Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION, Admin Manual

Page: 80 / 564

Chapter 2. Making Rules for Issuing Certificates
58
The possible values for the constraint are listed in
Section B.2.9, “Signing Algorithm Constraint”
.
2.6. Managing CA-Related Profiles
Certificate profiles and extensions must be used to set rules on how subordinate CAs can issue
certificates. There are two parts to this:
• Managing the CA signing certificate
• Defining issuance rules
2.6.1. Setting Restrictions on CA Certificates
When a subordinate CA is created, the root CA can impose limits or restrictions on the subordinate
CA. For example, the root CA can dictate the maximum depth of valid certification paths (the number
of subordinate CAs allowed to be chained below the new CA) by setting the pathLenConstraint field of
the Basic Constraints extension in the CA signing certificate.
A certificate chain generally consists of an entity certificate, zero or more intermediate CA certificates,
and a root CA certificate. The root CA certificate is either self-signed or signed by an external trusted
CA. Once issued, the root CA certificate is loaded into a certificate database as a trusted CA.
An exchange of certificates takes place when performing an SSL handshake, when sending an S/
MIME message, or when sending a signed object. As part of the handshake, the sender is expected to
send the subject certificate and any intermediate CA certificates needed to link the subject certificate
to the trusted root. For certificate chaining to work properly the certificates should have the following
properties:
• CA certificates must have the Basic Constraints extension.
• CA certificates must have the keyCertSign bit set in the Key Usage extension.
• When the CAs generate new keys, they must add the Authority Key Identifier extension to all subject
certificates. This extensions helps distinguish the certificates from the older CA certificates. The CA
certificates must contain the Subject Key Identifier extension.
For more information on certificates and their extensions, see
Internet X.509 Public Key Infrastructure
- Certificate and Certificate Revocation List (CRL) Profile (RFC 3280)
, available at
RFC 3280
1
.
These extensions can be configured through the certificate profile enrollment pages. By default, the
CA contains the required and reasonable configuration settings, but it is possible to customize these
settings.
NOTE
This procedure describes editing the CA certificate profile used by a CA to issue CA
certificates to its subordinate CAs.
The profile that is used when a CA instance is first configured is
/var/
lib/ subsystem_name /profiles/ca/caCert.profile
. This profile cannot be
1
http://www.ietf.org/rfc/rfc3280.txt