{"record":{"id":"5086db72182e9d71","repo":"gravitational/teleport","slug":"missing-keyusage-crlsign","errorCode":null,"errorMessage":"missing KeyUsage cRLSign","messagePattern":"missing KeyUsage cRLSign","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/subca/parsed.go","lineNumber":355,"sourceCode":"\t\treturn fmt.Errorf(\n\t\t\t\"incorrect cluster name %q (expected %q)\",\n\t\t\tcertClusterName,\n\t\t\tclusterName,\n\t\t)\n\t}\n\n\t// Verify certificate constraints.\n\tswitch {\n\tcase !cert.IsCA:\n\t\treturn errors.New(\"not a CA certificate (IsCA=false)\")\n\tcase !cert.BasicConstraintsValid:\n\t\treturn errors.New(\"basic constraints not valid (BasicConstraintsValid=false)\")\n\tcase cert.KeyUsage&x509.KeyUsageCertSign == 0:\n\t\t// Usage names per Go 1.26.1.\n\t\t// https://cs.opensource.google/go/go/+/refs/tags/go1.26.1:src/crypto/x509/x509_string.go;l=23\n\t\treturn errors.New(\"missing KeyUsage keyCertSign\")\n\tcase cert.KeyUsage&x509.KeyUsageCRLSign == 0:\n\t\treturn errors.New(\"missing KeyUsage cRLSign\")\n\tcase cert.NotBefore.After(cert.NotAfter):\n\t\treturn errors.New(\"NotBefore > NotAfter\")\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":337,"sourceCodeEnd":362,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/subca/parsed.go#L337-L362","documentation":"validateOverrideCertificate requires the override certificate's KeyUsage to include cRLSign (x509.KeyUsageCRLSign), since the override CA must be able to sign certificate revocation lists. Certificates lacking this bit are rejected even if they can sign certificates.","triggerScenarios":"Supplying an override certificate whose KeyUsage contains keyCertSign but not cRLSign when calling ValidateAndParseCAOverride.","commonSituations":"Minimal CA certs generated with only KeyUsageCertSign; PKI tooling defaults that omit CRL signing; older internal CAs created before CRL support was needed.","solutions":["Re-issue the certificate with KeyUsage = KeyUsageCertSign | KeyUsageCRLSign.","Verify with 'openssl x509 -text' that Key Usage lists both 'Certificate Sign' and 'CRL Sign'.","If the issuing CA cannot be changed, obtain a properly provisioned override CA certificate."],"exampleFix":"// before\nKeyUsage: x509.KeyUsageCertSign\n// after\nKeyUsage: x509.KeyUsageCertSign | x509.KeyUsageCRLSign","handlingStrategy":"validation","validationCode":"if cert.KeyUsage&x509.KeyUsageCRLSign == 0 {\n    return errors.New(\"override cert lacks cRLSign key usage\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Issue CA certs with KeyUsageCertSign|KeyUsageCRLSign so CRL signing works.","Verify both 'Certificate Sign' and 'CRL Sign' appear in the key usage before deployment.","Include CRL signing requirements in your internal PKI issuance policy."],"tags":["x509","certificate","keyusage","crl"],"backgroundTag":"certificate-missing-key-usage","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}