-
Notifications
You must be signed in to change notification settings - Fork 139
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add template profile for ServerCert with CRL-DP extension
- Loading branch information
Showing
4 changed files
with
426 additions
and
0 deletions.
There are no files selected for viewing
114 changes: 114 additions & 0 deletions
114
base/ca/shared/profiles/ca/caCMCECserverCertWithCRLDP.cfg
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,114 @@ | ||
| desc=This certificate profile is for enrolling server certificates with ECC keys using CMC and CRL-DP extention for certificate validation. | ||
| visible=false | ||
| enable=false | ||
| enableBy=admin | ||
| auth.instance_id=CMCAuth | ||
| authz.acl=group="Certificate Manager Agents" | ||
| name=Server Certificate wth ECC keys Enrollment using CMC with CRL-DP extension | ||
| input.list=i1 | ||
| input.i1.class_id=cmcCertReqInputImpl | ||
| output.list=o1 | ||
| output.o1.class_id=certOutputImpl | ||
| policyset.list=serverCertSet | ||
| policyset.serverCertSet.list=1,2,3,4,10,6,7,8,9 | ||
| policyset.serverCertSet.1.constraint.class_id=subjectNameConstraintImpl | ||
| policyset.serverCertSet.1.constraint.name=Subject Name Constraint | ||
| policyset.serverCertSet.1.constraint.params.pattern=.*CN=.* | ||
| policyset.serverCertSet.1.constraint.params.accept=true | ||
| policyset.serverCertSet.1.default.class_id=userSubjectNameDefaultImpl | ||
| policyset.serverCertSet.1.default.name=Subject Name Default | ||
| policyset.serverCertSet.1.default.params.name= | ||
| policyset.serverCertSet.2.constraint.class_id=validityConstraintImpl | ||
| policyset.serverCertSet.2.constraint.name=Validity Constraint | ||
| policyset.serverCertSet.2.constraint.params.range=720 | ||
| policyset.serverCertSet.2.constraint.params.notBeforeCheck=false | ||
| policyset.serverCertSet.2.constraint.params.notAfterCheck=false | ||
| policyset.serverCertSet.2.default.class_id=validityDefaultImpl | ||
| policyset.serverCertSet.2.default.name=Validity Default | ||
| policyset.serverCertSet.2.default.params.range=720 | ||
| policyset.serverCertSet.2.default.params.startTime=0 | ||
| policyset.serverCertSet.3.constraint.class_id=keyConstraintImpl | ||
| policyset.serverCertSet.3.constraint.name=Key Constraint | ||
| policyset.serverCertSet.3.constraint.params.keyType=EC | ||
| policyset.serverCertSet.3.constraint.params.keyParameters=nistp256,nistp384,nistp521 | ||
| policyset.serverCertSet.3.default.class_id=userKeyDefaultImpl | ||
| policyset.serverCertSet.3.default.name=Key Default | ||
| policyset.serverCertSet.4.constraint.class_id=noConstraintImpl | ||
| policyset.serverCertSet.4.constraint.name=No Constraint | ||
| policyset.serverCertSet.4.default.class_id=authorityKeyIdentifierExtDefaultImpl | ||
| policyset.serverCertSet.4.default.name=Authority Key Identifier Default | ||
| policyset.serverCertSet.5.constraint.class_id=noConstraintImpl | ||
| policyset.serverCertSet.5.constraint.name=No Constraint | ||
| policyset.serverCertSet.5.default.class_id=authInfoAccessExtDefaultImpl | ||
| policyset.serverCertSet.5.default.name=AIA Extension Default | ||
| policyset.serverCertSet.5.default.params.authInfoAccessADEnable_0=true | ||
| policyset.serverCertSet.5.default.params.authInfoAccessADLocationType_0=URIName | ||
| policyset.serverCertSet.5.default.params.authInfoAccessADLocation_0= | ||
| policyset.serverCertSet.5.default.params.authInfoAccessADMethod_0=1.3.6.1.5.5.7.48.1 | ||
| policyset.serverCertSet.5.default.params.authInfoAccessCritical=false | ||
| policyset.serverCertSet.5.default.params.authInfoAccessNumADs=1 | ||
| policyset.serverCertSet.6.constraint.class_id=keyUsageExtConstraintImpl | ||
| policyset.serverCertSet.6.constraint.name=Key Usage Extension Constraint | ||
| policyset.serverCertSet.6.constraint.params.keyUsageCritical=true | ||
| policyset.serverCertSet.6.constraint.params.keyUsageDigitalSignature=true | ||
| policyset.serverCertSet.6.constraint.params.keyUsageNonRepudiation=false | ||
| policyset.serverCertSet.6.constraint.params.keyUsageDataEncipherment=true | ||
| policyset.serverCertSet.6.constraint.params.keyUsageKeyEncipherment=false | ||
| policyset.serverCertSet.6.constraint.params.keyUsageKeyAgreement=true | ||
| policyset.serverCertSet.6.constraint.params.keyUsageKeyCertSign=false | ||
| policyset.serverCertSet.6.constraint.params.keyUsageCrlSign=false | ||
| policyset.serverCertSet.6.constraint.params.keyUsageEncipherOnly=false | ||
| policyset.serverCertSet.6.constraint.params.keyUsageDecipherOnly=false | ||
| policyset.serverCertSet.6.default.class_id=keyUsageExtDefaultImpl | ||
| policyset.serverCertSet.6.default.name=Key Usage Default | ||
| policyset.serverCertSet.6.default.params.keyUsageCritical=true | ||
| policyset.serverCertSet.6.default.params.keyUsageDigitalSignature=true | ||
| policyset.serverCertSet.6.default.params.keyUsageNonRepudiation=false | ||
| policyset.serverCertSet.6.default.params.keyUsageDataEncipherment=true | ||
| policyset.serverCertSet.6.default.params.keyUsageKeyEncipherment=false | ||
| policyset.serverCertSet.6.default.params.keyUsageKeyAgreement=true | ||
| policyset.serverCertSet.6.default.params.keyUsageKeyCertSign=false | ||
| policyset.serverCertSet.6.default.params.keyUsageCrlSign=false | ||
| policyset.serverCertSet.6.default.params.keyUsageEncipherOnly=false | ||
| policyset.serverCertSet.6.default.params.keyUsageDecipherOnly=false | ||
| policyset.serverCertSet.7.constraint.class_id=noConstraintImpl | ||
| policyset.serverCertSet.7.constraint.name=No Constraint | ||
| policyset.serverCertSet.7.default.class_id=extendedKeyUsageExtDefaultImpl | ||
| policyset.serverCertSet.7.default.name=Extended Key Usage Extension Default | ||
| policyset.serverCertSet.7.default.params.exKeyUsageCritical=false | ||
| policyset.serverCertSet.7.default.params.exKeyUsageOIDs=1.3.6.1.5.5.7.3.1 | ||
| policyset.serverCertSet.8.constraint.class_id=signingAlgConstraintImpl | ||
| policyset.serverCertSet.8.constraint.name=No Constraint | ||
| policyset.serverCertSet.8.constraint.params.signingAlgsAllowed=SHA256withRSA,SHA512withRSA,SHA256withEC,SHA384withRSA,SHA384withEC,SHA512withEC,SHA256withRSA/PSS,SHA384withRSA/PSS,SHA512withRSA/PSS | ||
| policyset.serverCertSet.8.default.class_id=signingAlgDefaultImpl | ||
| policyset.serverCertSet.8.default.name=Signing Alg | ||
| policyset.serverCertSet.8.default.params.signingAlg=- | ||
| policyset.serverCertSet.9.constraint.class_id=noConstraintImpl | ||
| policyset.serverCertSet.9.constraint.name=No Constraint | ||
| policyset.serverCertSet.9.default.class_id=commonNameToSANDefaultImpl | ||
| policyset.serverCertSet.9.default.name=copy CN to SAN Default | ||
| # The CRL Distribution Points extension describes where a CRL | ||
| # can be accessed. This extension requires: | ||
| # | ||
| # 1. setting the crlDistPointsPointName_0 parameter to the URL of the CRL | ||
| # e.g. http://host.example.com:8081/crl/ServerCertCRL.crl | ||
| # 2. setting the crlDistPointsIssuerName_0 parameter to the string | ||
| # representation of the Distinguised Name of the CRL issuer | ||
| # e.g. CN=CA Signing Certificate,O=Example-rhcs-ECC-RootCA | ||
| # | ||
| # Note: The crlDisPointsPointName example below is assuming that a CRL Distribution Point | ||
| # is set up for a smaller set of certificates, e.g. server certs used for a specific purpose, | ||
| # such as the server-cert of an LDAP server. For information on how to partition CRL, | ||
| # see RHCS documentation. | ||
| policyset.serverCertSet.10.constraint.class_id=noConstraintImpl | ||
| policyset.serverCertSet.10.constraint.name=No Constraint | ||
| policyset.serverCertSet.10.default.class_id=crlDistributionPointsExtDefaultImpl | ||
| policyset.serverCertSet.10.default.name=CRL Distribution Points Extension Default | ||
| policyset.serverCertSet.10.default.params.crlDistPointsCritical=false | ||
| policyset.serverCertSet.10.default.params.crlDistPointsEnable_0=true | ||
| policyset.serverCertSet.10.default.params.crlDistPointsIssuerName_0=SET_ME_TO_DN_OF_CRL_ISSUER | ||
| policyset.serverCertSet.10.default.params.crlDistPointsIssuerType_0=DirectoryName | ||
| policyset.serverCertSet.10.default.params.crlDistPointsNum=1 | ||
| policyset.serverCertSet.10.default.params.crlDistPointsPointName_0=http://LOCATION_OF_CRL | ||
| policyset.serverCertSet.10.default.params.crlDistPointsPointType_0=URIName | ||
| policyset.serverCertSet.10.default.params.crlDistPointsReasons_0= |
104 changes: 104 additions & 0 deletions
104
base/ca/shared/profiles/ca/caCMCserverCertWithCRLDP.cfg
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,104 @@ | ||
| desc=This certificate profile is for enrolling server certificates using CMC and CRL-DP extention for certificate validation. | ||
| visible=false | ||
| enable=false | ||
| enableBy=admin | ||
| auth.instance_id=CMCAuth | ||
| authz.acl=group="Certificate Manager Agents" | ||
| name=Server Certificate Enrollment using CMC with CRL-DP extension | ||
| input.list=i1 | ||
| input.i1.class_id=cmcCertReqInputImpl | ||
| output.list=o1 | ||
| output.o1.class_id=certOutputImpl | ||
| policyset.list=serverCertSet | ||
| policyset.serverCertSet.list=1,2,3,4,10,6,7,8,9 | ||
| policyset.serverCertSet.1.constraint.class_id=subjectNameConstraintImpl | ||
| policyset.serverCertSet.1.constraint.name=Subject Name Constraint | ||
| policyset.serverCertSet.1.constraint.params.pattern=.*CN=.* | ||
| policyset.serverCertSet.1.constraint.params.accept=true | ||
| policyset.serverCertSet.1.default.class_id=userSubjectNameDefaultImpl | ||
| policyset.serverCertSet.1.default.name=Subject Name Default | ||
| policyset.serverCertSet.1.default.params.name= | ||
| policyset.serverCertSet.2.constraint.class_id=validityConstraintImpl | ||
| policyset.serverCertSet.2.constraint.name=Validity Constraint | ||
| policyset.serverCertSet.2.constraint.params.range=720 | ||
| policyset.serverCertSet.2.constraint.params.notBeforeCheck=false | ||
| policyset.serverCertSet.2.constraint.params.notAfterCheck=false | ||
| policyset.serverCertSet.2.default.class_id=validityDefaultImpl | ||
| policyset.serverCertSet.2.default.name=Validity Default | ||
| policyset.serverCertSet.2.default.params.range=720 | ||
| policyset.serverCertSet.2.default.params.startTime=0 | ||
| policyset.serverCertSet.3.constraint.class_id=keyConstraintImpl | ||
| policyset.serverCertSet.3.constraint.name=Key Constraint | ||
| policyset.serverCertSet.3.constraint.params.keyType=RSA | ||
| policyset.serverCertSet.3.constraint.params.keyParameters=1024,2048,3072,4096 | ||
| policyset.serverCertSet.3.default.class_id=userKeyDefaultImpl | ||
| policyset.serverCertSet.3.default.name=Key Default | ||
| policyset.serverCertSet.4.constraint.class_id=noConstraintImpl | ||
| policyset.serverCertSet.4.constraint.name=No Constraint | ||
| policyset.serverCertSet.4.default.class_id=authorityKeyIdentifierExtDefaultImpl | ||
| policyset.serverCertSet.4.default.name=Authority Key Identifier Default | ||
| policyset.serverCertSet.6.constraint.class_id=keyUsageExtConstraintImpl | ||
| policyset.serverCertSet.6.constraint.name=Key Usage Extension Constraint | ||
| policyset.serverCertSet.6.constraint.params.keyUsageCritical=true | ||
| policyset.serverCertSet.6.constraint.params.keyUsageDigitalSignature=true | ||
| policyset.serverCertSet.6.constraint.params.keyUsageNonRepudiation=false | ||
| policyset.serverCertSet.6.constraint.params.keyUsageDataEncipherment=true | ||
| policyset.serverCertSet.6.constraint.params.keyUsageKeyEncipherment=true | ||
| policyset.serverCertSet.6.constraint.params.keyUsageKeyAgreement=false | ||
| policyset.serverCertSet.6.constraint.params.keyUsageKeyCertSign=false | ||
| policyset.serverCertSet.6.constraint.params.keyUsageCrlSign=false | ||
| policyset.serverCertSet.6.constraint.params.keyUsageEncipherOnly=false | ||
| policyset.serverCertSet.6.constraint.params.keyUsageDecipherOnly=false | ||
