certs: fix csr generation (correct the key usage, remove msExtReq from attributes)

1 files changed, 1 insertions, 2 deletions

diff --git a/lib/leap_cli/commands/ca.rb b/lib/leap_cli/commands/ca.rb
index ea4c8a8..ecc324b 100644
--- a/lib/leap_cli/commands/ca.rb
+++ b/lib/leap_cli/commands/ca.rb
@@ -303,7 +303,7 @@ module LeapCli; module Commands
       basic.ca = false
     }
     extensions << CertificateAuthority::Extensions::KeyUsage.new.tap {|keyusage|
-      keyusage.usage = ["digitalSignature", "nonRepudiation"]
+      keyusage.usage = ["digitalSignature", "keyEncipherment"]
     }
     extensions << CertificateAuthority::Extensions::ExtendedKeyUsage.new.tap {|extkeyusage|
       extkeyusage.usage = [ "serverAuth"]
@@ -317,7 +317,6 @@ module LeapCli; module Commands
     )])
     attrs = [
       OpenSSL::X509::Attribute.new("extReq", attrval),
-      OpenSSL::X509::Attribute.new("msExtReq", attrval)
     ]
     csr.attributes = attrs