Creating Custom Renewal Profiles - Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION Admin Manual

4.7.1.2. Renewal Types in Certificate System
As with any certificate request, a renewal request has to be approved before the CA will issue the new
certificate. Certificate System has three renewal types, depending on the authorization method used to
verify the requester, and any of the three types can be used to renew any kind of certificate:
• Agent-based renewal, where the agent manually approves the request
• Directory-based renewal, where the requester authenticates to an LDAP directory
• Certificate-based renewal, where the certificate stored in the browser's database is used to
authenticate the requester
Authentication is covered in
TIP
Email notifications can be configured for renewal requests; this is described in
Section 10.2, "Setting up Automated Notifications for the CA"
"Configuration Parameters of

4.7.2. Creating Custom Renewal Profiles

Certificate renewal regenerates a certificate using its original public key, certificate extensions and
constraints, and subject name. A renewed certificate is identical to the original, except that it has a
new expiration date.
When a certificate is renewed, it has to be renewed using a renewal profile that corresponds to
the initial enrollment profile. Certificate System supports renewals both for tokens and for regular
certificates, both through the RA and the CA.
The default configuration profiles cover user certificates and other types of subsystem certificates, as
well as token renewals, but it may be necessary or convenient to create a special renewal profile for a
custom enrollment form.
4.7.2.1. Default Renewal Profiles
Certificate System contains three default renewal profiles for renewing user certificates.
Renewal Profile
caDirUserRenewal.cfg
caManualRenewal.cfg
caSSLClientSelfRenewal.cfg
Table 4.4. Renewal Profiles
4.7.2.2. Creating an Enrollment Profile
A custom profile is configured the same as described in
There are two settings that must be present in the profile, however, to allow renewal for the certificate:
a setting on whether renewal is allowed and a setting on the time period when renewal is allowed.
The renewal parameter sets whether renewal is allowed. This must be true:
Chapter 9, Authentication for Enrolling
certRenewalNotifier".
Creating Custom Renewal Profiles
Certificates.
and
Type
Directory-based
Agent-based
Certificate-based
Section 2.2, "Setting up Certificate
Section 11.3.3,
Profiles".
119