What are these Bytes in the OID returned by X509Certificte.getExtensionValue("2.5.29.32")? - x509certificate

Question

I am pulling the 2.5.29.32 Certificate Policy OID bytes from an X.509 certificate. I am not using BouncyCastle.
bytes = _cert.getExtensionValue("2.5.29.32");
The raw bytes I get are
4, 15, 48, 13, 48, 11, 6, 9, 96, -122, 72, 1, 101, 2, 1, 11, 42
After DER decode (type = 4, size = 15), I have:
48, 13, 48, 11, 6, 9, 96, -122, 72, 1, 101, 2, 1, 11, 42
What I am after is the:
96, -122, 72, 1, 101, 2, 1, 11, 42 (2.16.840.1.101.2.1.11.42)
What are the bytes: 48, 13, 48, 11, 6, 9?

Answer 1

48 (aka 0x30) is the tag for CONSTRUCTED SEQUENCE (all SEQUENCE values are CONSTRUCTED, but still).
The 13 is the length value, as is the 11 two bytes later.
6 (aka 0x06) is the tag for OBJECT IDENTIFIER (aka OID), and 9 is its length.
So 30 0D 30 0B 06 09 ... is SEQUENCE(SEQUENCE(OID(... [ 9 bytes ]))).
ITU-T X.680-201508, the ASN.1 language.
ITU-T X.690-201508, the BER (and CER) and DER encodings for ASN.1 data.

Answer 2

In case anyone is interested in the code I wrote to do this...
private static byte CONSTRUCTED_SEQUENCE_TAG = 48;
private static byte OID_CODE = 6;
private static String extractPolicyOid(X509Certificate pCert) throws IOException {
byte[] _bytes = pCert.getExtensionValue("2.5.29.32");
if (_bytes == null) {
return null;
}
DerValue _der = new DerValue(new ByteArrayInputStream(_bytes));
_bytes = _der.getOctetString();
/*
* Skip header goo
*/
int _idx = 0;
while (_idx < _bytes.length) {
if (_bytes[_idx] == CONSTRUCTED_SEQUENCE_TAG) {
_idx += 2;
} else if (_bytes[_idx] == OID_CODE) {
_idx += 2;
} else {
break;
}
}
/*
* Create string version of OID
*/
StringBuffer _sb = new StringBuffer();
byte _byte = _bytes[_idx++];
_sb.append(_byte / 40);
_sb.append(".");
_sb.append(_byte % 40);
int _accum = 0;
for (; _idx < _bytes.length; _idx++) {
_byte = _bytes[_idx];
if (_byte << ~7 < 0) {
_accum = (_byte & 0x7f) << 7;
} else {
_accum += _byte;
_sb.append(".");
_sb.append(_accum);
_accum = 0;
}
}
return _sb.toString();
}