Skip to content

RDoc-3427 Support Server Certificates with Server Auth EKU only - update docs #2137

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Oct 1, 2025
Merged

RDoc-3427 Support Server Certificates with Server Auth EKU only - update docs #2137

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9a49e4f
RDoc-3427 Adjust the documentation about server certificates - 2EKU -…
poissoncorp Sep 29, 2025
b3879da
RavenDB-3427 Propagate changes to different versions (5.4-7.0)
poissoncorp Sep 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file modified docs/server/security/authentication/assets/cert-enhanced-key-usage.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file modified docs/server/security/authentication/assets/cert-key-usage.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file removed docs/server/security/authentication/assets/export_cluster_certificates.png
View file
Open in desktop
Binary file not shown.
Binary file removed docs/server/security/authentication/assets/renew_server_certificate.png
View file
Open in desktop
Binary file not shown.
Binary file removed docs/server/security/authentication/assets/upload-client-certificate.png
View file
Open in desktop
Binary file not shown.
7 changes: 3 additions & 4 deletions docs/server/security/authentication/certificate-configuration.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,16 +59,15 @@ RavenDB will accept `.pfx` server certificates that contain the private key, are
and include a basic (`Key Usage`) field and an enhanced (`Enhanced Key Usage`) field.

- `Key Usage`
Permissions granted by this field: **Digital Signature**, **Key Encipherment**
Permissions granted by this field: **Digital Signature**

![Key Usage](./assets/cert-key-usage.png)

- `Enhanced Key Usage`
Permissions granted by this field: **Server Authentication**, **Client Authentication**
Permissions granted by this field: **Server Authentication**

An `Enhanced Key Usage` field must include these two OIDs:
An `Enhanced Key Usage` field must include this OID:
**1.3.6.1.5.5.7.3.1** - Server Authentication
**1.3.6.1.5.5.7.3.2** - Client Authentication

![Enhanced Key Usage](./assets/cert-enhanced-key-usage.png)

Expand Down
4 changes: 0 additions & 4 deletions docs/server/security/authorization/security-clearance-and-permissions.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,10 +36,6 @@ import LanguageContent from "@site/src/components/LanguageContent";

`Cluster Admin` is the highest security clearance. There are no restrictions. A `Cluster Admin` certificate has admin permissions to all databases. It also has the ability to modify the cluster itself.

<Admonition type="note" title="">
The server certificate security clearance is called `Cluster Node`. The server certificate can also be used as a client certificate, and in that case `Cluster Node` is equivalent to `Cluster Admin` in terms of permissions.
</Admonition>

The following operations are allowed **only** for `Cluster Admin` certificates:

- All cluster operations
Expand Down
2 changes: 1 addition & 1 deletion docs/server/security/common-errors-and-faq.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -267,7 +267,7 @@ This server requires client certificate for authentication, but none was provide
See [trusting an existing certificate](../../server/administration/cli.mdx#trustclientcert).
#### If your browser runs under Windows 7 or Windows Server 2008 or older:

The first thing to try would be installing the **SERVER** certificate to the OS
The first thing to try would be installing the **ADMIN** certificate to the OS
where your server is running, closing **all instances** of the browser and restarting it.

If the issue persists, please also visit the
Expand Down
4 changes: 2 additions & 2 deletions docs/start/installation/setup-examples/kubernetes/azure-aks.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,8 +49,8 @@ There are many tools available online that automate the process of getting the c

RavenDB will accept PFX server certificates which contain the private key, are not expired, and have the following fields:

- KeyUsage: DigitalSignature, KeyEncipherment
- ExtendedKeyUsage: Client Authentication, Server Authentication
- KeyUsage: DigitalSignature
- ExtendedKeyUsage: Server Authentication

If you wish to use a self-signed certificate, you must register the CA certificate in the OS. A Docker image can be created based on the RavenDB image:

Expand Down
8 changes: 4 additions & 4 deletions docs/start/installation/setup-wizard.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -403,8 +403,8 @@ stores on all the relevant machines.

