gravitational/teleport · error

missing KeyUsage cRLSign

Error message

missing KeyUsage cRLSign

What it means

validateOverrideCertificate requires the override certificate's KeyUsage to include cRLSign (x509.KeyUsageCRLSign), since the override CA must be able to sign certificate revocation lists. Certificates lacking this bit are rejected even if they can sign certificates.

Source

Thrown at lib/subca/parsed.go:355

		return fmt.Errorf(
			"incorrect cluster name %q (expected %q)",
			certClusterName,
			clusterName,
		)
	}

	// Verify certificate constraints.
	switch {
	case !cert.IsCA:
		return errors.New("not a CA certificate (IsCA=false)")
	case !cert.BasicConstraintsValid:
		return errors.New("basic constraints not valid (BasicConstraintsValid=false)")
	case cert.KeyUsage&x509.KeyUsageCertSign == 0:
		// Usage names per Go 1.26.1.
		// https://cs.opensource.google/go/go/+/refs/tags/go1.26.1:src/crypto/x509/x509_string.go;l=23
		return errors.New("missing KeyUsage keyCertSign")
	case cert.KeyUsage&x509.KeyUsageCRLSign == 0:
		return errors.New("missing KeyUsage cRLSign")
	case cert.NotBefore.After(cert.NotAfter):
		return errors.New("NotBefore > NotAfter")
	}

	return nil
}

View on GitHub (pinned to 1283425b60)

Solutions

1. Re-issue the certificate with KeyUsage = KeyUsageCertSign | KeyUsageCRLSign.
2. Verify with 'openssl x509 -text' that Key Usage lists both 'Certificate Sign' and 'CRL Sign'.
3. If the issuing CA cannot be changed, obtain a properly provisioned override CA certificate.

Example fix

// before
KeyUsage: x509.KeyUsageCertSign
// after
KeyUsage: x509.KeyUsageCertSign | x509.KeyUsageCRLSign

if cert.KeyUsage&x509.KeyUsageCRLSign == 0 {
    return errors.New("override cert lacks cRLSign key usage")
}

When it happens

Trigger: Supplying an override certificate whose KeyUsage contains keyCertSign but not cRLSign when calling ValidateAndParseCAOverride.

Common situations: Minimal CA certs generated with only KeyUsageCertSign; PKI tooling defaults that omit CRL signing; older internal CAs created before CRL support was needed.

Related errors

• missing KeyUsage keyCertSign
• chain not allowed with an empty certificate
• override certificate should not be included in chain
• not a CA certificate (IsCA=false)
• basic constraints not valid (BasicConstraintsValid=false)

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/5086db72182e9d71. Report an issue: GitHub.