What do Key Usage and Extended Key Usage say, and what can a certificate from the default "User" template be used for?
Key Usage limits the low-level cryptographic operations of the key; Extended Key Usage names the application purposes. A default user certificate allows client authentication, secure e-mail and EFS file encryption.
- Key Usage (KU) is about what the key may do mathematically:
digitalSignature,keyEncipherment,dataEncipherment,keyCertSign(only CAs),cRLSign, … - Extended Key Usage (EKU) is about what the certificate is for:
serverAuth(TLS server),clientAuth(TLS client login),codeSigning,emailProtection(S/MIME),OCSPSigning, Encrypting File System, …
Relying software checks these. A browser accepts a certificate as a web server only if its EKU contains serverAuth, and PowerShell accepts it for signing only with codeSigning. A stolen web server certificate therefore cannot be used to sign software.
The web server request in this lab asks for keyUsage = keyEncipherment, dataEncipherment and extendedKeyUsage = serverAuth. A certificate autoenrolled from a copy of the AD User template shows in its Details tab the purposes Client Authentication, Secure Email and Encrypting File System: log in to TLS sites with it, sign and encrypt mail, encrypt files on NTFS.
Go deeper:
RFC 5280: X.509 PKI Certificate and CRL Profile — sections 4.2.1.3 (Key Usage) and 4.2.1.12 (Extended Key Usage).- Wikipedia: X.509 — extensions and their common values.