RavenDB will accept PFX server certificates which contain the private key, are not expired, and have the following fields:

- KeyUsage: DigitalSignature, KeyEncipherment
- ExtendedKeyUsage: Client Authentication, Server Authentication
- KeyUsage: DigitalSignature
- ExtendedKeyUsage: Server Authentication

If you wish to use the setup wizard to construct a cluster, you must use the same certificate for all nodes. If you wish to use
a different certificate for each node, it's possible only through [manual setup](../../start/installation/manual.mdx). A wildcard
Expand Down Expand Up @@ -512,8 +512,8 @@ If you are setting up a cluster, you will use this Zip file to set up each of yo

RavenDB will accept `.pfx` server certificates which contain the private key, are not expired, and have the following fields:

**KeyUsage**: DigitalSignature, KeyEncipherment
**ExtendedKeyUsage**: Client Authentication, Server Authentication
**KeyUsage**: DigitalSignature
**ExtendedKeyUsage**: Server Authentication


1. Place the `.pfx` file in a permanent location in each server/node folder.
Expand Down
Binary file modified ...s/version-5.4/server/security/authentication/assets/cert-enhanced-key-usage.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file modified ...ioned_docs/version-5.4/server/security/authentication/assets/cert-key-usage.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file removed ...rsion-5.4/server/security/authentication/assets/export_cluster_certificates.png
View file
Open in desktop
Binary file not shown.
Binary file removed .../version-5.4/server/security/authentication/assets/renew_server_certificate.png
View file
Open in desktop
Binary file not shown.
Binary file removed ...version-5.4/server/security/authentication/assets/upload-client-certificate.png
View file
Open in desktop
Binary file not shown.
8 changes: 4 additions & 4 deletions ...d_docs/version-5.4/server/security/authentication/certificate-configuration.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,16 +59,15 @@ RavenDB will accept `.pfx` server certificates that contain the private key, are
and include a basic (`Key Usage`) field and an enhanced (`Enhanced Key Usage`) field.

- `Key Usage`
Permissions granted by this field: **Digital Signature**, **Key Encipherment**
Permissions granted by this field: **Digital Signature**

![Key Usage](./assets/cert-key-usage.png)

- `Enhanced Key Usage`
Permissions granted by this field: **Server Authentication**, **Client Authentication**
Permissions granted by this field: **Server Authentication**

An `Enhanced Key Usage` field must include these two OIDs:
An `Enhanced Key Usage` field must include this OID:
**1.3.6.1.5.5.7.3.1** - Server Authentication
**1.3.6.1.5.5.7.3.2** - Client Authentication

![Enhanced Key Usage](./assets/cert-enhanced-key-usage.png)

Expand Down Expand Up @@ -258,3 +257,4 @@ In all secure configurations, the `ServerUrl` must contain the same domain name




4 changes: 0 additions & 4 deletions ...ersion-5.4/server/security/authorization/security-clearance-and-permissions.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,10 +36,6 @@ import LanguageContent from "@site/src/components/LanguageContent";

`Cluster Admin` is the highest security clearance. There are no restrictions. A `Cluster Admin` certificate has admin permissions to all databases. It also has the ability to modify the cluster itself.

<Admonition type="note" title="">
The server certificate security clearance is called `Cluster Node`. The server certificate can also be used as a client certificate, and in that case `Cluster Node` is equivalent to `Cluster Admin` in terms of permissions.
</Admonition>

The following operations are allowed **only** for `Cluster Admin` certificates:

- All cluster operations
Expand Down
2 changes: 1 addition & 1 deletion versioned_docs/version-5.4/server/security/common-errors-and-faq.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -267,7 +267,7 @@ This server requires client certificate for authentication, but none was provide
See [trusting an existing certificate](../../server/administration/cli.mdx#trustclientcert).
#### If your browser runs under Windows 7 or Windows Server 2008 or older:

The first thing to try would be installing the **SERVER** certificate to the OS
The first thing to try would be installing the **ADMIN** certificate to the OS
where your server is running, closing **all instances** of the browser and restarting it.

