2

I have a question about what key usage should I choose when creating a private CA (root or subordinate).

I have inspected some root and issuing web certificate authorities and they tend to use digitalSignature, cRLSign and keyCertSign. But isn't it logical to only use cRLSign and keyCertSign since the job of a CA is to sign other certificates and CRLs ?

Should I mark the key usage extension for a CA as critical or not? (My guess is yes, but I don't know how to justify it.)

Can someone please clarify the methodology behind these choices?

EDIT:

Example C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3:

-----BEGIN CERTIFICATE----- MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/ MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT DkRTVCBSb290IENBIFgzMB4XDTE2MDMxNzE2NDA0NloXDTIxMDMxNzE2NDA0Nlow SjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxIzAhBgNVBAMT GkxldCdzIEVuY3J5cHQgQXV0aG9yaXR5IFgzMIIBIjANBgkqhkiG9w0BAQEFAAOC AQ8AMIIBCgKCAQEAnNMM8FrlLke3cl03g7NoYzDq1zUmGSXhvb418XCSL7e4S0EF q6meNQhY7LEqxGiHC6PjdeTm86dicbp5gWAf15Gan/PQeGdxyGkOlZHP/uaZ6WA8 SMx+yk13EiSdRxta67nsHjcAHJyse6cF6s5K671B5TaYucv9bTyWaN8jKkKQDIZ0 Z8h/pZq4UmEUEz9l6YKHy9v6Dlb2honzhT+Xhq+w3Brvaw2VFn3EK6BlspkENnWA a6xK8xuQSXgvopZPKiAlKQTGdMDQMc2PMTiVFrqoM7hD8bEfwzB/onkxEz0tNvjj /PIzark5McWvxI0NHWQWM6r6hCm21AvA2H3DkwIDAQABo4IBfTCCAXkwEgYDVR0T AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwfwYIKwYBBQUHAQEEczBxMDIG CCsGAQUFBzABhiZodHRwOi8vaXNyZy50cnVzdGlkLm9jc3AuaWRlbnRydXN0LmNv bTA7BggrBgEFBQcwAoYvaHR0cDovL2FwcHMuaWRlbnRydXN0LmNvbS9yb290cy9k c3Ryb290Y2F4My5wN2MwHwYDVR0jBBgwFoAUxKexpHsscfrb4UuQdf/EFWCFiRAw VAYDVR0gBE0wSzAIBgZngQwBAgEwPwYLKwYBBAGC3xMBAQEwMDAuBggrBgEFBQcC ARYiaHR0cDovL2Nwcy5yb290LXgxLmxldHNlbmNyeXB0Lm9yZzA8BgNVHR8ENTAz MDGgL6AthitodHRwOi8vY3JsLmlkZW50cnVzdC5jb20vRFNUUk9PVENBWDNDUkwu Y3JsMB0GA1UdDgQWBBSoSmpjBH3duubRObemRWXv86jsoTANBgkqhkiG9w0BAQsF AAOCAQEA3TPXEfNjWDjdGBX7CVW+dla5cEilaUcne8IkCJLxWh9KEik3JHRRHGJo uM2VcGfl96S8TihRzZvoroed6ti6WqEBmtzw3Wodatg+VyOeph4EYpr/1wXKtx8/ wApIvJSwtmVi4MFU5aMqrSDE6ea73Mj2tcMyo5jMd6jmeWUHK8so/joWUoHOUgwu X4Po1QYz+3dszkDqMp4fklxBwXRsW10KXzPMTZ+sOPAveyxindmjkW8lGy+QsRlG PfZ+G6Z6h7mjem0Y+iWlkYcV4PIWL1iwBi8saCbGS5jN2p8M+X+Q7UNKEkROb3N6 KOqkqm57TH2H3eDJAkSnh6/DNFu0Qg== -----END CERTIFICATE-----

  • 1
    Interesting. Are you talking about PUBLIC CAs? If yes, then could you add the PEM certs of them? – StackzOfZtuff May 6 at 10:54
3

For OCSP?

I'm guessing it's for OCSP.

I've had a look at the CAB forum Baseline Requirements. I did a full text search for digitalSignature and there are only two hits.

Hit 1/2 is for root CAs:

b. keyUsage
This extension MUST be present and MUST be marked critical. Bit positions for keyCertSign and cRLSign MUST be set. If the Root CA Private Key is used for signing OCSP responses, then the digitalSignature bit MUST be set.

Hit 2/2 is for subordinate CAs:

e. keyUsage
This extension MUST be present and MUST be marked critical. Bit positions for keyCertSign and cRLSign MUST be set. If the Subordinate CA Private Key is used for signing OCSP responses, then the digitalSignature bit MUST be set.

| improve this answer | |
  • 1
    Boom! That's probably exactly it! – Mike Ounsworth May 6 at 13:28
  • 2
    @MikeOunsworth: I'm guessing so, yes. But it's only a regular "if" and not an "if and only if", so I'm not 100% sure. – StackzOfZtuff May 6 at 13:44
3

I think you're right. RFC 5280 section 4.2.1.3. Key Usage says (emphasis mine):

KeyUsage ::= BIT STRING {
       digitalSignature        (0),
       nonRepudiation          (1), -- recent editions of X.509 have
                            -- renamed this bit to contentCommitment
       keyEncipherment         (2),
       dataEncipherment        (3),
       keyAgreement            (4),
       keyCertSign             (5),
       cRLSign                 (6),
       encipherOnly            (7),
       decipherOnly            (8) }

Bits in the KeyUsage type are used as follows:

The digitalSignature bit is asserted when the subject public key is used for verifying digital signatures, *other than signatures on certificates (bit 5) and CRLs (bit 6)*, such as those used in an entity authentication service, a data origin authentication service, and/or an integrity service.

...

However, the digitalSignature and/or nonRepudiation bits MAY be set in addition to the keyCertSign and/or cRLSign bits if the subject public key is to be used to verify signatures on certificates and/or CRLs as well as other objects.

My guess is that CAs want the ability to use the root key for some other kind of authentication; who knows, maybe signing logs or something? Either that or it's misconfiguration.


Full disclosure, I work for Entrust, so I'll use them as an example: the publicly-trusted Entrust Root Certificate Authority—G2 and the L1K and L1M issuing CAs do not have the digitalSignature keyUsage, so it's certainly not needed:

Entrust Root Certificate Authority—G2 does not have the digitalSignature key usage


As for your other question:

Should I mark the key usage extension for a CA as crticial or not ? (my guess is yes, but I don't know how to justify it)

RFC 5280 (same section) says:

When present, conforming CAs SHOULD mark this extension as critical.

I'm not sure what happens if you mark this as non-critical, but I'm guessing some clients / verifiers will work fine, and some will have weird behaviours.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.