I am currently designing a private PKI for my family and some close friends for use in E-Mail, VPN, file sharing etc. The PKI will be 3-tiered:
Root CA -> Policy Authority -> Issuing Authority -> Enduser
I want to restrict the usage of certificates to certain use cases by using the keyUsage and extendedKeyUsage fields. I.e. our web servers' certificates should have the following extensions set:
keyUsage=digitalSignature,keyEncipherment,keyAgreement,nonRepudation extendedKeyUsage=TLS Web Server Authentication
These certificates will be issued by the "Web Server Issuing CA". It is not under my direct supervision, but I'd like to enforce that exactly those keyUsage and extendedKeyUsage fields must be present and more importantly, I do not want the Webserver Issuing CA to issue certificates for E-Mail etc.