tree 9d23bc598cf2bd179ece2c9f7a4b7c98be4e6abc
parent c2303dcbe84172e0c0da4c9f083eeca54c06f298
author Filippo Valsorda <hi@filippo.io> 1491543861 -0700
committer Alex Vaghin <ddos@google.com> 1491546772 +0000

acme: set correct KeyUsage and ExtKeyUsage

A certificate must have the Server Auth Extended Key Usage to be used
for TLS, and an ECDSA certificate must have the Digital Signature Key
Usage to be used at all (you can't encrypt to an ECDSA key).

crypto/tls ignores (E)KUs when serving certificates, and most browsers
do as well, so it works, but OpenSSL would refuse to serve these
certificates, and clients would be allowed to reject them.

Change-Id: I699e58e613f01077e6b67fdb9e789d46e1672112
Reviewed-on: https://go-review.googlesource.com/39913
Run-TryBot: Alex Vaghin <ddos@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Alex Vaghin <ddos@google.com>