Standalone CA - Restrict Issuing CA to issue only Server Authentication and Client Authentication EKU certificates

hi everyone,

have standalone issuing ca configured issue certificates end users. now, want restrict certificates being issued ca server authentication , client authentication only. ca should stop certificate requests other purpose under enhanced key usage.

what did :

have ca can issue certificates eku. renewed ca keys, added server authentication , client authentication ca csr , got approved immediate issuer. imported new certificate has eku server authentication , client authentication ca. till point, good.

testing end user certificate issuance:

have requested 2 types of certificates via web-enrollment.
first 1 eku server authentication , got certificate expected , issuer certificate new ca certificate.
second 1 eku code signing , got certificate code signing issuer certificate old ca certificate instead of new ca certificate renewed time back.

looking @ second test result, revoked old ca certificate , installed latest crl in ca server issue did not resolve.

the questions are:

1. how did old ca certificate issuing certificates?
2. can ca revoked issue certificates?
3. did not see message in ca properties revocation information against old ca certificate. expected behaviour?
4. how restrict not use old ca certificate issue certificates?
5. how issue end user certificates ca ekus server authentication and/or client authentication?

can 1 me in understanding above?

thanks in advance.

> or because old , new ca certificates use same key

this case. though, should understand ca able issue certificates eku regardless of eku in ca certificate, because not strict constraint. however, certificates mismatching ekus not validated.

---

vadims podāns, aka powershell cryptoguy
weblog: www.sysadmins.lv
powershell pki module: pspki
check out new: ssl certificate verifier
check out new: powershell file checksum integrity verifier tool.

Windows Server  >  Security