<p>When creating a <code>CertificateSigningRequest</code> (or <code>csr</code> for short) with the Kubernetes Certificate API we can specify &quot;usages&quot;. The <a href="https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/#create-certificatesigningrequest" rel="nofollow noreferrer">docs</a> show the following example for creating a <code>csr</code> object:</p>
<pre><code>cat &lt;&lt;EOF | kubectl apply -f -
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: myuser
spec:
  request: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQ1ZqQ0NBVDRDQVFBd0VURVBNQTBHQTFVRUF3d0dZVzVuWld4aE1JSUJJakFOQmdrcWhraUc5dzBCQVFFRgpBQU9DQVE4QU1JSUJDZ0tDQVFFQTByczhJTHRHdTYxakx2dHhWTTJSVlRWMDNHWlJTWWw0dWluVWo4RElaWjBOCnR2MUZtRVFSd3VoaUZsOFEzcWl0Qm0wMUFSMkNJVXBGd2ZzSjZ4MXF3ckJzVkhZbGlBNVhwRVpZM3ExcGswSDQKM3Z3aGJlK1o2MVNrVHF5SVBYUUwrTWM5T1Nsbm0xb0R2N0NtSkZNMUlMRVI3QTVGZnZKOEdFRjJ6dHBoaUlFMwpub1dtdHNZb3JuT2wzc2lHQ2ZGZzR4Zmd4eW8ybmlneFNVekl1bXNnVm9PM2ttT0x1RVF6cXpkakJ3TFJXbWlECklmMXBMWnoyalVnald4UkhCM1gyWnVVV1d1T09PZnpXM01LaE8ybHEvZi9DdS8wYk83c0x0MCt3U2ZMSU91TFcKcW90blZtRmxMMytqTy82WDNDKzBERHk5aUtwbXJjVDBnWGZLemE1dHJRSURBUUFCb0FBd0RRWUpLb1pJaHZjTgpBUUVMQlFBRGdnRUJBR05WdmVIOGR4ZzNvK21VeVRkbmFjVmQ1N24zSkExdnZEU1JWREkyQTZ1eXN3ZFp1L1BVCkkwZXpZWFV0RVNnSk1IRmQycVVNMjNuNVJsSXJ3R0xuUXFISUh5VStWWHhsdnZsRnpNOVpEWllSTmU3QlJvYXgKQVlEdUI5STZXT3FYbkFvczFqRmxNUG5NbFpqdU5kSGxpT1BjTU1oNndLaTZzZFhpVStHYTJ2RUVLY01jSVUyRgpvU2djUWdMYTk0aEpacGk3ZnNMdm1OQUxoT045UHdNMGM1dVJVejV4T0dGMUtCbWRSeEgvbUNOS2JKYjFRQm1HCkkwYitEUEdaTktXTU0xMzhIQXdoV0tkNjVoVHdYOWl4V3ZHMkh4TG1WQzg0L1BHT0tWQW9FNkpsYWFHdTlQVmkKdjlOSjVaZlZrcXdCd0hKbzZXdk9xVlA3SVFjZmg3d0drWm89Ci0tLS0tRU5EIENFUlRJRklDQVRFIFJFUVVFU1QtLS0tLQo=
  signerName: kubernetes.io/kube-apiserver-client
  expirationSeconds: 86400  # one day
  usages:
  - client auth
EOF
</code></pre>
<p>The docs show that many different usages can be set here:</p>
<pre><code>&gt;&gt; kubectl explain csr.spec.usages
KIND:     CertificateSigningRequest
VERSION:  certificates.k8s.io/v1

FIELD:    usages &lt;[]string&gt;

DESCRIPTION:
     usages specifies a set of key usages requested in the issued certificate.
     Requests for TLS client certificates typically request: &quot;digital
     signature&quot;, &quot;key encipherment&quot;, &quot;client auth&quot;.

     Requests for TLS serving certificates typically request: &quot;key
     encipherment&quot;, &quot;digital signature&quot;, &quot;server auth&quot;.

     Valid values are:
     &quot;signing&quot;, &quot;digital signature&quot;, &quot;content commitment&quot;, &quot;key encipherment&quot;,
     &quot;key agreement&quot;, &quot;data encipherment&quot;, &quot;cert sign&quot;, &quot;crl sign&quot;, &quot;encipher
     only&quot;, &quot;decipher only&quot;, &quot;any&quot;, &quot;server auth&quot;, &quot;client auth&quot;, &quot;code
     signing&quot;, &quot;email protection&quot;, &quot;s/mime&quot;, &quot;ipsec end system&quot;, &quot;ipsec tunnel&quot;,
     &quot;ipsec user&quot;, &quot;timestamping&quot;, &quot;ocsp signing&quot;, &quot;microsoft sgc&quot;, &quot;netscape
     sgc&quot;
</code></pre>
<p>Why does a TLS client certificate need &quot;digital signature&quot;, &quot;key encipherment&quot;, &quot;client auth&quot; as usages? What do these individual usage values mean? Which consequences does it have if some or all of these usages are set or not set?</p>
<p>I would also like to understand what the meaning of the other available options is but couldn't find a resource online.</p>

Moritz Wolff
<blockquote>
<p>Why does a TLS client certificate need &quot;digital signature&quot;, &quot;key encipherment&quot;, &quot;client auth&quot; as usages?</p>
</blockquote>
<p>It describes the purpose that the certificate created will have (and as you can see there are several ones). This avoids that certificates created for some specific purpose are used improperly.</p>
<blockquote>
<p>What do these individual usage values mean? Which consequences does it
have if some or all of these usages are set or not set?</p>
</blockquote>
<p>You've to specify one. In your example you're creating a Certificate which will be used by someone (likely just your <em>kubectl</em>) to authenticate to API Server as a specific User (thus a Client Authentication or <code>client auth</code>), other common uses cases are certificates used by Web Server to basically certify they're who they say they are (Server Authentication or <code>server auth</code>).</p>
<p>I don't actually know all the values but I'm pretty sure you can find some explanation <a href="https://help.hcltechsw.com/domino/11.0.0/conf_keyusageextensionsandextendedkeyusage_r.html" rel="nofollow noreferrer">online</a>.</p>
