Configuring Certificate Profiles - dogtagpki/pki GitHub Wiki
Certificate profile templates are stored in /usr/share/pki/ca/profiles/ca. During CA installation, the certificate profiles will be copied into /var/lib/pki/<instance>/ca/profiles/ca. The profiles can be configured during installation (see Two-Step Installation) or after installation.
For IPA, the profiles will be imported into the database as well.
To manage CA certificate profiles, use PKI CA Profile CLI to ensure the profiles are updated properly regardless of storage location.
See also Bootstrap Profiles.
To configure the certificate profile, edit the profile configuration file in /var/lib/pki/<instance>/ca/profiles/ca (not in /usr/share/pki/ca/profiles/ca):
desc=... visible=... enable=... enableBy=... auth.class_id=... name=... input.list=<list of inputs> input.<input>.class_id=... output.list=<list of outputs> output.<output>.class_id=... policyset.list=<list of policies> policyset.<policy>.list=<list of numbers> policyset.<policy>.<number>.constraint.class_id=... policyset.<policy>.<number>.constraint.name=... policyset.<policy>.<number>.constraint.params.<name>=... policyset.<policy>.<number>.default.class_id=... policyset.<policy>.<number>.default.name=... policyset.<policy>.<number>.default.params.<name>=...
To enable or disable a profile, set the enable to true to false:
enable=<true|false>
To show or hide a profile, set the visible to true to false:
visible=<true|false>
Profile authentication is configured using the auth.instance_id parameter. Supported authentications are:
-
No authentication (blank)
-
AgentCertAuth -
CMCAuth -
flatFileAuth -
PinDirEnrollment -
raCertAuth -
SSLclientCertAuth -
TokenAuth -
UserDirEnrollment
To add a SAN extension, add the following parameters:
policyset.<policy>.<number>.constraint.class_id=noConstraintImpl policyset.<policy>.<number>.constraint.name=No Constraint policyset.<policy>.<number>.constraint.subjAltNameExtCritical=false policyset.<policy>.<number>.default.class_id=userExtensionDefaultImpl policyset.<policy>.<number>.default.name=User Supplied Extension Default policyset.<policy>.<number>.default.params.userExtOID=2.5.29.17