What is the Key Usage Extension?
The Key Usage Extension (KUE) defines how a certificate can be used. You can use a key usage extension to limit which operations the public key in a certificate can perform. For example, you could create a certificate to sign emails, but not to encrypt them. The Extended Key Usage certificate (EKU) is similar to the KUE, but it defines a certificate in terms of “purpose” (for example, to sign OCSP responses, identify an SSL client, and so on). The EKU is newer and more extensible than the KUE, so it is often considered “the” usage-restriction mechanism. You can configure the Extended Key Usage extension later in this assistant.

You can use the following Key Usage Extensions:

Signature: Select this when the certificate’s public key is used with a digital signature mechanism to support security services other than certificate signing.

Non-repudiation: Select this when the certificate’s public key is used to verify digital signatures that are used to provide a non-repudiation service which protects against falsely denying some action. Non-repudiation ensures a party in a dispute cannot repudiate or refute the validity of a statement or contract. 

Key Encipherment: Select this when the certificate’s public key is used for encrypting a key for any purpose. Key encipherment is used for key transport and key wrapping (or key management).

Data Encipherment: Select this when the certificate’s public key is used for enciphering user data other than cryptographic keys.

Key Agreement: Select this when the certificate’s public key is used for key agreement. Key agreement protocol (also known as key exchange protocol) is used when two parties agree on a key to be used in a secret-key crypto system where keys can be shared freely and securely over any insecure medium. (For example, if Diffie-Hellman keys are used for key management, this extension is set.)

Certificate Signing: Select this when the certificate’s public key is used for verifying a signature on public key certificates. Certificates with this extension are Certificate Authority (CA) certificates.  If this extension is assigned to a certificate, the “Use this certificate as a Certificate Authority”  in the Basic Constraints Extension (BCE) must also be set. The BCE is shown later in this assistant.

CRL Signing: Select this when the certificate’s public key is used for verifying a signature on a Certificate Revocation List (CRL).

Encipher Only: Select this only when the Key Agreement is also set.  It indicates that the certificate’s public key can be used for enciphering data while performing key agreement.

Decipher Only:  Select this when the Key Agreement is also set. It indicates that the certificate’s public key can be used for deciphering data while performing key agreement.

What does “This extension is critical” mean?
This is also known as the “criticality indicator.” It is a flag that instructs software that uses the certificate whether it is safe to ignore the Key Usage Extension if it does not recognise it. A certificate will be rejected if the software does not recognise a “critical extension.”