If the issue persists, please also visit the
Expand Down
4 changes: 2 additions & 2 deletions ...ned_docs/version-5.4/start/installation/setup-examples/kubernetes/azure-aks.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,8 +49,8 @@ There are many tools available online that automate the process of getting the c

RavenDB will accept PFX server certificates which contain the private key, are not expired, and have the following fields:

- KeyUsage: DigitalSignature, KeyEncipherment
- ExtendedKeyUsage: Client Authentication, Server Authentication
- KeyUsage: DigitalSignature
- ExtendedKeyUsage: Server Authentication

If you wish to use a self-signed certificate, you must register the CA certificate in the OS. A Docker image can be created based on the RavenDB image:

Expand Down
8 changes: 4 additions & 4 deletions versioned_docs/version-5.4/start/installation/setup-wizard.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -403,8 +403,8 @@ stores on all the relevant machines.

RavenDB will accept PFX server certificates which contain the private key, are not expired, and have the following fields:

- KeyUsage: DigitalSignature, KeyEncipherment
- ExtendedKeyUsage: Client Authentication, Server Authentication
- KeyUsage: DigitalSignature
- ExtendedKeyUsage: Server Authentication

If you wish to use the setup wizard to construct a cluster, you must use the same certificate for all nodes. If you wish to use
a different certificate for each node, it's possible only through [manual setup](../../start/installation/manual.mdx). A wildcard
Expand Down Expand Up @@ -512,8 +512,8 @@ If you are setting up a cluster, you will use this Zip file to set up each of yo

RavenDB will accept `.pfx` server certificates which contain the private key, are not expired, and have the following fields:

**KeyUsage**: DigitalSignature, KeyEncipherment
**ExtendedKeyUsage**: Client Authentication, Server Authentication
**KeyUsage**: DigitalSignature
**ExtendedKeyUsage**: Server Authentication


1. Place the `.pfx` file in a permanent location in each server/node folder.
Expand Down
Binary file modified ...s/version-6.0/server/security/authentication/assets/cert-enhanced-key-usage.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file modified ...ioned_docs/version-6.0/server/security/authentication/assets/cert-key-usage.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file removed ...rsion-6.0/server/security/authentication/assets/export_cluster_certificates.png
View file
Open in desktop
Binary file not shown.
Binary file removed .../version-6.0/server/security/authentication/assets/renew_server_certificate.png
View file
Open in desktop
Binary file not shown.
Binary file removed ...version-6.0/server/security/authentication/assets/upload-client-certificate.png
View file
Open in desktop
Binary file not shown.
17 changes: 8 additions & 9 deletions ...d_docs/version-6.0/server/security/authentication/certificate-configuration.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,17 +58,16 @@ See [Certificate Management](../../../server/security/authentication/certificate
RavenDB will accept `.pfx` server certificates that contain the private key, are not expired,
and include a basic (`Key Usage`) field and an enhanced (`Enhanced Key Usage`) field.

- `Key Usage`
Permissions granted by this field: **Digital Signature**, **Key Encipherment**
- `Key Usage`
Permissions granted by this field: **Digital Signature**

![Key Usage](./assets/cert-key-usage.png)

- `Enhanced Key Usage`
Permissions granted by this field: **Server Authentication**, **Client Authentication**

An `Enhanced Key Usage` field must include these two OIDs:
**1.3.6.1.5.5.7.3.1** - Server Authentication
**1.3.6.1.5.5.7.3.2** - Client Authentication
- `Enhanced Key Usage`
Permissions granted by this field: **Server Authentication**

An `Enhanced Key Usage` field must include this OID:
**1.3.6.1.5.5.7.3.1** - Server Authentication

![Enhanced Key Usage](./assets/cert-enhanced-key-usage.png)

Expand Down
4 changes: 0 additions & 4 deletions ...ersion-6.0/server/security/authorization/security-clearance-and-permissions.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,10 +36,6 @@ import LanguageContent from "@site/src/components/LanguageContent";

`Cluster Admin` is the highest security clearance. There are no restrictions. A `Cluster Admin` certificate has admin permissions to all databases. It also has the ability to modify the cluster itself.

