{"record":{"id":"5dd5a9e1f678ac8f","repo":"gravitational/teleport","slug":"missing-keyusage-keycertsign","errorCode":null,"errorMessage":"missing KeyUsage keyCertSign","messagePattern":"missing KeyUsage keyCertSign","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/subca/parsed.go","lineNumber":353,"sourceCode":"\t}\n\tif certClusterName != clusterName {\n\t\treturn fmt.Errorf(\n\t\t\t\"incorrect cluster name %q (expected %q)\",\n\t\t\tcertClusterName,\n\t\t\tclusterName,\n\t\t)\n\t}\n\n\t// Verify certificate constraints.\n\tswitch {\n\tcase !cert.IsCA:\n\t\treturn errors.New(\"not a CA certificate (IsCA=false)\")\n\tcase !cert.BasicConstraintsValid:\n\t\treturn errors.New(\"basic constraints not valid (BasicConstraintsValid=false)\")\n\tcase cert.KeyUsage&x509.KeyUsageCertSign == 0:\n\t\t// Usage names per Go 1.26.1.\n\t\t// https://cs.opensource.google/go/go/+/refs/tags/go1.26.1:src/crypto/x509/x509_string.go;l=23\n\t\treturn errors.New(\"missing KeyUsage keyCertSign\")\n\tcase cert.KeyUsage&x509.KeyUsageCRLSign == 0:\n\t\treturn errors.New(\"missing KeyUsage cRLSign\")\n\tcase cert.NotBefore.After(cert.NotAfter):\n\t\treturn errors.New(\"NotBefore > NotAfter\")\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":335,"sourceCodeEnd":362,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/subca/parsed.go#L335-L362","documentation":"validateOverrideCertificate requires the override certificate's KeyUsage to include keyCertSign (x509.KeyUsageCertSign). Without this key usage the certificate is not permitted to verify/sign other certificates, so it cannot serve as a CA override.","triggerScenarios":"Supplying a certificate where KeyUsage is set but does not contain the keyCertSign bit (e.g. only digitalSignature/keyEncipherment) when calling ValidateAndParseCAOverride.","commonSituations":"Reusing a TLS server certificate as an override CA; CA certs issued by tooling that forgot the keyUsage extension; certificates converted between formats dropping extensions.","solutions":["Re-issue the CA certificate with KeyUsage including keyCertSign (and cRLSign).","Inspect with 'openssl x509 -in cert.pem -text' that 'Certificate Sign' appears under Key Usage.","In Go generation code, add x509.KeyUsageCertSign to template.KeyUsage."],"exampleFix":"// before\nKeyUsage: x509.KeyUsageDigitalSignature\n// after\nKeyUsage: x509.KeyUsageDigitalSignature |\n          x509.KeyUsageCertSign |\n          x509.KeyUsageCRLSign","handlingStrategy":"validation","validationCode":"if cert.KeyUsage&x509.KeyUsageCertSign == 0 {\n    return errors.New(\"override cert lacks keyCertSign key usage\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always provision CA certs with KeyUsageCertSign (plus CRLSign).","Check key usage via 'openssl x509 -text | grep -A1 \"Key Usage\"'.","Never reuse TLS server certs as CA overrides."],"tags":["x509","certificate","keyusage","validation"],"backgroundTag":"certificate-missing-key-usage","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}