Signing a CSR fails with extended key usage set to critical

Question

I have the following Root CA certificate:

• basic constraints: critical,ca:true
• key usage: keycertsign,crlsign

I'm trying to set the extended key usage to critical

Unfortunately, I can only sign the CSR with the value mentioned above not set.

I do have 2 questions:

• Is my current configuration correct considering what I'm trying to achieve? I assume it is since the keycertsign value is indeed in the list of the key usage.
• Does the RSA key pair used to generate the Root CA certificate need to have a specific configuration? The RSA key pair currently only have sign/verify operations

Thanks you very much in advance guys.