0

I'm under the impression that x509 extensions must be added at certificate creation time. Just want to check that my understanding is correct and that I can not take a certificate after it was created and add the extension then.

These are extensions my test opc-ua server might require:

    X509v3 Key Usage:
        Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Certificate Sign
    X509v3 Extended Key Usage:
        TLS Web Server Authentication, TLS Web Client Authentication
Improve this question
4
  • A server (any EE) definitely doesn't need CertSign, and any public CA that gives it to you is effectively gambling their entire business on you, which means either you are a hundred times more competent than this Q indicates or the CA is massively stupid and doomed. A TLS server only needs digSign (for PFS keyexchanges) and keyEnc if the key is RSA and you (will or may) support plain-RSA keyexchange which is no longer recommended (but not yet actually forbidden). A server also doesn't need clientAuth, but many CAs give you that anyway.
    – dave_thompson_085
    Sep 16, 2017 at 3:54
  • Dupe security.stackexchange.com/questions/48992/… and security.stackexchange.com/questions/127904/…
    – dave_thompson_085
    Sep 16, 2017 at 4:12
  • @dave_thompson_085 I'm sure you can tell I'm new to the wonderful world of certs. May I ask what EE stands for?
    – simgineer
    Sep 16, 2017 at 5:05
  • EE = End Entity = a 'real' system (not a CA) that has a certificate (issued by a CA). Rather like the Catholic church, X.509 dogma partitions a 'clergy' of entities with rich and complicated internal structure (root CAs, intermediate/subordinate CAs, public CAs, private CAs, RAs, issuers, distribution points, responders, logs, repositories, auditors, etc, etc) from an external 'lay' class of EEs which are considered basically alike -- from the point of view of PKI, though not from their own. See the (simplified!) diagram at tools.ietf.org/html/rfc5280#section-3
    – dave_thompson_085
    Sep 16, 2017 at 22:22

1 Answer 1

Reset to default
3

You are correct that you cannot add an extension to an existing certificate.

Adding an extension would change the contents of the tbsCertificate portion of the certificate, and that would invalidate the signature on the cert.

Producing another certificate which is in all other respects the same (but has this extension) is theoretically possible if you own the CA. If not, you'd just be submitting a new request, and that would mean you get a new serial number. (Either way you'd get a new Thumbprint/Fingerprint, since that's a hash of the certificate, and not an intrinsic value).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .