{"record":{"id":"02a30ee30a1f5ccb","repo":"ory/hydra","slug":"the-ca-certificate-does-not-have-the-client-authen","errorCode":null,"errorMessage":"the CA certificate does not have the client authentication extended key usage (OID 1.3.6.1.5.5.7.3.2) set","messagePattern":"the CA certificate does not have the client authentication extended key usage \\(OID 1\\.3\\.6\\.1\\.5\\.5\\.7\\.3\\.2\\) set","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/tlsx/cert.go","lineNumber":301,"sourceCode":"\tif err != nil {\n\t\treturn cert, errors.Errorf(\"failed to encode private key: %s\", err)\n\t}\n\treturn cert, nil\n}\n\n// PEMBlockForKey returns a PEM-encoded block for key.\nfunc PEMBlockForKey(key interface{}) (*pem.Block, error) {\n\tb, err := x509.MarshalPKCS8PrivateKey(key)\n\tif err != nil {\n\t\treturn nil, errors.WithStack(err)\n\t}\n\treturn &pem.Block{Type: \"PRIVATE KEY\", Bytes: b}, nil\n}\n\n// NewClientCert creates a new client TLS certificate signed by the given CA.\nfunc NewClientCert(CAcert *x509.Certificate, CAkey crypto.PrivateKey, opts ...CertificateOpts) (*tls.Certificate, error) {\n\tif !slices.Contains(CAcert.ExtKeyUsage, x509.ExtKeyUsageClientAuth) {\n\t\treturn nil, errors.Errorf(\"the CA certificate does not have the client authentication extended key usage (OID 1.3.6.1.5.5.7.3.2) set\")\n\t}\n\tserialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)\n\tserialNumber, err := rand.Int(rand.Reader, serialNumberLimit)\n\tif err != nil {\n\t\treturn nil, errors.Errorf(\"failed to generate serial number: %s\", err)\n\t}\n\n\tkey, err := rsa.GenerateKey(rand.Reader, 3072)\n\tif err != nil {\n\t\treturn nil, errors.Errorf(\"failed to generate private key: %s\", err)\n\t}\n\n\ttemplate := &x509.Certificate{\n\t\tSerialNumber: serialNumber,\n\t\tSubject: pkix.Name{\n\t\t\tOrganization: []string{\"Ory GmbH\"},\n\t\t\tCommonName:   \"ORY\",\n\t\t},","sourceCodeStart":283,"sourceCodeEnd":319,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/tlsx/cert.go#L283-L319","documentation":"NewClientCert signs a client certificate using the provided CA. Before doing any work it checks that the CA certificate declares ExtKeyUsageClientAuth (OID 1.3.6.1.5.5.7.3.2). If the CA was created without the client-auth extended key usage, signing a client cert from it would yield a certificate peers reject, so the function fails fast with this error. It is a configuration problem with the CA certificate, not with the client key.","triggerScenarios":"Calling NewClientCert with a CA certificate generated without the ClientAuth extended key usage option (e.g. created via CreateSelfSignedCertificate with default opts, which sets server auth, or with ExtKeyUsage opts that omitted x509.ExtKeyUsageClientAuth).","commonSituations":"Reusing a server-only TLS CA to mint client certificates for mTLS; loading a CA from an external PKI that was provisioned for server authentication only; forgetting to pass the ExtKeyUsage option when creating the CA.","solutions":["Re-create the CA with the client-auth EKU: pass an option that sets ExtKeyUsage to include x509.ExtKeyUsageClientAuth.","If you cannot re-issue the CA, provision a separate CA that is allowed for client authentication.","Verify the loaded CA with cert.CheckSignature/cert.ExtKeyUsage before calling NewClientCert."],"exampleFix":"// before\ncaCert, _ := tlsx.CreateSelfSignedCertificate(caKey) // no EKU opts\nclient, err := tlsx.NewClientCert(caCert, caKey)\n// after\ncaCert, _ := tlsx.CreateSelfSignedCertificate(caKey, func(c *x509.Certificate) {\n    c.ExtKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth}\n    c.IsCA = true\n})\nclient, err := tlsx.NewClientCert(caCert, caKey)","handlingStrategy":"validation","validationCode":"func caSupportsClientAuth(caCert *x509.Certificate) bool {\n    return slices.Contains(caCert.ExtKeyUsage, x509.ExtKeyUsageClientAuth)\n}\n// call before NewClientCert","typeGuard":"func isClientAuthCA(cert *x509.Certificate) bool {\n    return cert != nil && slices.Contains(cert.ExtKeyUsage, x509.ExtKeyUsageClientAuth)\n}","tryCatchPattern":"client, err := tlsx.NewClientCert(caCert, caKey)\nif err != nil && strings.Contains(err.Error(), \"client authentication extended key usage\") {\n    // re-issue the CA with ExtKeyUsageClientAuth before retrying\n}","preventionTips":["Create CAs intended for mTLS with ExtKeyUsage including x509.ExtKeyUsageClientAuth.","Validate loaded CA certificates' ExtKeyUsage before using them to sign client certs.","Keep separate CAs for server-auth and client-auth roles in your PKI."],"tags":["tls","x509","mtls","certificate-config"],"backgroundTag":"certificate-extended-key-usage-missing","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}