Configuring System Certificate Profiles

Overview

System certificate profiles are used to generate the initial system certificates during installation.

The system certificate profile templates are stored in /usr/share/pki/ca/conf. During CA installation the system certificate profiles will be copied into /var/lib/pki/<instance>/<subsystem>/conf.

The profiles can be configured with the Two-Step Installation process.

Configuration Process

Run installation step 1.

Edit the profile configuration files in /var/lib/pki/<instance>/<subsystem>/conf:

id=...
name=...
description=...
profileIDMapping=...
profileSetIDMapping=...
list=<list of numbers>
<number>.default.class=...
<number>.default.name=...
<number>.default.params.<name>=...

Finally, run installation step 2.

System Certificate Profiles

• CA signing certificate:

  • caCert.profile

• OCSP signing certificate:

  • caOCSPCert.profile

• Audit signing certificate:

  • caAuditSigningCert.profile

• Subsystem certificate:

  • rsaSubsystemCert.profile

  • eccSubsystemCert.profile

  • ECsubsystemCert.profile

• Server certificate:

  • eccServerCert.profile

  • rsaServerCert.profile

  • ECserverCert.profile

• Admin certificate:

  • rsaAdminCert.profile

  • eccAdminCert.profile

  • ECadminCert.profile

See Also

• Configuring Certificate Profiles

• Certificate Profile Constraints

• RFC 3280

• Customising Dogtag system certificate lifetimes