Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 293 / 554

Chapter 13.
271
Certificate Profiles
The Certificate System provides a customizable framework to apply policies for incoming certificate
requests and to control the input request types and output certificate types; these are called
certificate
profiles
. Certificate profiles set the required information for certificate enrollment forms in the
Certificate Manager end-entities page. This chapter describes how to configure certificate profiles.
13.1. About Certificate Profiles
A certificate profile defines everything associated with issuing a particular type of certificate, including
the authentication method, the certificate content (defaults), constraints for the values of the content,
and the contents of the input and output for the certificate profile. Enrollment requests are submitted
to a certificate profile and are then subject to the defaults and constraints set in that certificate profile.
These constraints are in place whether the request is submitted through the input form associated with
the certificate profile or through other means. The certificate that is issued from a certificate profile
request contains the content required by the defaults with the information required by the default
parameters. The constraints provide rules for what content is allowed in the certificate.
For example, a certificate profile for user certificates defines all aspects of that certificate, including the
validity period of the certificate. The default validity period can be set to two years, and a constraint
can be set on the profile that the validity period for certificates requested through this certificate profile
cannot exceed two years. When a user requests a certificate using the input form associated with this
certificate profile, the issued certificate contains the information specified in the defaults and will be
valid for two years. If the user submits a preformatted request for a certificate with a validity period of
four years, the request is rejected since the constraints allow a maximum of two years validity period
for this type of certificate.
A set of certificate profiles have been predefined for the most common certificates issued. These
certificate profiles define defaults and constraints, associate the authentication method, and define the
needed inputs and outputs for the certificate profile.
The parameters of the default certificate profiles � the authentication method, the defaults, the
constraints used in each profile, the values assigned to any of the parameters in a profile, the input,
and the output � can be modified. It is also possible to create new certificate profiles for other types of
certificates or for creating more than one certificate profile for a certificate type. There can be multiple
certificate profiles for a particular type of certificate to issue the same type of certificate with a different
authentication method or different definitions for the defaults and constraints. For example, there can
be two certificate profiles for enrollment of SSL server certificates where one certificate profile issues
certificates with a validity period of six months and another certificate profile issues certificates with a
validity period of two years.
An input sets a text field in the enrollment form and what kind of information needs gathered from
the end entity; this includes setting the text area for a certificate request to be pasted, which allows
a request to be created outside the input form with any of the request information desired. The input
values are set as values in the certificate.
An output specifies how the response page to a successful enrollment is presented. It usually displays
the certificate in a user-readable format. The default output shows a printable version of the resultant
certificate; other outputs set the type of information generated at the end of the enrollment, such as
PKCS #7.
Policy sets are sets of constraints and default extensions attached to every certificate processed
through the profile. The extensions define certificate content such as validity periods and subject name