From a19daeaadfeaa0ed733c87b5062e975d00aed488 Mon Sep 17 00:00:00 2001 From: Aaron Gable Date: Thu, 29 Oct 2026 11:27:09 -0700 Subject: [PATCH] Make digitalSignature KU optional for Subordinate CA Certificates Fixes https://github.com/letsencrypt/cp-cps/issues/347 --- CP-CPS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CP-CPS.md b/CP-CPS.md index 8c46723..ab5a73b 100644 --- a/CP-CPS.md +++ b/CP-CPS.md @@ -1072,7 +1072,7 @@ All ISRG Certificates are issued in accordance with one of the following Certifi |         `certificatePolicies` | Contains only the Baseline Requirements Domain Validated Reserved Policy Identifier (OID 2.23.140.1.2.1) | |         `crlDistributionPoints` | Contains the HTTP URI of a CRL issued by the Issuing CA whose scope includes this certificate | |         `extKeyUsage` | Contains only `id-kp-serverAuth` (OID 1.3.6.1.5.5.7.3.1) | -|         `keyUsage` | Critical, with only the `digitalSignature` (0), `keyCertSign` (5), and `cRLSign` (6) bits set | +|         `keyUsage` | Critical, with only the `keyCertSign` (5), `cRLSign` (6), and optionally `digitalSignature` (0) bits set | |         `subjectKeyIdentifier` | Contains a truncated hash of the `subjectPublicKey`, per Section 2(1) of RFC 7093 | |         Any other extension | Not present | | `signatureAlgorithm` | Byte-for-byte identical to the `tbsCertificate.signature` |