Is the CA allowed to change the CSR before signing?
Can someone tell me if Certification Authorities (CAs) can make changes to the Certificate Signing Request (CSR) before actually signing the certificate with their private key?
Specifically, I would like to know if it is valid for the CA to add additional fields (like EKU) to the certificate before adding their signature.
source to share
Yes
The CA is responsible for enforcing the organization's PKI security policies through its policy files and templates. This can include EKU (Extended Key Usage) attributes.
In effect, you are requesting a certain type of certificate from a CA on behalf of your subject. It is up to the CA to provide the type of certificates (and associated uses) that it will issue.
The CA does not actually modify the request in the same way that it issues an authorized type certificate.
source to share
I can't talk about CA at all, but I once ran a Windows Server 2003 network with my own CA and it is definitely possible certreq
(via an option -attrib
) to add additional fields to the CSR before it gets to the CA. So it seems to me that the CA can do the same.
Your mileage may vary.
source to share