3.6.1.4.1.44947.1.2.2.**1**: Let's Encrypt E1
+        * 1.3.6.1.4.1.44947.1.2.2.**2**: Let's Encrypt E2
+        * 1.3.6.1.4.1.44947.1.2.2.**3**: Let's Encrypt E5
+        * 1.3.6.1.4.1.44947.1.2.2.**4**: Let's Encrypt E6
+        * 1.3.6.1.4.1.44947.1.2.2.**5**: Let's Encrypt E7
+        * 1.3.6.1.4.1.44947.1.2.2.**6**: Let's Encrypt E8
+        * 1.3.6.1.4.1.44947.1.2.2.**7**: Let's Encrypt E9
+      * 1.3.6.1.4.1.44947.1.2.**3**: ISRG Root YE
+        * 1.3.6.1.4.1.44947.1.2.3.**1**: Let's Encrypt YE1
+        * 1.3.6.1.4.1.44947.1.2.3.**2**: Let's Encrypt YE2
+        * 1.3.6.1.4.1.44947.1.2.3.**3**: Let's Encrypt YE3
+      * 1.3.6.1.4.1.44947.1.2.**4**: ISRG Root YR
+        * 1.3.6.1.4.1.44947.1.2.4.**1**: Let's Encrypt YR1
+        * 1.3.6.1.4.1.44947.1.2.4.**2**: Let's Encrypt YR2
+        * 1.3.6.1.4.1.44947.1.2.4.**3**: Let's Encrypt YR3

content/es/docs/oids.md

@@ -0,0 +1,9 @@
+---
+title: Object Identifiers
+slug: oids
+date: 2025-09-08
+lastmod: 2025-09-08
+show_lastmod: false
+untranslated: 1
+---
+

content/fa/docs/oids.md

@@ -0,0 +1,9 @@
+---
+title: Object Identifiers
+slug: oids
+date: 2025-09-08
+lastmod: 2025-09-08
+show_lastmod: false
+untranslated: 1
+---
+