CA 是否可以在签名前修改 CSR？
谁能告诉我，在使用自己的私钥实际签署证书之前，是否允许认证机构 (CA) 对证书签名请求 (CSR) 进行修改？
具体来说，我想知道 CA 在添加签名之前将其他字段（例如 EKU）插入到证书中是否有效。
Can anyone please tell me if Certifying Authorities (CAs) are allowed to make modifications to the Certificate Signing Request (CSR) before actually signing the certificate with their own private key?
Specifically, I'd like to know if it's valid for the CA to insert additional fields (such as EKUs) into the cert before adding their signature.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
是
证书颁发机构负责通过其策略文件和模板强制执行组织的 PKI 安全策略。 这可能包括 EKU（扩展密钥使用）属性。
实际上，您是代表您的主体向 CA 请求某种类型的证书。 CA 负责强制执行其将颁发的证书类型（以及相关用途）。
CA 实际上并没有修改请求，而是颁发了允许类型的证书。
Yes
The Certificate Authority is responsible for enforcing the organisations PKI security policy via its policy files and templates. This may include EKU (extended key usage) attributes.
In reality you are requesting a certificate of a certain type from the CA on behalf of your subject. It is up to the CA to enforce the type of certificates (and the associated uses) that it will issue.
The CA is not actually modifying the request so much as issuing a cert of a permitted type.
我不能笼统地谈论 CA，但我曾经运行过一个带有自己的 CA 的 Windows Server 2003 网络，并且绝对可以制作
certreq（通过-attrib选项）在 CSR 到达 CA 之前向其添加其他字段。 因此，在我看来，CA 本身也可以做同样的事情。你的旅费可能会改变。
I can't speak about CAs in general, but I once ran a Windows Server 2003 network with its own CA, and it's definitely possible to make
certreq(through the-attriboption) add additional fields to the CSR before it gets to the CA. Thus, it looks to me like it's possible for the CA itself to do much the same thing.Your mileage may vary.