Fix extension formating

certs/extensions.go

@@ -49,8 +49,8 @@ func KeyUsageString(keyUsage x509.KeyUsage) string {
 	var keyUsageFlags x509.KeyUsage
 	var builder strings.Builder
 	for _, keyUsageFlag := range keyUsages {
-		keyUsageFlags |= keyUsageFlag
 		if (keyUsage & keyUsageFlag) == keyUsageFlag {
+			keyUsageFlags |= keyUsageFlag
 			if builder.Len() > 0 {
 				builder.WriteString(", ")
 			}
@@ -133,12 +133,12 @@ const BasicConstraintsExtensionOID = "2.5.29.19"
 
 func BasicConstraintsString(isCA bool, maxPathLen int, maxPathLenZero bool) string {
 	if !isCA {
-		return "CA = false"
+		return "CA: no"
 	}
 	if maxPathLen < 0 || (maxPathLen == 0 && !maxPathLenZero) {
-		return "CA = true"
+		return "CA: yes"
 	}
-	return fmt.Sprintf("CA = true, pathLenConstraint = %d", maxPathLen)
+	return fmt.Sprintf("CA: yes, pathLenConstraint: %d", maxPathLen)
 }
 
 const SubjectKeyIdentifierExtensionName = "SubjectKeyIdentifier"

certs/extensions_test.go

@@ -16,6 +16,7 @@ import (
 
 func TestKeyUsageString(t *testing.T) {
 	require.Equal(t, "-", certs.KeyUsageString(0))
+	require.Equal(t, "keyCertSign", certs.KeyUsageString(x509.KeyUsageCertSign))
 	require.Equal(t, "digitalSignature, contentCommitment, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly, decipherOnly, 0xfe00", certs.KeyUsageString(0xffff))
 }
 
@@ -24,9 +25,9 @@ func TestExtKeyUsageString(t *testing.T) {
 	require.Equal(t, "any, 1.2.3.4", certs.ExtKeyUsageString([]x509.ExtKeyUsage{x509.ExtKeyUsageAny}, []asn1.ObjectIdentifier{asn1.ObjectIdentifier([]int{1, 2, 3, 4})}))
 }
 
-const basicConstraintsNoCA = "CA = false"
-const basicConstratinsCAWithoutPathLenConstraint = "CA = true"
-const basicConstratinsCAWithPathLenConstraint = "CA = true, pathLenConstraint = 2"
+const basicConstraintsNoCA = "CA: no"
+const basicConstratinsCAWithoutPathLenConstraint = "CA: yes"
+const basicConstratinsCAWithPathLenConstraint = "CA: yes, pathLenConstraint: 2"
 
 func TestBasicConstraintsString(t *testing.T) {
 	require.Equal(t, basicConstraintsNoCA, certs.BasicConstraintsString(false, 0, false))