Ability to create a CSR locally with an EKU (a standard x509 v3 extension)

[ahpala]

BUSINESS PROBLEM

We have a use case with a customer who uses VCert in an embedded environment. They need to compose CSR in this environment with x509 Extended Key Usage. Unfortunately the CA in this environment does not have an ability to insert the EKU during signing process (which may be missing the EKU). This results in a signed certificate without EKU extension.

PROPOSED SOLUTION

Enhance ability in VCert for CLI options, as well as the playbook to include EKU as an optional attribute in the CSR.

CURRENT ALTERNATIVES

At present other alternatives are not available as the client environment is an embedded Linux OS with highly restrictive security conditions.

VENAFI EXPERIENCE