Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE, Administration Manual

Page: 135 / 512

Setting Restrictions on CA Certificates through Certificate Extensions
115
to the trusted root. For certificate chaining to work properly the certificates should have the following
properties:
• CA certificates must have either the Basic Constraints extension, a Key Usage or Extended Key
Usage extension set to issue SSL or email certificates, or both.
• If CAs issue multiple certificates for the same identity, for example for separate signing and
encryption keys, they must include the Key Usage extension in the subject certificates.
• If CAs will ever generate new keys, they must add the Authority Key Identifier extension to all
subject certificates. If the
key ID
is anything other than the SHA-1 hash of the CA certificates
subjectPublicKeyInfo
field, then the CA certificate should contain the Subject Key Identifier
extension. This will allow for a smooth transition when the new issuing certificate becomes active.
These extensions can be configured through the certificate profile enrollment pages. To set the default
in the CA signing certificate profile, do the following:
1. If the profile is currently enabled, it must be disabled before it can be edited. Open the agent
services page, select
Manage Certificate Profiles
from the left navigation menu, select the
profile, and click
Disable profile
.
2. Open the CA Console.
pkiconsole https://server.example.com:9443/ca
3. In the left navigation tree of the
Configuration
tab, select
Certificate Manager
, then
Certificate
Profiles
.
4. Select caCACert, or the appropriate CA signing certificate profile, from the right window, and click
Edit/View
.
5. In the
Policies
tab of the
Certificate Profile Rule Editor
, select and edit the Key Usage or
Extended Key Usage Extension Default if it exists or add it to the profile.
6. Select the Key Usage or Extended Key Usage Extension Constraint, as appropriate, for the
default.
7. Set the default values for the CA certificates. For the Key Usage extension, here are several
settings for a CA signing certificate:
digitalSignature
and
nonRepudiation
, which allows a
CA to issue server certificates and email certificates;
cRLSign
, which allows a CA to sign CRLS;
and then several options for encrypting data. For the Extended Key Usage extension, there are
several OIDs which can be set for email, server authentication, or client authentication. For more
information, see
Section 12.7.8, “Key Usage Extension Default”
and
Section 12.7.5, “Extended
Key Usage Extension Default”
.
8. Set the constraint values for the CA certificates. There are no constraints to be set for a Key
Usage extension; for an Extended Key Usage extension, set the appropriate OID constraints for
the CA. For more information, see
Section 12.7.5, “Extended Key Usage Extension Default”
.
9. When the changes have been made to the profile, log into the agent services page again, and re-
enable the certificate profile.