My understanding is that a CSR contains the public key from the client, and the response is a signed version of that CSR, with certain attributes (EKU, expiration) and other attributes the CA decides to arbitrarily add.
When a key is revoked in a CSR, is the hash of the public key mentioned in the CSR or just the PKI-stamped version of the Public key?
For argument's sake, suppose I want to use the same RSA pub/private key pair for many usages, even though this may be a bad idea in reality. As a result I generate 3 certs, with the respective EKU below
Will a revocation affect all three usages of the same private key? Or will the revocation only affect a given cert?