<Admonition type="note" title="">
The server certificate security clearance is called `Cluster Node`. The server certificate can also be used as a client certificate, and in that case `Cluster Node` is equivalent to `Cluster Admin` in terms of permissions.
</Admonition>

The following operations are allowed **only** for `Cluster Admin` certificates:

- All cluster operations
Expand Down
2 changes: 1 addition & 1 deletion versioned_docs/version-6.0/server/security/common-errors-and-faq.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -267,7 +267,7 @@ This server requires client certificate for authentication, but none was provide
See [trusting an existing certificate](../../server/administration/cli.mdx#trustclientcert).
#### If your browser runs under Windows 7 or Windows Server 2008 or older:

The first thing to try would be installing the **SERVER** certificate to the OS
The first thing to try would be installing the **ADMIN** certificate to the OS
where your server is running, closing **all instances** of the browser and restarting it.

If the issue persists, please also visit the
Expand Down
4 changes: 2 additions & 2 deletions ...ned_docs/version-6.0/start/installation/setup-examples/kubernetes/azure-aks.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,8 +49,8 @@ There are many tools available online that automate the process of getting the c

RavenDB will accept PFX server certificates which contain the private key, are not expired, and have the following fields:

- KeyUsage: DigitalSignature, KeyEncipherment
- ExtendedKeyUsage: Client Authentication, Server Authentication
- KeyUsage: DigitalSignature
- ExtendedKeyUsage: Server Authentication

If you wish to use a self-signed certificate, you must register the CA certificate in the OS. A Docker image can be created based on the RavenDB image:

Expand Down
8 changes: 4 additions & 4 deletions versioned_docs/version-6.0/start/installation/setup-wizard.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -403,8 +403,8 @@ stores on all the relevant machines.

RavenDB will accept PFX server certificates which contain the private key, are not expired, and have the following fields:

- KeyUsage: DigitalSignature, KeyEncipherment
- ExtendedKeyUsage: Client Authentication, Server Authentication
- KeyUsage: DigitalSignature
- ExtendedKeyUsage: Server Authentication

If you wish to use the setup wizard to construct a cluster, you must use the same certificate for all nodes. If you wish to use
a different certificate for each node, it's possible only through [manual setup](../../start/installation/manual.mdx). A wildcard
Expand Down Expand Up @@ -512,8 +512,8 @@ If you are setting up a cluster, you will use this Zip file to set up each of yo

RavenDB will accept `.pfx` server certificates which contain the private key, are not expired, and have the following fields:

**KeyUsage**: DigitalSignature, KeyEncipherment
**ExtendedKeyUsage**: Client Authentication, Server Authentication
**KeyUsage**: DigitalSignature
**ExtendedKeyUsage**: Server Authentication


1. Place the `.pfx` file in a permanent location in each server/node folder.
Expand Down
Binary file modified ...s/version-6.2/server/security/authentication/assets/cert-enhanced-key-usage.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file modified ...ioned_docs/version-6.2/server/security/authentication/assets/cert-key-usage.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file removed ...rsion-6.2/server/security/authentication/assets/export_cluster_certificates.png
View file
Open in desktop
Binary file not shown.
Binary file removed .../version-6.2/server/security/authentication/assets/renew_server_certificate.png
View file
Open in desktop
Binary file not shown.
Binary file removed ...version-6.2/server/security/authentication/assets/upload-client-certificate.png
View file
Open in desktop
Binary file not shown.
17 changes: 8 additions & 9 deletions ...d_docs/version-6.2/server/security/authentication/certificate-configuration.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,17 +58,16 @@ See [Certificate Management](../../../server/security/authentication/certificate
RavenDB will accept `.pfx` server certificates that contain the private key, are not expired,
and include a basic (`Key Usage`) field and an enhanced (`Enhanced Key Usage`) field.

- `Key Usage`
Permissions granted by this field: **Digital Signature**, **Key Encipherment**
- `Key Usage`
Permissions granted by this field: **Digital Signature**

![Key Usage](./assets/cert-key-usage.png)

- `Enhanced Key Usage`
Permissions granted by this field: **Server Authentication**, **Client Authentication**

An `Enhanced Key Usage` field must include these two OIDs:
**1.3.6.1.5.5.7.3.1** - Server Authentication
**1.3.6.1.5.5.7.3.2** - Client Authentication
- `Enhanced Key Usage`
Permissions granted by this field: **Server Authentication**

An `Enhanced Key Usage` field must include this OID:
**1.3.6.1.5.5.7.3.1** - Server Authentication

![Enhanced Key Usage](./assets/cert-enhanced-key-usage.png)

Expand Down
4 changes: 0 additions & 4 deletions ...ersion-6.2/server/security/authorization/security-clearance-and-permissions.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,10 +36,6 @@ import LanguageContent from "@site/src/components/LanguageContent";

`Cluster Admin` is the highest security clearance. There are no restrictions. A `Cluster Admin` certificate has admin permissions to all databases. It also has the ability to modify the cluster itself.

<Admonition type="note" title="">
The server certificate security clearance is called `Cluster Node`. The server certificate can also be used as a client certificate, and in that case `Cluster Node` is equivalent to `Cluster Admin` in terms of permissions.
</Admonition>

The following operations are allowed **only** for `Cluster Admin` certificates:

- All cluster operations
Expand Down
2 changes: 1 addition & 1 deletion versioned_docs/version-6.2/server/security/common-errors-and-faq.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -267,7 +267,7 @@ This server requires client certificate for authentication, but none was provide
See [trusting an existing certificate](../../server/administration/cli.mdx#trustclientcert).
#### If your browser runs under Windows 7 or Windows Server 2008 or older:

The first thing to try would be installing the **SERVER** certificate to the OS
The first thing to try would be installing the **ADMIN** certificate to the OS
where your server is running, closing **all instances** of the browser and restarting it.

If the issue persists, please also visit the
Expand Down
4 changes: 2 additions & 2 deletions ...ned_docs/version-6.2/start/installation/setup-examples/kubernetes/azure-aks.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,8 +49,8 @@ There are many tools available online that automate the process of getting the c

RavenDB will accept PFX server certificates which contain the private key, are not expired, and have the following fields:

- KeyUsage: DigitalSignature, KeyEncipherment
- ExtendedKeyUsage: Client Authentication, Server Authentication
- KeyUsage: DigitalSignature
- ExtendedKeyUsage: Server Authentication

If you wish to use a self-signed certificate, you must register the CA certificate in the OS. A Docker image can be created based on the RavenDB image:

Expand Down
8 changes: 4 additions & 4 deletions versioned_docs/version-6.2/start/installation/setup-wizard.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -403,8 +403,8 @@ stores on all the relevant machines.

RavenDB will accept PFX server certificates which contain the private key, are not expired, and have the following fields:

- KeyUsage: DigitalSignature, KeyEncipherment
- ExtendedKeyUsage: Client Authentication, Server Authentication
- KeyUsage: DigitalSignature
- ExtendedKeyUsage: Server Authentication

If you wish to use the setup wizard to construct a cluster, you must use the same certificate for all nodes. If you wish to use
a different certificate for each node, it's possible only through [manual setup](../../start/installation/manual.mdx). A wildcard
Expand Down Expand Up @@ -512,8 +512,8 @@ If you are setting up a cluster, you will use this Zip file to set up each of yo

RavenDB will accept `.pfx` server certificates which contain the private key, are not expired, and have the following fields:

**KeyUsage**: DigitalSignature, KeyEncipherment
**ExtendedKeyUsage**: Client Authentication, Server Authentication
**KeyUsage**: DigitalSignature
**ExtendedKeyUsage**: Server Authentication


1. Place the `.pfx` file in a permanent location in each server/node folder.
Expand Down
Binary file modified ...s/version-7.0/server/security/authentication/assets/cert-enhanced-key-usage.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file modified ...ioned_docs/version-7.0/server/security/authentication/assets/cert-key-usage.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file removed ...rsion-7.0/server/security/authentication/assets/export_cluster_certificates.png
View file
Open in desktop
Binary file not shown.
Binary file removed .../version-7.0/server/security/authentication/assets/renew_server_certificate.png
View file
Open in desktop
Binary file not shown.
Binary file removed ...version-7.0/server/security/authentication/assets/upload-client-certificate.png
View file
Open in desktop
Binary file not shown.
17 changes: 8 additions & 9 deletions ...d_docs/version-7.0/server/security/authentication/certificate-configuration.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,17 +58,16 @@ See [Certificate Management](../../../server/security/authentication/certificate
RavenDB will accept `.pfx` server certificates that contain the private key, are not expired,
and include a basic (`Key Usage`) field and an enhanced (`Enhanced Key Usage`) field.

