How to add keyUsage to certificate signing request in Golang

I need to create a PEM-encoded Certificate Signing Request (CSR) that specifies keyUsage certSign in a Golang application.

In Golang, function x509.CreateCertificateRequest helps with this, and it takes an x509.CertificateRequest input parameter. Type CertificateRequest does not have a KeyUsage attribute, so I assume I must use its Extensions attribute to embed a KeyUsage in that CSR. That Extensions attribute is of type []pkix.Extension and the pkix Go package does not really have much to help me build a KeyUsage extension.

KeyUsage is documented in RFC5280 section 4.2.1.3 as a BIT STRING with OBJECT IDENTIFIER id-ce 15. Would the following be the right way to create that KeyUsage? Is there no easier way that leverages the pkix or x509 Go packages and avoids doing my own bit serialization? Is my bit serialization even in compliance with that RFC, how can I test this?

asn1KeyUsage, err := asn1.Marshal(asn1.BitString{
		Bytes:     []byte{byte(x509.KeyUsageCertSign)},
		BitLength: 8,
	})
if err != nil { ... }

csrTemplate := x509.CertificateRequest{
		SignatureAlgorithm: ...,
		PublicKeyAlgorithm: ...,
		PublicKey:          ...,
		Subject:            ...,
		ExtraExtensions: []pkix.Extension{
			{
				Id:       asn1.ObjectIdentifier([]int{2, 5, 29, 15}),
				Critical: true,
				Value:    asn1KeyUsage,
			},
		},
}
    
asn1, err = x509.CreateCertificateRequest(
		rand.Reader,
		csrTemplate,
		privateKey,
	)
   
// Convert asn1 to PEM below

I'm also not find a nice short way of adding KeyUsage to my CSRs. I looked into golang's code and found this.

I finally ended up extracting following piece of code:

func marshalKeyUsage(ku x509.KeyUsage) (pkix.Extension, error) {
	ext := pkix.Extension{Id: asn1.ObjectIdentifier{2, 5, 29, 15}, Critical: true}

	var a [2]byte
	a[0] = reverseBitsInAByte(byte(ku))
	a[1] = reverseBitsInAByte(byte(ku >> 8))

	l := 1
	if a[1] != 0 {
		l = 2
	}

	bitString := a[:l]
	var err error
	ext.Value, err = asn1.Marshal(asn1.BitString{Bytes: bitString, BitLength: asn1BitLength(bitString)})
	if err != nil {
		return ext, err
	}
	return ext, nil
}

func reverseBitsInAByte(in byte) byte {
	b1 := in>>4 | in<<4
	b2 := b1>>2&0x33 | b1<<2&0xcc
	b3 := b2>>1&0x55 | b2<<1&0xaa
	return b3
}

func asn1BitLength(bitString []byte) int {
	bitLen := len(bitString) * 8

	for i := range bitString {
		b := bitString[len(bitString)-i-1]

		for bit := uint(0); bit < 8; bit++ {
			if (b>>bit)&1 == 1 {
				return bitLen
			}
			bitLen--
		}
	}

	return 0
}

You can use this as:

keyUsage := x509.KeyUsage(x509.KeyUsageDigitalSignature)
extKeyUsage, err := marshalKeyUsage(keyUsage)
if err != nil {
    log.Fatal(err)
}

// add this extension to csr like below

template.ExtraExtensions = []pkix.Extension{extKeyUsage}