Custom key usage extensions

[KLuuKer]

Is your feature request related to a problem? Please describe.
i cannot enable encryption strict TLS1.3 for sql server on my containers due to missing OID

Describe the solution you'd like
Support for custom key usages like Server Authentication (1.3.6.1.5.5.7.3.1)

Describe alternatives you've considered
rolling my own certificate authority

Additional context
I wouldn't even mind having to set a this is dangerous bool that we need to toggle before it works

#5494
#3540
#3404
#1282

/kind feature

[cert-manager-bot]

Issues go stale after 6 months of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues remain open for an additional 3 months of inactivity and then close.
If this issue is safe to close now please do so with /close.
/lifecycle stale

[jalder]

Supporting the embedding of custom extensions (for example, an OID for authorization in EKUs) would add a lot of value to cert-manager integration in mTLS environments.

/remove-lifecycle stale

[SgtCoDFish]

Hey, thanks for raising this - sorry it's taken a while to get a response!

I'm not sure if I understand the ask specifically for Server Authentication - cert-manager does support this, and that's not a custom OID as far as I know?

See "server auth" for keyUsage on Certificate resources: https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.KeyUsage

More broadly, cert-manager relies heavily on the stdlib crypto/x509 package, and we can pretty easily support anything exposed in the Certificate struct. Custom key usages don't seem to be in there, so this would be a huge feature. We'd need a really compelling reason to do this.

[KLuuKer]

i think they were using a slightly different OID before?
it's been a while since i last verified this

but all the other issues have people complaining about
1.3.6.1.4.1.44924.1.6, required by the Open Connectivity Foundation specification.

[jalder]

Agreed. Personally, I'm looking for 1.3.6.1.4.1.34601.2.1.1 and 1.3.6.1.4.1.34601.2.1.2 for MongoDB EKU purposes.