What is the difference between the x.509 V3 extensions Basic Constraints and Key Usage to create a CA certificate?

security encryption ssl cryptography x509certificate
Cratylus picture Cratylus · Apr 26, 2011 · Viewed 18.9k times · Source

These two actions seem to do the same:

  • using the Basic Constraints extension in a X.509 Certificate to signify that it is a CA certificate and
  • using the Key Usage extension e.g. to signify that the public key can be used for certificate signining.

What is the difference between these extensions?
Do they serve same purpose or complement each other?

Answer

Babu Srinivasan picture Babu Srinivasan · Apr 26, 2011

"Key Usage" defines what can be done with the key contained in the certificate. Examples of usage are: ciphering, signature, signing certificates, signing CRLs.

"Basic Constraints" identifies if the subject of certificates is a CA who is allowed to issue child certificates.

For a certificate that can be used to sign certificates, the info is in some sense duplicated:

  • X509v3 Basic Constraints: CA: TRUE --- Can sign certificates
  • X509v3 Key Usage: Key Cert Sign --- Can sign certificates

But "Basic Constraints" will also specify the maximum depth of valid certification chain.

Though it is duplicated, you need to specify both, according to RFC 3280 --- X.509. This is the relevant paragraph from the RFC (page 29):

The keyCertSign bit is asserted when the subject public key is used for verifying a signature on public key certificates. If the keyCertSign bit is asserted, then the cA bit in the basic constraints extension (section 4.2.1.10) MUST also be asserted.

Related questions

WordPress with ssl form let's encrypt, but homepage not fully secure. "Attackers might be able to see images.." message

Could you help me find out what to do with not fully secure message. I have installed ssl certificate from let's encrypt, but my wordpress homepage has a message "Attackers might be able to see the images you're looking at …

Read More
How do you Encrypt and Decrypt a PHP String?

What I mean is: Original String + Salt or Key --> Encrypted String Encrypted String + Salt or Key --> Decrypted (Original String) Maybe something like: "hello world!" + "ABCD1234" --> Encrypt --> "2a2ffa8f13220befbe30819047e23b2…

Read More
Simplest two-way encryption using PHP

What is the simplest way of doing two way encryption in common PHP installs? I need to be able to encrypt data with a string key, and use the same key to decrypt on the other end. The security isn't …

Read More