How to Set or Remove the critical Flag on Key Usage or Extended Key Usage Extensions

Hi

I've the following function that I'm using to generate a CSR,

pub fn generate_csr(config: &CommonConfig) -> Result<model::CsrBundle> {
    let mut params: CertificateParams = CertificateParams::new(config.dns_array())?;
    params.is_ca = IsCa::NoCa;

    let mut dn = DistinguishedName::new();
	// dn information....
    params.distinguished_name = dn;

    let now = time::OffsetDateTime::now_utc();
    params.not_before = now;
    params.not_after = now + time::Duration::days(365);

    // key usage attributes
    params.key_usages = vec![
        KeyUsagePurpose::DigitalSignature,
        KeyUsagePurpose::KeyEncipherment,
        KeyUsagePurpose::KeyAgreement,
    ];
    params.extended_key_usages = vec![ExtendedKeyUsagePurpose::ServerAuth];

    // CSR creation and signing
    let key = generate_private_key();
    let csr = params.serialize_request(&key)?;

    Ok(model::CsrBundle { csr, key })
}

The resulting CSR contains:

        Attributes:
            Requested Extensions:
                X509v3 Key Usage: critical
                    Digital Signature, Key Encipherment, Key Agreement
                X509v3 Extended Key Usage:
                    TLS Web Server Authentication

However, I would like to configure the CSR so that:

• Key Usage is marked non-critical
• Extended Key Usage is marked critical

Is there a way to configure this in rcgen? I couldn’t find any options in CertificateParams to change the criticality of individual extensions.

Thanks in advance for any help!

Start with CertificateParams and the serialize_request path shown in the issue, then inspect how key_usages and extended_key_usages become requested X.509 extensions. Confirm the design can set each extension's criticality independently, and verify that generated CSRs mark Key Usage non-critical and Extended Key Usage critical.