I am trying to set up a Root Certificate Authority using Keychain Access/Certificate Assistant but I am running into some trouble.

When creating the authority the assistant asks you to enter Key Usage and Extended Key usage extension settings for both the CA itself and the users of it. However, upon completion of the certificate this seems to have been swapped around. So the CA itself seems to have the settings that were entered for the users of the CA.

For demonstration purpose, I have made some screenshots of setting up a Test CA:

enter image description here

This setup will yield the certificate seen below:

As you can see the values for the key usage and extended key usage extensions come from the values entered for the users for this CA. While the values for the basic constraints and subject alternate name seem to be taken correctly from the values entered for the CA itself.

Now I have a few questions about this:

  • Is this a bug in certificate assistant and are the extensions 2 & 3 below incorrectly taken form the assistant? (If so I will have to use OpenSSL)
  • If not, what is the reason the certificate would show default values it uses for certificates it will issue? And in that case, does the Key Usage field at No. 1 below represent the correct values entered for the CA?
  • Do the user values entered for those 2 extensions affect the issued certificates in any way? (If the defaults for the issued certificate are changed). The reason I ask this is because I have read somewhere that the key usage extension sets defaults for issued certificates while the extended key usage extension sets restrictions for issued certificates.

enter image description here

  • 1
    Related: Key usage extensions and extended key usage
    – klanomath
    Commented Aug 15, 2016 at 16:05
  • Thank you for that @klanomath. That is by far the clearest explanation I have seen on this topic. Although I have yet to find a good explanation for what Non-Repudiation does with for example emails and where else it could be used. But there still seems to be a problem, even if the Usage/Purpose itself changed automatically because of dependencies then certificate assistant still took the criticality indicator from the wrong fields. Commented Aug 15, 2016 at 16:21

1 Answer 1


So I've been looking into this further and from what I read here and there, I am pretty sure that it is not supposed to be doing this. I have reported this bug to apple and if I ever get an answer from them I will update this post.

If anyone with the same problem finds this post, this is the temporary solution I used:

  1. Create the certificate authority and for any extension that gives you two screens enter the same values in both. Those should be the values you want on the certificate itself.
  2. When done, go to ~/Library/Application Support/Certificate Authority/[ca name] and edit the template file there for the values you actually wanted to enter into the second screen of every extension.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .