As I understand the creation of a x509 certificate is a simple 3 step process:

  1. The client generates a private and a public key.
  2. The clients generates a certificate signing request for the pair and signs it using its private key.
  3. The certificate authority verifies the certificate signing request and generates a signature.

I am somewhat confused as to what information is provided by the client and what end up being imposed by the certificate authority. I'm fine with the client providing the basic information about who he is, but I do not understand why it is up to the client to provide v3 extensions (i.e. extendedKeyUsage). To me, the client is some user interested in using the PKI for accesses some sort of service. Thus the PKI is responsible for determining the scope of the certificate. Analogous its not the worker's job to make sure not to access restricted resources, its the security departments job to keep him from doing so.

In short: Why does the client provide v3 extensions in the certificate signing request instead of the certificate authority imposing them when generating the certificate?


The CSR is not used as a fixed order but more like a wishlist. Most CA do not simply sign this CSR but instead just take the clients public key from the CSR and then add whatever information and restrictions they think should be added to the certificate.

  • How does this work in practice? CSRs are self-certifying due to being signed using the requestors private key and containing its public key. The CA does not know the private key and therefore cannot generate a new CSR. – Cyclonit Apr 3 '16 at 10:27
  • 1
    @Cyclonit: You don't actually need a signed CSR to create a certificate. All you need are the information which should be stored in the certificate, i.e. the public key, subject, life time, usage ... . The CSR is only signed with the private key so that the issuer can verify that it got not modified during transfer, but the owners private key is not actually needed to create and sign the certificate by the issuer. – Steffen Ullrich Apr 3 '16 at 10:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.