A real world extensions sequence (taken from Google's GAI2). $ openssl asn1parse -i < [EXTENSIONS] 0:d=0 hl=3 l= 228 cons: SEQUENCE 3:d=1 hl=2 l= 31 cons: SEQUENCE 5:d=2 hl=2 l= 3 prim: OBJECT :X509v3 Authority Key Identifier 10:d=2 hl=2 l= 24 prim: OCTET STRING [HEX DUMP]:30168014C07A98688D89FBAB05640C117DAA7D65B8CACC4E 36:d=1 hl=2 l= 29 cons: SEQUENCE 38:d=2 hl=2 l= 3 prim: OBJECT :X509v3 Subject Key Identifier 43:d=2 hl=2 l= 22 prim: OCTET STRING [HEX DUMP]:04144ADD06161BBCF668B576F581B6BB621ABA5A812F 67:d=1 hl=2 l= 14 cons: SEQUENCE 69:d=2 hl=2 l= 3 prim: OBJECT :X509v3 Key Usage 74:d=2 hl=2 l= 1 prim: BOOLEAN :255 77:d=2 hl=2 l= 4 prim: OCTET STRING [HEX DUMP]:03020106 83:d=1 hl=2 l= 46 cons: SEQUENCE 85:d=2 hl=2 l= 8 prim: OBJECT :Authority Information Access 95:d=2 hl=2 l= 34 prim: OCTET STRING [HEX DUMP]:3020301E06082B060105050730018612687474703A2F2F672E73796D63642E636F6D 131:d=1 hl=2 l= 18 cons: SEQUENCE 133:d=2 hl=2 l= 3 prim: OBJECT :X509v3 Basic Constraints 138:d=2 hl=2 l= 1 prim: BOOLEAN :255 141:d=2 hl=2 l= 8 prim: OCTET STRING [HEX DUMP]:30060101FF020100 151:d=1 hl=2 l= 53 cons: SEQUENCE 153:d=2 hl=2 l= 3 prim: OBJECT :X509v3 CRL Distribution Points 158:d=2 hl=2 l= 46 prim: OCTET STRING [HEX DUMP]:302C302AA028A0268624687474703A2F2F672E73796D63622E636F6D2F63726C732F6774676C6F62616C2E63726C 206:d=1 hl=2 l= 23 cons: SEQUENCE 208:d=2 hl=2 l= 3 prim: OBJECT :X509v3 Certificate Policies 213:d=2 hl=2 l= 16 prim: OCTET STRING [HEX DUMP]:300E300C060A2B06010401D679020501 -----BEGIN EXTENSIONS----- MIHkMB8GA1UdIwQYMBaAFMB6mGiNifurBWQMEX2qfWW4ysxOMB0GA1UdDgQWBBRK3QYWG7z2aLV 29YG2u2IaulqBLzAOBgNVHQ8BAf8EBAMCAQYwLgYIKwYBBQUHAQEEIjAgMB4GCCsGAQUFBzABhh JodHRwOi8vZy5zeW1jZC5jb20wEgYDVR0TAQH/BAgwBgEB/wIBADA1BgNVHR8ELjAsMCqgKKAmh iRodHRwOi8vZy5zeW1jYi5jb20vY3Jscy9ndGdsb2JhbC5jcmwwFwYDVR0gBBAwDjAMBgorBgEE AdZ5AgUB -----END EXTENSIONS-----