As above, we were planning to do the following:

  • Access our HSM (Luna SA)
  • Generate CSR
  • Send CSR to 3rd Party CA
  • Add critical key usage of Non Repudiation on 3rd Parties portal
  • Send the now signed CSR (public key to our trading partner) which has the key usage

Does it matter if I have not added the key usage attribute during the CSR generation on the HSM as I cannot find a way to add the key usage with the HSM client software?


2 Answers 2


Each tool should be used for what it does the best. The HSM is great to protect a private key by allowing to use it without leaking it out the the hardware module.

But IMHO, the CSR generation and validation should be done before submitting a validated CSR to the HSM for signature only.

  • Thankyou, we have found a solution that involves writing a config file to the HSM, this way we can still generate the CSR with the right key usage attribute on the HSM.
    – Steve
    Aug 21, 2017 at 12:50

It is typically the responsibility of the CA to only sign extensions they approve (typically described in their CPS), and may add extensions according to the type of certificate. I would check with the CA.

For most CAs they will discard the extensions you supply and only add the ones they include from their own template/certificate type. As an example, you may have the CA:TRUE extension in your CSR, but no CA is going to simply sign without first removing that value. On the other hand, if you specifically request a nonRepudiation certificate, the CA should add it for you even if it is not in the CSR, since the resulting certificate will not perform as you require without it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .