Configuring System Certificate Profiles

Overview

System certificate profiles are used to generate the initial system certificates during installation (see Two-Step Installation). These profiles are no longer used after installation.

The templates for system certificate profiles are stored in /usr/share/pki/ca/conf.

• CA signing certificate:

  • caCert.profile

• CA OCSP signing certificate:

  • caOCSPCert.profile

• CA Audit signing certificate:

  • caAuditSigningCert.profile

• Subsystem certificate:

  • rsaSubsystemCert.profile

  • eccSubsystemCert.profile

• Server certificate:

  • eccServerCert.profile

  • rsaServerCert.profile

• CA Admin certificate:

  • rsaAdminCert.profile

  • eccAdminCert.profile

During CA installation these templates will be copied into /var/lib/pki/<instance>/<subsystem>/conf which can be configured using the Two-Step Installation.

Configuration

To configure a system certificate profile, edit the profile configuration file in /var/lib/pki/<instance>/<subsystem>/conf (not in /usr/share/pki/ca/conf):

id=...
name=...
description=...
profileIDMapping=...
profileSetIDMapping=...
list=<list of numbers>
<number>.default.class=...
<number>.default.name=...
<number>.default.params.<name>=...

See Also

• Configuring Certificate Profiles

• Certificate Profile Constraints

• RFC 3280

• Customising Dogtag system certificate lifetimes