- `Key Usage`
Permissions granted by this field: **Digital Signature**, **Key Encipherment**
- `Key Usage`
Permissions granted by this field: **Digital Signature**

![Key Usage](./assets/cert-key-usage.png)

- `Enhanced Key Usage`
Permissions granted by this field: **Server Authentication**, **Client Authentication**

An `Enhanced Key Usage` field must include these two OIDs:
**1.3.6.1.5.5.7.3.1** - Server Authentication
**1.3.6.1.5.5.7.3.2** - Client Authentication
- `Enhanced Key Usage`
Permissions granted by this field: **Server Authentication**

An `Enhanced Key Usage` field must include this OID:
**1.3.6.1.5.5.7.3.1** - Server Authentication

![Enhanced Key Usage](./assets/cert-enhanced-key-usage.png)

Expand Down
4 changes: 0 additions & 4 deletions ...ersion-7.0/server/security/authorization/security-clearance-and-permissions.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,10 +36,6 @@ import LanguageContent from "@site/src/components/LanguageContent";

`Cluster Admin` is the highest security clearance. There are no restrictions. A `Cluster Admin` certificate has admin permissions to all databases. It also has the ability to modify the cluster itself.

<Admonition type="note" title="">
The server certificate security clearance is called `Cluster Node`. The server certificate can also be used as a client certificate, and in that case `Cluster Node` is equivalent to `Cluster Admin` in terms of permissions.
</Admonition>

The following operations are allowed **only** for `Cluster Admin` certificates:

- All cluster operations
Expand Down
2 changes: 1 addition & 1 deletion versioned_docs/version-7.0/server/security/common-errors-and-faq.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -267,7 +267,7 @@ This server requires client certificate for authentication, but none was provide
See [trusting an existing certificate](../../server/administration/cli.mdx#trustclientcert).
#### If your browser runs under Windows 7 or Windows Server 2008 or older:

The first thing to try would be installing the **SERVER** certificate to the OS
The first thing to try would be installing the **ADMIN** certificate to the OS
where your server is running, closing **all instances** of the browser and restarting it.

If the issue persists, please also visit the
Expand Down
4 changes: 2 additions & 2 deletions ...ned_docs/version-7.0/start/installation/setup-examples/kubernetes/azure-aks.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,8 +49,8 @@ There are many tools available online that automate the process of getting the c

RavenDB will accept PFX server certificates which contain the private key, are not expired, and have the following fields:

- KeyUsage: DigitalSignature, KeyEncipherment
- ExtendedKeyUsage: Client Authentication, Server Authentication
- KeyUsage: DigitalSignature
- ExtendedKeyUsage: Server Authentication

If you wish to use a self-signed certificate, you must register the CA certificate in the OS. A Docker image can be created based on the RavenDB image:

Expand Down
8 changes: 4 additions & 4 deletions versioned_docs/version-7.0/start/installation/setup-wizard.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -403,8 +403,8 @@ stores on all the relevant machines.

RavenDB will accept PFX server certificates which contain the private key, are not expired, and have the following fields:

- KeyUsage: DigitalSignature, KeyEncipherment
- ExtendedKeyUsage: Client Authentication, Server Authentication
- KeyUsage: DigitalSignature
- ExtendedKeyUsage: Server Authentication

If you wish to use the setup wizard to construct a cluster, you must use the same certificate for all nodes. If you wish to use
a different certificate for each node, it's possible only through [manual setup](../../start/installation/manual.mdx). A wildcard
Expand Down Expand Up @@ -512,8 +512,8 @@ If you are setting up a cluster, you will use this Zip file to set up each of yo

RavenDB will accept `.pfx` server certificates which contain the private key, are not expired, and have the following fields:

**KeyUsage**: DigitalSignature, KeyEncipherment
**ExtendedKeyUsage**: Client Authentication, Server Authentication
**KeyUsage**: DigitalSignature
**ExtendedKeyUsage**: Server Authentication


1. Place the `.pfx` file in a permanent location in each server/node folder.
Expand Down
Loading