Study. uk . com
  1. Home
  2. All questions
  3. Question 251

CISSP study material · question 251 of 500

A certificate authority's signing key will only ever sign certificates and revocation lists. Which practice does RFC 5280 recommend for its keyUsage bits?

  1. Set nonRepudiation, since a certificate authority must not deny its issuances.
  2. Leave digitalSignature and nonRepudiation clear so the certificate claims no more than it does.
  3. Set digitalSignature as well, since certificate signing is a form of signing.
  4. Set all bits, since the profile does not restrict combinations.
Show the answer

Answer: B. Leave digitalSignature and nonRepudiation clear so the certificate claims no more than it does.

Where the key signs only certificates or revocation lists, those two bits should stay clear, though they may be set if other objects are signed too.

Source: RFC 5280 (IETF) — RFC 5280 > 4.2.1.3 Key Usage

Challenge yourself on this topic → Study as cards