| policyset.serverCertSet.6.default.class_id=keyUsageExtDefaultImpl | ||
| policyset.serverCertSet.6.default.name=Key Usage Default | ||
| policyset.serverCertSet.6.default.params.keyUsageCritical=true | ||
| policyset.serverCertSet.6.default.params.keyUsageDigitalSignature=true | ||
| policyset.serverCertSet.6.default.params.keyUsageNonRepudiation=false | ||
| policyset.serverCertSet.6.default.params.keyUsageDataEncipherment=true | ||
| policyset.serverCertSet.6.default.params.keyUsageKeyEncipherment=true | ||
| policyset.serverCertSet.6.default.params.keyUsageKeyAgreement=false | ||
| policyset.serverCertSet.6.default.params.keyUsageKeyCertSign=false | ||
| policyset.serverCertSet.6.default.params.keyUsageCrlSign=false | ||
| policyset.serverCertSet.6.default.params.keyUsageEncipherOnly=false | ||
| policyset.serverCertSet.6.default.params.keyUsageDecipherOnly=false | ||
| policyset.serverCertSet.7.constraint.class_id=noConstraintImpl | ||
| policyset.serverCertSet.7.constraint.name=No Constraint | ||
| policyset.serverCertSet.7.default.class_id=extendedKeyUsageExtDefaultImpl | ||
| policyset.serverCertSet.7.default.name=Extended Key Usage Extension Default | ||
| policyset.serverCertSet.7.default.params.exKeyUsageCritical=false | ||
| policyset.serverCertSet.7.default.params.exKeyUsageOIDs=1.3.6.1.5.5.7.3.1 | ||
| policyset.serverCertSet.8.constraint.class_id=signingAlgConstraintImpl | ||
| policyset.serverCertSet.8.constraint.name=No Constraint | ||
| policyset.serverCertSet.8.constraint.params.signingAlgsAllowed=SHA256withRSA,SHA512withRSA,SHA256withEC,SHA384withRSA,SHA384withEC,SHA512withEC,SHA256withRSA/PSS,SHA384withRSA/PSS,SHA512withRSA/PSS | ||
| policyset.serverCertSet.8.default.class_id=signingAlgDefaultImpl | ||
| policyset.serverCertSet.8.default.name=Signing Alg | ||
| policyset.serverCertSet.8.default.params.signingAlg=- | ||
| policyset.serverCertSet.9.constraint.class_id=noConstraintImpl | ||
| policyset.serverCertSet.9.constraint.name=No Constraint | ||
| policyset.serverCertSet.9.default.class_id=commonNameToSANDefaultImpl | ||
| policyset.serverCertSet.9.default.name=copy CN to SAN Default | ||
| # The CRL Distribution Points extension describes where a CRL | ||
| # can be accessed. This extension requires: | ||
| # | ||
| # 1. setting the crlDistPointsPointName_0 parameter to the URL of the CRL | ||
| # e.g. http://host.example.com:8081/crl/ServerCertCRL.crl | ||
| # 2. setting the crlDistPointsIssuerName_0 parameter to the string | ||
| # representation of the Distinguised Name of the CRL issuer | ||
| # e.g. CN=CA Signing Certificate,O=Example-rhcs-RSA-RootCA | ||
| # | ||
| # Note: The crlDisPointsPointName example below is assuming that a CRL Distribution Point | ||
| # is set up for a smaller set of certificates, e.g. server certs used for a specific purpose, | ||
| # such as the server-cert of an LDAP server. For information on how to partition CRL, | ||
| # see RHCS documentation. | ||
| policyset.serverCertSet.10.constraint.class_id=noConstraintImpl | ||
| policyset.serverCertSet.10.constraint.name=No Constraint | ||
| policyset.serverCertSet.10.default.class_id=crlDistributionPointsExtDefaultImpl | ||
| policyset.serverCertSet.10.default.name=CRL Distribution Points Extension Default | ||
| policyset.serverCertSet.10.default.params.crlDistPointsCritical=false | ||
| policyset.serverCertSet.10.default.params.crlDistPointsEnable_0=true | ||
| policyset.serverCertSet.10.default.params.crlDistPointsIssuerName_0=SET_ME_TO_DN_OF_CRL_ISSUER | ||
| policyset.serverCertSet.10.default.params.crlDistPointsIssuerType_0=DirectoryName | ||
| policyset.serverCertSet.10.default.params.crlDistPointsNum=1 | ||
| policyset.serverCertSet.10.default.params.crlDistPointsPointName_0=http://LOCATION_OF_CRL | ||
| policyset.serverCertSet.10.default.params.crlDistPointsPointType_0=URIName | ||
| policyset.serverCertSet.10.default.params.crlDistPointsReasons_0= |
Oops, something went wrong.