I want to use OpenSSL to create a CSR and submit it to my CA (which uses Microsoft PKI) and receive certificates that can be used for both Server Auth and Client Auth. I'm not clear on a couple of things, which may simply be a a link between keyUsage and nsCertType.
- Is it enough for me to include in the CSR keyUsage=digitalSignature,keyEncipherment and extendedKeyUsage=serverAuth,clientAuth ?
- Can the signing CA choose to ignore these requested attributes and grant me only Server Auth usage?
- Is nsCertType used for requests (eg, CSRs) or only when OpenSSL is used to sign certs?