Red Hat CERTIFICATE 7.1 ADMINISTRATOR, Administrator'S Manual

Page: 737 / 840

Standard X.509 v3 Certificate Extensions
Appendix G Certificate and CRL Extensions 737
•
encipherOnly
(
7
) if the public key is to be used only for enciphering data. If this bit
is set,
keyAgreement
should also be set.
•
decipherOnly
(
8
) if the public key is to be used only for deciphering data. If this bit
is set,
keyAgreement
should also be set.
Table G-3 summarizes the above guidelines for typical certificate uses.
If the
keyUsage
extension is present and is marked critical, then it will be used to enforce
the usage of the certificate and key. The extension is used to limit the usage of a key; if the
extension is not present or not critical, all types of usage are allowed.
If the
keyUsage
extension is present (critical or not), it is used to select from multiple
certificates for a given operation. For example, it is used to distinguish separate signing and
encryption certificates for users who have separate certificates and key pairs for these
operations.
CS Version Support
Supported since CS 4.1. Refer to “KeyUsageExt” on page 513.
nameConstraints
OID
2.5.29.30
Criticality
PKIX Part 1 requires that this extension be marked critical.
Table G-3 Certificate uses and corresponding Key Usage bits
Purpose of certificate Required Key Usage bit
CA Signing
keyCertSign
cRLSign
SSL Client
digitalSignature
SSL Server
keyEncipherment
S/MIME Signing
digitalSignature
S/MIME Encryption
keyEncipherment
Certificate Signing
keyCertSign
Object Signing
digitalSignature