Extra EKUs set in client certificate a security risk?

Question

I have implemented a 2-tier Windows AD CS PKI. For 802.1x I'm using autoenroll to distribute computer certificates automatically to any domain joined computer.

Currently I use a single computer template for all computers, both servers and workstation. This template includes client authentication, server authentication and remote desktop authentication EKUs.

For workstations, client authentication is all that's required, but is having the extra EKUs set in the certificate a security issue?

(By default there are no groups seperating servers from workstations, so you cannot assign different autoenroll certificate templates to servers and workstations. It's possible to ceate a server group and add servers to this group, but this adds an extra manual action.)

Answer 1

It depends on your security policy. If your policy requires a separate certificate for each application/service, then it is bad. If your security policy allows single certificate use for multiple applications/services (where applicable), it is ok.

There is no universal approach, each has its own advantages and disadvantages. For example, when requiring separate certificate for each application, you increase administrative efforts (since you have to maintain multiple certificates), but reduce couplings. A failure in single certificate will affect only single service, other services are not affected.

When you reuse single certificate in multiple applications, you reduce administrative efforts (as only single certificate per device must be maintained). On the other hand, a failure in certificate will affect all applications the certificate is associated with.