Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

With regard to this answer, I have a question about Key Usage in an SSL certificate.

Most SSL server certificates have a RSA key which is not restricted through a Key Usage extension, so you can use both "RSA" and "DHE_RSA" key types.

  • How do I determine if my certificate has a key usage restriction?
  • Do all SSL Keys have an RSA key?
  • Is there only one key usage to look out for, or are there others?

Where should I learn more?

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

You should learn to use the "openssl" command-line tool (available for Windows, Linux, Mac OS X, etc.).

Type on the command line: (where mycert is your certificate)

openssl x509 -text -in mycert

This decodes all the fields in the certificate, and will list any restrictions.

No, it doesn't have to be RSA. You can select Diffie-Helmman instead when you create your certificate.

There are a wide variety of certificate uses. For example, you might want a certificate that can sign other certificates for the domain, so that you don't need to buy individual certificates from a CA, but can create them yourself.

share|improve this answer
add comment

Not all certificates use RSA, but most do. A few months ago, I scanned a lot of random IP addresses to find SSL servers, and out of 10147 certificate chains (from 16027 servers -- there is considerable chain reuse), only 9 of them used anything else than RSA (6 with DSA keys, 3 with GOST keys; no Diffie-Hellman, no ECDSA). This is more than market dominance; RSA has an almost monopoly on cryptographic algorithms for SSL servers.

(I should write a Web page somewhere with all the stats.)

Apart from the Key Usage extension, a few other extensions can be relevant; see this answer for details.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.