What is the difference between the x.509 V3 extensions Basic Constraints and Key Usage to create a CA certificate?

Question

These two actions seem to do the same:

• using the Basic Constraints extension in a X.509 Certificate to signify that it is a CA certificate and

Answer 1

"Key Usage" defines what can be done with the key contained in the certificate. Examples of usage are: ciphering, signature, signing certificates, signing CRLs.

"Basic Constraints" identifies if the subject of certificates is a CA who is allowed to issue child certificates.

For a certificate that can be used to sign certificates, the info is in some sense duplicated:

• X509v3 Basic Constraints: CA: TRUE --- Can sign certificates
• X509v3 Key Usage: Key Cert Sign --- Can sign certificates

But "Basic Constraints" will also specify the maximum depth of valid certification chain.

Though it is duplicated, you need to specify both, according to RFC 3280 --- X.509. This is the relevant paragraph from the RFC (page 29):

The keyCertSign bit is asserted when the subject public key is used for verifying a signature on public key certificates. If the keyCertSign bit is asserted, then the cA bit in the basic constraints extension (section 4.2.1.10) MUST also be asserted.

Answer 2

Key Usage describes intended purposes of the certificate.

Basic Constraints extension describes how deep the certificate chain that has the certificate as it's top can be. In other words, this extension is used by CAs to restrict activity of their sub-CAs when the sub-CA certificate is issued. If toplevel CA gets a sub-CA , it allows sub-CA to issue end-user certificates, but doesn't allow sub-CA have it's own sub-CAs.