Key Usage (keyUsage extension)

Key Usage is a bit string defined in RFC 5280 with nine flags: digitalSignature, nonRepudiation (also called contentCommitment), keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly and decipherOnly. It describes low-level operations, while Extended Key Usage describes application purposes such as TLS server authentication. CA certificates use keyCertSign and cRLSign; TLS server certificates use digitalSignature, often with keyEncipherment for RSA keys.

Why it matters

Clients enforce Key Usage when it is present, and it is usually marked critical, so a wrong flag makes a certificate fail even when everything else is correct. The flags should follow the key type and protocol: an ECDSA key signs handshake data and needs digitalSignature. keyEncipherment exists for the old RSA key exchange, in which the client encrypted the premaster secret with the server's RSA public key. TLS 1.3 removed that key exchange, so under TLS 1.3 an RSA certificate is used only for signatures.

Example

X509v3 Key Usage: critical
    Digital Signature, Key Encipherment

This is typical of an RSA server certificate; an ECDSA server certificate usually shows only Digital Signature.

Common misconceptions

• Key Usage and Extended Key Usage are the same thing. KU limits cryptographic operations and EKU limits purposes; when both are present, both must allow the use.
• keyEncipherment is needed for TLS 1.3. TLS 1.3 never encrypts with the certificate key; digitalSignature is what matters.