# Certgen and the "Extended Key Usage" field

**URL:** <https://discuss.elastic.co/t/certgen-and-the-extended-key-usage-field/100536>\
**Category:** Elasticsearch\
**Created:** [September 14, 2017, 12:51pm UTC](https://discuss.elastic.co/t/certgen-and-the-extended-key-usage-field/100536 "2017-09-14T12:51:29Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Cornoualis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cornoualis/32/23246_2.png) [@Cornoualis](https://discuss.elastic.co/u/Cornoualis)\
**Post date:** [September 14, 2017, 12:51pm UTC](https://discuss.elastic.co/t/certgen-and-the-extended-key-usage-field/100536/1 "2017-09-14T12:51:29Z")

</div>

In a previous topic, there was a discussion about the "Extended Key Usage" field that was left blank by certgen, when generating a CSR:

> [@SSL between elastic nodes is failing](https://discuss.elastic.co/t/ssl-between-elastic-nodes-is-failing/91925/3):
>
> Thanks for the information. We have used certgen tool to create csr then the certificates are signed by our organization. Does the certgen tool has some option to specify extended key usage while creating csr or we need to take care of extended key usage while signing csr and creating certificate?

**Since we know in advance that the certificate will be used for both server and client authentication, why don't you directly put this value by default?**

I had the problem with my PKI team that fills the field with "Server authentication" by default when the field is blank.

Thanks in advance for your help!

---

<div class="post-metadata">

**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\
**Post date:** [September 22, 2017, 2:20pm UTC](https://discuss.elastic.co/t/certgen-and-the-extended-key-usage-field/100536/2 "2017-09-22T14:20:21Z")

</div>

This is a good question. `certgen` is meant for use to generate certificates and keys for other components of the Elastic stack, which would only need client authentication as the key usage. I think we will definitely consider having this be auto populated as no EKU implies the key can be used for anything vs just client and server authentication.

---

<div class="post-metadata">

**Author:** ![Cornoualis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cornoualis/32/23246_2.png) [@Cornoualis](https://discuss.elastic.co/u/Cornoualis)\
**Post date:** [September 25, 2017, 1:07pm UTC](https://discuss.elastic.co/t/certgen-and-the-extended-key-usage-field/100536/3 "2017-09-25T13:07:05Z")

</div>

Thank you Jay!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 23, 2017, 1:07pm UTC](https://discuss.elastic.co/t/certgen-and-the-extended-key-usage-field/100536/4 "2017-10-23T13:07:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.