User Key Default; User Signing Algorithm Default - Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION Admin Manual

Appendix B. Defaults, Constraints, and Extensions for Certificates and CRLs
• If the OID of the extension is specified in both the certificate request and the default, then the
extension is validated by the constraints and applied to the certificate.
• If an OID of an extension is given in the request but is not specified in the User Supplied Extension
Default in the profile, then the user-specified extension is ignored, and the certificate is successfully
enrolled without that extension.
• If this extension is set on a profile with a corresponding OID (Extension Constraint), then any
certificate request processed through that profile must carry the specified extension or the request is
rejected.
A certificate request that contains the user-defined extensions must be submitted to the profile. The
certificate enrollment forms, however, do not have any input fields for users to add user-supplied
extensions. Submitting a certificate request without supplying the extension fails.
Example B.2, "User Supplied Extension Default for the Extended Key Usage Extension"
Supplied Extension Default to a profile with the Extended Key Usage Constraint. The OID specified in
the userExtOID parameter is for the Extended Key Usage Extension.
policyset.set1.2.constraint.class_id=extendedKeyUsageExtConstraintImpl
policyset.set1.2.constraint.name=Extended Key Usage Extension
policyset.set1.2.constraint.params.exKeyUsageCritical=false
policyset.set1.2.constraint.params.exKeyUsageOIDs=1.3.6.1.5.5.7.3.2,1.3.6.1.5.5.7.3.4
policyset.set1.2.default.class_id=userExtensionDefaultImpl
policyset.set1.2.default.name=User Supplied Extension Default
policyset.set1.2.default.params.userExtOID=2.5.29.37
Example B.2. User Supplied Extension Default for the Extended Key Usage Extension
Example B.2, "User Supplied Extension Default for the Extended Key Usage
In
although the User Supplied Extension Default allows a user to specify the Extended Key Usage
Extension (2.5.29.37), the constraint limits the user request to only the SSL client authentication
(1.3.6.1.5.5.7.3.2) and email protection (1.3.6.1.5.5.7.3.4) uses.
Editing profiles is described in
Command Line".
B.1.23. User Key Default
This default attaches a user-supplied key into the certificate request. This is a required default. Keys
are part of the enrollment request.
The following constraints can be defined with this default:
• Key Constraint; see
• No Constraints; see
B.1.24. User Signing Algorithm Default
This default implements an enrollment default profile that populates a user-supplied signing algorithm
in the certificate request. If included in the certificate profile, this allows a user to choose a signing
algorithm for the certificate, subject to the constraint set.
No inputs are provided to add signing algorithm choices to the enrollment form, but it is possible to
submit a request that contains this information.
450
Section 2.2.3, "Creating and Editing Certificate Profiles through the
Section B.2.4, "Key Constraint".
Section B.2.6, "No Constraint".
adds the User
Extension",