10

I want to use OpenSSL to create a CSR and submit it to my CA (which uses Microsoft PKI) and receive certificates that can be used for both Server Auth and Client Auth. I'm not clear on a couple of things, which may simply be a a link between keyUsage and nsCertType.

  1. Is it enough for me to include in the CSR keyUsage=digitalSignature,keyEncipherment and extendedKeyUsage=serverAuth,clientAuth ?
  2. Can the signing CA choose to ignore these requested attributes and grant me only Server Auth usage?
  3. Is nsCertType used for requests (eg, CSRs) or only when OpenSSL is used to sign certs?

Regards, Mike

Thomas Pornin
  • 320,799
  • 57
  • 780
  • 949
Mike
  • 408
  • 1
  • 5
  • 8

1 Answers1

11

nsCertType is an old Netscape-specific extension, which was used by the Netscape browser at a time when that browser was still alive. You can forget it nowadays.

The signing CA, by principle, acts in any way as it sees fit. It can put whatever it wishes in your certificate. Your certificate request is just a suggestion. You can more or less count on the CA to take the public key from your request and use that public key in the certificate; for everything less (including name, key usages and other extensions) this is completely up to the CA to decide. Microsoft's Certificate Services uses "certificate templates" for its configuration, and the templates decide what goes in the certificates. According to my own tests, the key usage and extended key usages which you put in the certificate will be completely ignored.

What extensions are needed for client authentication, and/or for server authentication, depends on the involved software. You will find some information in my past prose, e.g. this, this and that.

Community
  • 1
Thomas Pornin
  • 320,799
  • 57
  • 780
  • 949
  • Thanks much for the explanation and links; they helped me gain further understanding. I was afraid of that disconnect between requested and signed extensions. Hopefully I won't need to argue with my CA to add or alter cert templates. – Mike Apr 05 '13 at 22:29