Root CA ignores CSR's critical flag on key usage

Daniel Niccoli 196 Reputation points
2022-01-03T16:19:19.913+00:00

I created a certificate signing request for a new intermediate CA. The CSR was created with the critical flag on the KeyUsage property. I can verify this by running certutil -dump certificate.req.

161951-image.png

Upon importing the CSR into the (standalone) root CA, it does not recognise the critical flag on the CSR. The root CA seems to even completely omit the KeyUsage from the CSR, as the KeyUsage origin is set to Policy instead of Request.

161919-image.png

In the next image you can see that the critical flag is not present in the issued certificate.

161856-image.png

Next, I checked if the CA is configured to even transfer the KeyUsage from the request to the certificate, by running **certutil -v -getreg Policy\EnableRequestExtensionList* and checking if OID 2.5.29.15 is included. In the next image you can see, that it is.

161920-image.png

Why is my root CA ignoring the flag in the request and how can I make it respect the request flag?

Windows Server Infrastructure
Windows Server Infrastructure
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Infrastructure: A Microsoft solution area focused on providing organizations with a cloud solution that supports their real-world needs and meets evolving regulatory requirements.
526 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vijay Raghavan 0 Reputation points Microsoft Employee
    2024-01-05T14:41:38.2366667+00:00

    If the CSR has the BasicConstraint extension set to CA=True the CA will default to what you see above. You can override this by running the following on the signing CA (the Root)

    certutil -setreg policy\EditFlags -EDITF_ADDOLDKEYUSAGE

    Restart the service and try again.