Support client/server key usages on issued certificates about aws-privateca-issuer HOT 3 CLOSED

I checked the docs and from my understanding we would probably need to use the BlankEndEntityCertificate_CSRPassthrough/V1 template to have those key usages be passed on from the CSR that cert-manager provides.
@paramsethi can you confirm this? And would we need some kind of default for people who don't specify any key usage?

from aws-privateca-issuer.

I believe cert-manager provides a default already. From cert-manager - Key Usages:

Unless any number of usages has been set, cert-manager will set the default requested usages of “digital signature”, “key encipherment”, and “server auth”

One other consideration about BlankEndEntityCertificate_CSRPassthrough/V1 is that it will not include the digital signature and key encipherment usages by default. These usages are important to some TLS implementations.

If a user specifies only KeyUsages: [ "server auth" ], they may be surprised if their certificate doesn't work as expected.

from aws-privateca-issuer.

If no templateArn is provided, the acm-pca/IssueCertificate uses default EndEntityCertificate template which includes both Server, and client auth as keyusage values.

If the KeyUsage in CSR is present, we can use BlankEndEntityCertificate_CSRPassthrough template.

However, If KeyUsage is not populated in the CSR, we should fall back to using the default EndEntityCertificate in order to issue a valid X509 certificate.

The other option is to use specific template, which are only used for Client Auth or Server Auth. ACM Private CA provides EndEntityClientAuthCertificate, and EndEntityServerAuthCertificate templates for this purpose, which adds the Client Auth and Server Auth values in ExtendedKeyUsage field and keep the KeyUsage values for digital signature and key encipherment.

from aws-privateca-issuer.