0

When I create a CSR and provide the block of encrypted text to a Root CA (e.g. Verisign, Thawte), what or who will determine the Key Usage extension attributes like:

  • Digital Signature
  • Non-Repudiation
  • Key Encipherment

Are these already included in the CSR or is the Root CA setting them respectively?

1

You can include them in the CSR if you want, but the R stands for request, and no CA will issue you a certificate if your CSR does not comply with its policies. In fact, most CAs ignore everything in your CSR except for the key material.

  • What if it's a internal Root CA e.g. Microsoft Certificate Services ? I need a certificate with Key Agreement, Certificate Signing ,Off-line CRL Signing and other Key usage flags. – adam86 Jul 14 '16 at 20:13
  • There are CAs that will sell intermediate CA certificates, but you probably don't qualify. If you need to run your own CA, typical practice is to create your own root certificate, and distribute it yourself to the systems that you need to trust it. – Reid Rankin Jul 14 '16 at 20:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.