# What Is Key Usage (keyUsage extension)? Definition and Examples

> Key Usage is the X.509 extension that limits the cryptographic operations a certificate's key may perform, such as signing data or signing certificates.

Source: https://ssl.sh/glossary/key-usage/
Last updated: 2026-11-10

Key Usage is a bit string defined in RFC 5280 with nine flags: digitalSignature, nonRepudiation (also called contentCommitment), keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly and decipherOnly. It describes low-level operations, while [Extended Key Usage](https://ssl.sh/glossary/extended-key-usage/) describes application purposes such as TLS server authentication. CA certificates use keyCertSign and cRLSign; TLS server certificates use digitalSignature, often with keyEncipherment for RSA keys.

## Why it matters
Clients enforce Key Usage when it is present, and it is usually marked critical, so a wrong flag makes a certificate fail even when everything else is correct. The flags should follow the key type and protocol: an [ECDSA](https://ssl.sh/glossary/ecdsa/) key signs handshake data and needs digitalSignature. keyEncipherment exists for the old [RSA](https://ssl.sh/glossary/rsa/) key exchange, in which the client encrypted the premaster secret with the server's RSA public key. TLS 1.3 removed that key exchange, so under TLS 1.3 an RSA certificate is used only for signatures.

## Example
```text
X509v3 Key Usage: critical
    Digital Signature, Key Encipherment
```

This is typical of an RSA server certificate; an ECDSA server certificate usually shows only `Digital Signature`.

## Common misconceptions
- **Key Usage and Extended Key Usage are the same thing.** KU limits cryptographic operations and EKU limits purposes; when both are present, both must allow the use.
- **keyEncipherment is needed for TLS 1.3.** TLS 1.3 never encrypts with the certificate key; digitalSignature is what matters.

## Related terms

- [EKU](https://ssl.sh/zh/glossary/extended-key-usage/): EKU 即扩展密钥用途，是列出证书可用于哪些目的（如 serverAuth 服务器认证、clientAuth 客户端认证、代码签名）的 X.509 扩展。
- [基本约束](https://ssl.sh/zh/glossary/basic-constraints/): 基本约束是 X.509 证书扩展，用来声明该证书是否属于 CA，以及其下方还允许出现多少层 CA。
- [X.509](https://ssl.sh/zh/glossary/x509/): X.509 是 ITU-T 制定的公钥证书标准格式，其互联网配置规范 RFC 5280 规定了 TLS 所用证书的结构和验证方法。
- [数字签名](https://ssl.sh/zh/glossary/digital-signature/): 数字签名是用私钥对消息计算出的一个值，任何持有对应公钥的人都能验证它，从而确认消息来源和内容未被篡改。
- [RSA](https://ssl.sh/zh/glossary/rsa/): RSA 是 1977 年提出的公钥算法，TLS 用它对证书和握手进行签名，在 TLS 1.3 之前还用它传输会话密钥。
- [ECDSA](https://ssl.sh/zh/glossary/ecdsa/): ECDSA 是基于椭圆曲线的数字签名算法，在 TLS 证书中作为 RSA 的替代方案，密钥和签名更小、签名运算更快。
- [TLS 1.3](https://ssl.sh/zh/glossary/tls-1-3/): TLS 1.3 是当前最新的传输层安全协议版本（2018 年的 RFC 8446，现行规范为 RFC 9846），完整握手只需一个往返，且只保留 AEAD 加密算法。