Powershell创建新的自签名证书。 根CA证书：绝对不能存在extendedKeyUsage。

Question

I am currently making a RootCA and a SAN cert using powershell. Now everything is working as it should only it seems soms browsers are pretty strict when it comes to trusting a certificate. I am currently getting one last error when running my certificate through a linter (Z-lint in this case).

zlint ERROR Root CA Certificate: extendedKeyUsage MUST NOT be present.t

Now the error is pretty obvious... extendedKeyUsage should not be present in my powershell command when creating my RootCA

However I only use -keyUsage in my command. I am not quite sure what I need to adjust to my command to remove the error.

 $rootCert = New-SelfSignedCertificate -CertStoreLocation cert:\\LocalMachine\\My -keyUsage KeyEncipherment,DigitalSignature,CrlSign,CertSign -Subject "CN=AgionRootCA, OU=supplied, O=supplied, C=supplied, L=supplied, S=supplied" -TextExtension @("1.3.6.1.4.1.311.21.10={text}1.3.6.1.5.5.7.3.1,1.3.6.1.5.5.7.3.2", "2.5.29.19={text}CA=true","2.5.29.37={text}1.3.6.1.4.1.311.10.12.1") 

After following ->

When looking at the Microsoft Docs for the New-SelfSignedCertificate cmdlet it says the following about the -KeyUsage switch:

Specifies the key usages set in the key usage extension of the certificate. The acceptable values for this parameter are:

• CertSign
• CRLSign
• DataEncipherment
• DecipherOnly
• DigitalSignature
• EncipherOnly
• KeyAgreement
• KeyEncipherment
• None (default)
• NonRepudiation

The default value, None, indicates that this cmdlet does not include the KeyUsage extension in the new certificate. So it would seem like that if you want extendedKeyUsage to NOT be present you need to change -keyUsage KeyEncipherment,DigitalSignature,CrlSign,CertSign to -keyUsage None which would be default if you don't include the switch at all.

The error messages increased stating that I do need regular -KeyUsage, but not -extendedKeyUsage

Error messages:

zlint ERROR Root and Subordinate CA certificate keyUsage extension's crlSign bit MUST be set zlint ERROR Root CA Certificate: Bit positions for keyCertSign and cRLSign MUST be set.
zlint ERROR Root CA Certificate: extendedKeyUsage MUST NOT be present.t

Answer 1

Well I managed to solve the problem. In my Powershell command I had added the OID 2.5.29.37 at the end and apparently OID 2.5.29.37 is ExtendedKeyUsage. Therefore I kept on getting that problem. Closed!

More information on this matter Self signed certificates