Are you making an ApplicationInstanceCertificate or a user-authentication certificate? You mention “starting the server” so most likely ApplicationInstanceCertificate (though you mention ‘clientAuth’, but one would use ‘serverAuth’ for server so it is a bit confusing, or well the spec says it should also include ‘clientAuth’, but the ‘serverAuth’ is mandatory).

I’m going to assume ApplicationInstanceCertificate, as user-auth via certs is very rare.

In short, the certificate without the flags would be kinda useless. Note that you need more than those 2 for it to be a proper OPC UA ApplicationInstanceCertificate. Please see https://reference.opcfoundation.org/Core/Part6/v105/docs/6.2.2. “For RSA keys, the keyUsage shall include digitalSignature, nonRepudiation, keyEncipherment and dataEncipherment”. Then from https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.3

“The digitalSignature bit is asserted when the subject public key is used for verifying digital signatures …”
“The keyEncipherment bit is asserted when the subject public key is
used for enciphering private or secret keys, i.e., for key
transport. For example, this bit shall be set when an RSA public
key is to be used for encrypting a symmetric content-decryption
key or an asymmetric private key.”
For nonRepudiation see
https://stackoverflow.com/questions/3468127/x509-whats-the-difference-between-digital-signature-and-non-repudiation

and finally
“The dataEncipherment bit is asserted when the subject public key
is used for directly enciphering raw user data without the use of
an intermediate symmetric cipher.”

Without the flags, it would not be possible to do what OPC UA needs the cert for. It is used to sign and encrypt the OpenSecureChannel message exchange and forming a temporary symmetric key for the rest of the messages.

In general (at least OPC UA wise) the whole point of using CA-signed certs is that one doesn’t need to individually trust each applications certificate (that normally would be a self-signed one). You would typically have like one CA (cert) per factory floor (or equivalent), use that to sign all certs of clients and servers and then have them trust that CA.