User Supplied Key Default - Red Hat CERTIFICATE SYSTEM 7.2 - ADMINISTRATION Administration Manual

Chapter 12. Certificate Profiles
• If this extension is set on a profile with a corresponding OID (Extension Constraint), then any
certificate request processed through that profile must carry the specified extension or the request is
rejected.
A certificate request that contains the user-defined extensions must be submitted to the profile. The
certificate enrollment forms, however, do not have any input fields for users to add user-supplied
extensions. Submitting a certificate request without supplying the extension fails. An input for adding
the extension can be created for the profile using the CS SDK.
The following constraints can be defined with this default:
• Basic Constraints Extension Constraint; see
Constraint".
• Extended Key Usage Constraint; see
• Extension Constraint; see
• Key Constraints; see
• Netscape Certificate Type Extension Constraint; see
Extension Constraint".
• No Constraints; see
This example adds the User Supplied Extension Default to a profile with the Basic Constraints
Extension Constraint. The OID specified in the userExtOID parameter is for the Basic Constraints
Extension Constraint.
policyset.set1.p5.default.params.keyUsageNonRepudiation=true
policyset.set1.p6.constraint.class_id=basicConstraintsExtConstraintImpl
policyset.set1.p6.constraint.name=Basic Constraint Extension Constraint
policyset.set1.p6.constraint.params.basicConstraintsCritical=true
policyset.set1.p6.constraint.params.basicConstraintsIsCA=false
policyset.set1.p6.constraint.params.basicConstraintsMinPathLen=-1
policyset.set1.p6.constraint.params.basicConstraintsMaxPathLen=-1
policyset.set1.p6.default.class_id=userExtensionDefaultImpl
policyset.set1.p6.default.name=User Supplied Extension Default
policyset.set1.p6.default.userExtOID=2.5.29.19
Editing profiles is described in
Line".

12.7.23. User Supplied Key Default

This default attaches a user-supplied key into the certificate request. This is a required default. Keys
are part of the enrollment request.
The following constraints can be defined with this default:
• Key Constraint; see
• No Constraints; see
280
Section 12.8.2, "Extended Key Usage Extension
Section 12.8.3, "Extension
Section 12.8.4, "Key Constraint".
Section 12.8.6, "No Constraint".
Section 12.3.2, "Modifying Certificate Profiles through the Command
Section 12.8.4, "Key Constraint".
Section 12.8.6, "No Constraint".
Section 12.8.1, "Basic Constraints Extension
Constraint".
Section 12.8.7, "Netscape Certificate Type
Constraint".