Key Usage Decoder

Decode certificate key usage and extended key usage extensions

About Key Usage Extensions

Key Usage and Extended Key Usage are X.509 certificate extensions that define the cryptographic operations a certificate is authorized to perform. Key Usage specifies low-level operations like digital signatures and key encipherment, while Extended Key Usage defines higher-level purposes like server authentication, client authentication, or code signing. Our Key Usage Decoder fetches a server's certificate and displays both extensions in a human-readable format, helping you understand exactly what each certificate is allowed to do.

How to Use

Enter the domain name whose certificate key usage you want to decode.
Click Decode to fetch the certificate and parse its extensions.
Review the Key Usage and Extended Key Usage sections for permitted operations.
Check if the certificate is a CA certificate and its path length constraint.

Use Cases

Certificate Validation: Confirm that a certificate has the correct key usage extensions for its intended purpose.
Security Analysis: Identify certificates with overly permissive key usage that may pose security risks.
CA Certificate Review: Examine CA certificates to understand their issuing authority and path length constraints.
Compliance Checks: Verify that certificates meet organizational policies for key usage and extended key usage.

Frequently Asked Questions

Key Usage defines basic cryptographic operations like digitalSignature, keyEncipherment, and keyCertSign. Extended Key Usage defines more specific purposes like serverAuth (TLS web server), clientAuth (TLS client), and codeSigning. A certificate typically has both extensions to precisely define its allowed uses.

A typical TLS server certificate requires digitalSignature and keyEncipherment (or keyAgreement for ECDHE) in Key Usage, and serverAuth (1.3.6.1.5.5.7.3.1) in Extended Key Usage. Without these extensions, browsers may reject the connection as improperly configured.

Path length constraint is a property of CA certificates that limits how many intermediate CAs can exist below them in the certificate chain. A path length of 0 means the CA can only issue end-entity certificates, not subordinate CAs.

Tips & Best Practices

•Configure appropriate key usage extensions for your certificate purpose
•Verify key usage matches your intended certificate application
•Use extended key usage for specific application requirements
•Monitor key usage compliance across your certificate infrastructure

Technical Details

Extensions: Key Usage and Extended Key Usage analysis
Purposes: Digital Signature, Key Encipherment, Code Signing, etc.
Validation: Key usage compatibility with certificate purpose
Output: Key usage assessment with recommendations