Confirmed users, Administrators
5,526
edits
CA:TestErrors: Difference between revisions
Added keyUsage critical info
m (Added info about RSA keys and key Agreement) |
(Added keyUsage critical info) |
||
| Line 47: | Line 47: | ||
| Unallowed key usage for RSA public key || https://tools.ietf.org/html/rfc5280 page 30. A certificate with an RSA key should not assert keyAgreement. || A certificate that has an RSA key and asserts the keyAgreement usage is technically a non-conforming certificate. We are not aware of any implementation that would actually have a problem verifying that certificate, but we think that CAs should not be issuing certificates with this problem. || {{Bug|636557#c56}} | | Unallowed key usage for RSA public key || https://tools.ietf.org/html/rfc5280 page 30. A certificate with an RSA key should not assert keyAgreement. || A certificate that has an RSA key and asserts the keyAgreement usage is technically a non-conforming certificate. We are not aware of any implementation that would actually have a problem verifying that certificate, but we think that CAs should not be issuing certificates with this problem. || {{Bug|636557#c56}} | ||
|- | |- | ||
| | | CA certificates must set keyUsage extension as critical || The [https://cabforum.org/baseline-requirements-documents/ Baseline Requirements] say that the keyUsage extension MUST be present and MUST be marked critical. || This requirement applies to all CA certs that are created after the first BR Effective Date of 01-Jul-2012. In general, CAs should not be requesting inclusion of CA certs created before that date. || | ||
|- | |- | ||
| || || || | | || || || | ||