创建 CA 证书的 x.509 V3 扩展基本约束和密钥用法有什么区别？
这两个操作似乎执行相同的操作：
- 在 X.509 证书中使用基本约束扩展来表示它是 CA 证书，并
- 使用密钥用法扩展例如表示公钥可用于证书签名。
这些扩展有什么区别？
它们的目的相同还是互补？
These two actions seem to do the same:
- using the Basic Constraints extension in a X.509 Certificate to signify that it is a CA certificate and
- using the Key Usage extension e.g. to signify that the public key can be used for certificate signining.
What is the difference between these extensions?
Do they serve same purpose or complement each other?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
“密钥用法”定义了可以使用证书中包含的密钥执行哪些操作。使用示例有：加密、签名、签名证书、签名 CRL。
“基本约束”标识证书的主体是否是允许颁发子证书的 CA。
对于可用于签署证书的证书，该信息在某种意义上是重复的：
但“基本约束”还将指定有效证书链的最大深度。
尽管它是重复的，但您需要根据 RFC 3280 --- 指定两者X.509。
这是 RFC（第 29 页）中的相关段落：
"Key Usage" defines what can be done with the key contained in the certificate. Examples of usage are: ciphering, signature, signing certificates, signing CRLs.
"Basic Constraints" identifies if the subject of certificates is a CA who is allowed to issue child certificates.
For a certificate that can be used to sign certificates, the info is in some sense duplicated:
But "Basic Constraints" will also specify the maximum depth of valid certification chain.
Though it is duplicated, you need to specify both, according to RFC 3280 --- X.509.
This is the relevant paragraph from the RFC (page 29):
密钥用途描述了证书的预期用途。
基本约束扩展描述了顶部证书的证书链的深度。换句话说，当颁发子 CA 证书时，CA 使用此扩展来限制其子 CA 的活动。如果顶级 CA 获得子 CA ，则它允许子 CA 颁发最终用户证书，但不允许子 CA 拥有自己的子 CA。
Key Usage describes intended purposes of the certificate.
Basic Constraints extension describes how deep the certificate chain that has the certificate as it's top can be. In other words, this extension is used by CAs to restrict activity of their sub-CAs when the sub-CA certificate is issued. If toplevel CA gets a sub-CA , it allows sub-CA to issue end-user certificates, but doesn't allow sub-CA have it's own sub-CAs.