Defining Key Defaults In Profiles; Configuring Cross-Pair Profiles - Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION Admin Manual

Defining Key Defaults in Profiles

2.2.3.3. Adding Inputs through the Command Line
The certificate profile configuration file in the CA's profiles/ca directory contains the input
information for the that particular certificate profile form. Inputs are the fields in the end-entities page
enrollment forms. There is a parameter, input.list, which lists the inputs included in that profile.
Other parameters define the inputs; these are identified by the format input.ID. For example, this
adds a generic input to a profile:
input.list=i1,i2,i3,i4
...
input.i4.class_id=genericInputImpl
input.i4.params.gi_display_name0=Name0
input.i4.params.gi_display_name1=Name1
input.i4.params.gi_display_name2=Name2
input.i4.params.gi_display_name3=Name3
input.i4.params.gi_param_enable0=true
input.i4.params.gi_param_enable1=true
input.i4.params.gi_param_enable2=true
input.i4.params.gi_param_enable3=true
input.i4.params.gi_param_name0=gname0
input.i4.params.gi_param_name1=gname1
input.i4.params.gi_param_name2=gname2
input.i4.params.gi_param_name3=gname3
input.i4.params.gi_num=4
Section A.1, "Input Reference".
For more information on what inputs, or form fields, are available, see
2.2.4. Defining Key Defaults in Profiles
There is one important thing to do when creating profiles: the Key Default must be added before the
Subject Key Identifier Default. Certificate System processes the key constraints in the Key Default
before creating or applying the Subject Key Identifier Default, so if the key has not been processed
yet, setting the key in the subject name fails.
For example, an object-signing profile may define both defaults:
policyset.set1.p3.constraint.class_id=noConstraintImpl
policyset.set1.p3.constraint.name=No Constraint
policyset.set1.p3.default.class_id=subjectKeyIdentifierExtDefaultImpl
policyset.set1.p3.default.name=Subject Key Identifier Default
...
policyset.set1.p11.constraint.class_id=keyConstraintImpl
policyset.set1.p11.constraint.name=Key Constraint
policyset.set1.p11.constraint.params.keyType=-
policyset.set1.p11.constraint.params.keyMinLength=256
policyset.set1.p11.constraint.params.keyMaxLength=4096
policyset.set1.p11.default.class_id=userKeyDefaultImpl
policyset.set1.p11.default.name=Key Default
In the policyset list, then, the Key Default (p11) must be listed before the Subject Key Identifier
Default (p3).
policyset.set1.list=p1,p2,p11,p3,p4,p5,p6,p7,p8,p9,p10

2.2.5. Configuring Cross-Pair Profiles

Bridge or cross-pair certificates are CA signing certificate that are framed as dual certificate pairs,
similar to encryption and signing certificate pairs for users, only each certificate in the pair is issued
39