Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is Extended Key Usage (EKU)?
Short answer
Extended Key Usage (EKU) is the X.509 extension that states the purposes for which a certificate can be used (RFC 5280): Server authentication (serverAuth) allows the certificate to prove the identity of a server, and Client Authentication (clientAuth) allows it to prove the identity of a client (a user, a device or a service). The party that validates the certificate examines the EKU; for example, a certificate that carries only Server authentication can be rejected as a client certificate in mTLS. In TR7, the EKU of the certificates that the internal CA will issue is selected in the Extended Key Usage field in Certificate Profiles (default Server authentication); the EKU value of an installed certificate appears in the Extended Key Usage (EKU) row on the Details tab of the preview.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Certificates & PKI → Certificate Profiles → Add | Extended Key Usage: Server authentication (default), Client Authentication; at least one is selected | The purpose of use of the certificate that will be issued with the Internal CA |
| Certificate Profiles | Usage: TLS server, Client / mTLS | On which screen the profile can be selected (SSL/TLS Certificates → Internal CA or Client Certificates) |
| Certificates & PKI → Client Certificates → Issue from an internal CA | Certificate profile | Client Authentication is added to the certificate even if it is not selected in the profile |
| SSL/TLS Certificates → preview → Details | Extended Key Usage (EKU) | The EKU values of the installed certificate (e.g. serverAuth) |
Common Misconceptions
- "Every certificate can be used for both the server and the client." EKU limits the permitted purposes; for both purposes, both must be selected.
- "The Usage value of the profile determines the EKU." Usage determines on which screen the profile is listed; the EKU comes from the Extended Key Usage field, and the form does not enforce that the two match. Server authentication is selected in a TLS server profile, and Client Authentication in a Client / mTLS profile.
- "A certificate that carries no EKU cannot be used for any purpose." In a certificate that has no EKU extension, usage is not restricted by this extension; the restriction comes into effect when an EKU is written. The internal CA of TR7 writes an EKU to the server and client certificates it issues.
How it is done in the documentation
