setting x509.KeyUsageCertSign | x509.KeyUsageCRLSign on the CA certificate breaks macOS about scep HOT 2 CLOSED

Could you describe more? I see following error message in scep enrollment without "x509.KeyUsageCRLSign " 10.13.4 beta (17E170c).

CertificateService Server capabilities lack support for 3DES but we're going to use it anyway
CertificateService Creating inner envelope for CSR failed: -50
CertificateService [ERROR] <: [MDM_SCEP_Enroll] Calling SCEPRequestCertSignatureWithCSR --> NSOSStatusErrorDomain:-50
mdmclient [ERROR] <<<<< PlugIn: InstallPayload [CertificateService] Error: Error Domain=NSOSStatusErrorDomain Code=-50 "paramErr: error in user parameter list" UserInfo={IsInternalError=true} <<<<<

from scep.

Tested on 10.13.6 successfully — profile issued and installed successfully. CA cert:

$ curl -s 'http://scepserver/scep?operation=GetCACert' | openssl x509 -inform DER -noout -text | grep -B 1 CRL
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign

from scep.