Mandatory Certificate Extensions

May 14, 2020 | Posted in certificates,security

When you create certificates or certificate requests for a CA, your certificate must comply with certain standards, otherwise, it will be considered "non-standard".

On mac os you even get a warning that a website presents a non-standard certificate when you try to open the cert in Safari or Chrome (but not in Firefox).

First of all, you must have the Subject Alternative Name (SAN) extension, this extension must contain DNS names of all the domain names the certificate was issued for. Browsers no longer trust the "CN" of the subject field.

Your certificate must have a "Basic Constraints" extension marked as critical and specifying that the subject is not a CA.

Your certificate must also have a non-critical "Extended key usage" extension specifying "TLS Web Server Authentication" (if your certificate is used by a server).

Another requirement is to provide a "Key Usage" extension (marked as critical) allowing for "Digital Signature" and "Key Encipherment".

Finally, and this is just common sense, your certificate's validity must be limited to 825 days (the shorter the better) and the RSA's minimal acceptable key length is 2048.