keyEncipherment Key Usage in Public TLS RSA Certificates

Overview 

With the introduction of our new single-purpose TLS Root CAs, we’ve updated how certain key usage settings are handled for publicly trusted TLS certificates with RSA keys. If you’ve noticed that your newly issued RSA certificates no longer include the keyEncipherment key usage by default, this article explains what changed, why, and what your options are. 

What changed? 

For publicly trusted RSA TLS certificates issued from our new root chain, the keyEncipherment key usage (KU) is now optional rather than automatically included. 

Why did we make this change? 

The CA/Browser Forum (CABF), which sets the industry standards for publicly trusted certificates, does not require the keyEncipherment KU for modern TLS certificates, and current best practices discourage it. Our new root chain is designed to be the most modern and standards-aligned version we offer, so we’ve chosen to follow the industry standard by default. 

What if I need this key usage? 

We understand that some environments, applications, or devices still expect keyEncipherment to be present in leaf certificates. If you need the keyEncipherment KU, you can include it in your certificate request when ordering through the Atlas APIs↗. 

If you would like this key usage to be included on all of your certificates, including those requested through the Atlas portal, please reach out to your account representative. They can help you get this set up for your account. 

Need more help? 

If you’re unsure whether your environment requires this key usage, or you have questions about which option is right for you, our support team↗ and your account representative are happy to help.