How to Set or Remove the critical Flag on Key Usage or Extended Key Usage Extensions

[artsbentley]

Hi

I've the following function that I'm using to generate a CSR,

pub fn generate_csr(config: &CommonConfig) -> Result<model::CsrBundle> {
    let mut params: CertificateParams = CertificateParams::new(config.dns_array())?;
    params.is_ca = IsCa::NoCa;

    let mut dn = DistinguishedName::new();
	// dn information....
    params.distinguished_name = dn;

    let now = time::OffsetDateTime::now_utc();
    params.not_before = now;
    params.not_after = now + time::Duration::days(365);

    // key usage attributes
    params.key_usages = vec![
        KeyUsagePurpose::DigitalSignature,
        KeyUsagePurpose::KeyEncipherment,
        KeyUsagePurpose::KeyAgreement,
    ];
    params.extended_key_usages = vec![ExtendedKeyUsagePurpose::ServerAuth];

    // CSR creation and signing
    let key = generate_private_key();
    let csr = params.serialize_request(&key)?;

    Ok(model::CsrBundle { csr, key })
}

The resulting CSR contains:

        Attributes:
            Requested Extensions:
                X509v3 Key Usage: critical
                    Digital Signature, Key Encipherment, Key Agreement
                X509v3 Extended Key Usage:
                    TLS Web Server Authentication

However, I would like to configure the CSR so that:

• Key Usage is marked non-critical
• Extended Key Usage is marked critical

Is there a way to configure this in rcgen? I couldn’t find any options in CertificateParams to change the criticality of individual extensions.

Thanks in advance for any help!

[djc]

Section 4.2.1.3 Key Usage:

Conforming CAs MUST include this extension in certificates that contain public keys that are used to validate digital signatures of other public key certificates or CRLs. When present, conforming CAs SHOULD mark this extension as critical.

Section 4.2.1.12 Extended Key Usage:

This extension MAY, at the option of the certificate issuer, be either critical or non-critical.

Right now there is no way to make this configurable in rcgen, but I could see us making this configurable for extended key usage. Given the RFC wording, I would not be inclined to allow marking key usage as non-critical.

[da77a]

Citing RFC5280 to say what can and cannot be configured/modified by a user of rcgen implies that rcgen is only to be used to generate / work with certificates (and CSRs) conforming to a specific (RFC5280 defined) "Internet" profile. This rather limits its generality. Is this stated anywhere in the docs?

[djc]

If you have another use case, feel free to file an issue requesting support for it.