thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Fundamentals & Crypto · Advanced

Key Usage Extension

X.509 extensions that restrict what a certificate's key may be used for, such as signing or server authentication.

Definition

Key Usage specifies cryptographic operations like digitalSignature, keyEncipherment, and keyCertSign. Extended Key Usage specifies applications such as serverAuth, clientAuth, codeSigning, and emailProtection. Basic Constraints indicates whether a certificate is a CA and the allowed path length.

Example

A certificate with EKU clientAuth only cannot be used as a TLS server certificate.

Exam tip

keyCertSign plus Basic Constraints CA:TRUE marks a CA certificate.

Related terms