add digitalSignature keyUsage to CA, for signing OCSP response

Signed-off-by: Youfu Zhang <[email protected]>
OpenVPN · Jun 25, 2021 · d73dd6e · d73dd6e
1 parent a0d8767
commit d73dd6e
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/easyrsa3/openssl-easyrsa.cnf b/easyrsa3/openssl-easyrsa.cnf
@@ -123,7 +123,7 @@ basicConstraints = critical, CA:true
 
 # Limit key usage to CA tasks. If you really want to use the generated pair as
 # a self-signed cert, comment this out.
-keyUsage = critical, cRLSign, keyCertSign
+keyUsage = critical, cRLSign, digitalSignature, keyCertSign
 
 # nsCertType omitted by default. Let's try to let the deprecated stuff die.
 # nsCertType = sslCA

diff --git a/easyrsa3/x509-types/ca b/easyrsa3/x509-types/ca
@@ -9,5 +9,5 @@
 basicConstraints = critical, CA:TRUE
 subjectKeyIdentifier = hash
 authorityKeyIdentifier = keyid:always,issuer:always
-keyUsage = critical, cRLSign, keyCertSign
+keyUsage = critical, cRLSign, digitalSignature, keyCertSign