I want to use SCEP to give out client certificates, probably using ADCS. We already have an internal offline root CA in place (securely in a safe, only used for signing and revoking intermediate certificate authorities), and this root is trusted by all internal clients and servers.

For signing the client certificates, I want to create an intermediate that can do only that: signing client certificates. Specifically, I don't want it to be possible to sign server certificates with this intermediate (the reason being that the intermediate by necessity has to be on an online system, and I want to limit the possible damage in case it gets breached)

Is this even possible?


If you create the intermediate CA with only the client auth certificate EKU ( then even if a template got altered to allow it to endorse server auth certificates they would fail a chain walk.

On Windows this would report an error with the leaf/EE certificate with status CERT_TRUST_IS_NOT_VALID_FOR_USAGE (or, in .NET, X509ChainStatusFlags.NotValidForUsage).

  • Isn't something that's set in the actual client certificates, not the intermediate? – Roel Harbers Apr 3 '17 at 12:10
  • 1
    Usually it's omitted from the CA chain, making them "valid for all purposes". But you can constrain them. The CA/Browser Forum Baseline Requirements even talks about it "... For a Subordinate CA Certificate to be considered Technically Constrained, the certificate MUST include an Extended Key Usage (EKU) extension specifying all extended key usages that the Subordinate CA Certificate is authorized to issue certificates for.". (cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.4.2.pdf, 7.1.5) – bartonjs Apr 3 '17 at 14:37

With AD integrated CAs you can specify the Certificate Templates, which a CA is allowed to issue. So, yes you can.

But note: Certificate Templates are stored in Forest Root. Thus the Forest Root admin can change the available certificate templates! The domain admin or local admin of the sub CA can change the templates provided by the sub CA. Thus you should in addition set the access rights on the templates accordingly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.