0

When I create a CSR and provide the block of encrypted text to a Root CA (e.g. Verisign, Thawte), what or who will determine the Key Usage extension attributes like:

  • Digital Signature
  • Non-Repudiation
  • Key Encipherment

Are these already included in the CSR or is the Root CA setting them respectively?

Improve this question

1 Answer 1

Reset to default
1

You can include them in the CSR if you want, but the R stands for request, and no CA will issue you a certificate if your CSR does not comply with its policies. In fact, most CAs ignore everything in your CSR except for the key material.

Improve this answer
2
  • What if it's a internal Root CA e.g. Microsoft Certificate Services ? I need a certificate with Key Agreement, Certificate Signing ,Off-line CRL Signing and other Key usage flags.
    – cyzczy
    Jul 14, 2016 at 20:13
  • There are CAs that will sell intermediate CA certificates, but you probably don't qualify. If you need to run your own CA, typical practice is to create your own root certificate, and distribute it yourself to the systems that you need to trust it.
    – Reid Rankin
    Jul 14, 2016 at 20:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .