Self-signed certificates requested through CSR contain both server- and client usage

[marc1404]

Context & Description

When creating a self-signed Certificate using a certificate signing request (CSR), the key usage is set to the default:

cert-management/pkg/shared/legobridge/pki.go

Line 251 in 319450d

ExtKeyUsage: DefaultCertExtKeyUsage,

The default is both server- and client usage:

cert-management/pkg/shared/legobridge/pki.go

Lines 31 to 35 in 319450d

	// DefaultCertExtKeyUsage are the default Extended KeyUsage (letsencrypt default).
	var DefaultCertExtKeyUsage []x509.ExtKeyUsage = []x509.ExtKeyUsage{
	x509.ExtKeyUsageClientAuth,
	x509.ExtKeyUsageServerAuth,
	}

Strictly speaking, this default is also not correct anymore, as Let's Encrypt is moving to issuing certificates only with server usage:
https://letsencrypt.org/2025/05/14/ending-tls-client-authentication

However, when a self-signed Certificate is created without a CSR, it will only have server usage:

cert-management/pkg/shared/legobridge/pki.go

Line 288 in 319450d

ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},

In short, there's an inconsistency in the key usage of self-signed Certificates depending on whether a CSR is used.

Tasks

• Remove client usage from self-signed Certificates created through a CSR.
• Review the default key usage and align with Let's Encrypt (can also be moved to a separate issue) [see also: ref].

Additional Information

Removing the client auth key usage should be treated as a breaking change and described in the release notes accordingly.