Creating Certificate Profile

Overview

This page describes the process to create a new certificate profile from an existing one in CA.

Stopping PKI Server

$ pki-server stop

Creating Certificate Profile

Perform the following customization to automatically create a profile for this authentication plugin which will be directly available from the end-entity (EE) port (default EE port number is 9443). Perform the following tasks for each selected instance of the PKI server:

• Assume the role of the root user.

• Execute:

$ cd <pki-instance>/profiles/<pki-subsystem>

where <pki-instance> is the complete path to the desired CA instance, and <pki-subsystem> is always ca for all authentication plugins.

• Execute:

$ cp -p caDirUserCert.cfg caSSNUserCert.cfg

to create a new customized enrollment page, and preserve the permissions of the owner of this CA instance.

• Edit the <pki-instance>/profiles/<pki-subsystem>/caSSNUserCert.cfg file to make the following highlighted changes:

desc=This certificate profile is for enrolling user certificates with SSN authentication.
visible=true
enable=true
enableBy=admin
name=SSN User Dual-Use Certificate Enrollment
auth.instance_id=SSNEnroll
    .
    .
    .

• Execute:

$ cd <pki-instance>/conf

where <pki-instance> is the complete path to the same CA instance.

• Edit the <pki-instance>/conf/CS.cfg file to make the following highlighted changes:

    .
    .
    .
profile.list=caUserCert,caDualCert,caSignedLogCert,caTPSCert,caRARouterCert,caRo
uterCert,caServerCert,caOtherCert,caCACert,caInstallCACert,caRACert,caOCSPCert,c
aTransportCert,caDirUserCert,caAgentServerCert,caAgentFileSigning,caCMCUserCert,
caFullCMCUserCert,caSimpleCMCUserCert,caTokenDeviceKeyEnrollment,caTokenUserEncr
yptionKeyEnrollment,caTokenUserSigningKeyEnrollment,caTempTokenDeviceKeyEnrollme
nt,caTempTokenUserEncryptionKeyEnrollment,caTempTokenUserSigningKeyEnrollment,ca
AdminCert,caInternalAuthServerCert,caInternalAuthTransportCert,caInternalAuthDRM
storageCert,caInternalAuthSubsystemCert,caInternalAuthOCSPCert,DomainController,
caDualRAuserCert,caRAagentCert,caRAserverCert,caSSNUserCert
    .
    .
    .
profile.caRouterCert.class_id=caEnrollImpl
profile.caRouterCert.config=<pki-instance>/profiles/<pki-subsystem>/caRouterCert.cfg
profile.caSSNUserCert.class_id=caEnrollImpl
profile.caSSNUserCert.config=<pki-instance>/profiles/<pki-subsystem>/caSSNUserCert.cfg
profile.caServerCert.class_id=caEnrollImpl
profile.caServerCert.config=<pki-instance>/profiles/<pki-subsystem>/caServerCert.cfg
    .
    .
    .

Starting PKI Server

$ pki-server start