Appendix A. Certificate Profile Input and Output Reference

The Certificate Request input is used for enrollments in which a certificate request is pasted into the enrollment form. It allows the request format to be set from a drop-down list and provides an input field to paste the request.

This input puts the following fields in the enrollment form:

caAdminCert.cfg:input.i1.class_id=certReqInputImpl

The CMC Certificate Request input is used for enrollments using a Certificate Message over CMS (CMC) certificate request is submitted in the request form. The request type must be either PKCS#10 or CRMF, and the only field is the Certificate Request text area in which to paste the request.

caCMCUserCert.cfg:input.i1.class_id=cmcCertReqInputImpl

The Dual Key Generation input is for enrollments in which dual key pairs will be generated, and thus two certificates issued, one for signing and one for encryption.

This input puts the following fields into the enrollment form:

caDualCert.cfg:input.i1.class_id=dualKeyGenInputImpl

The File-Signing input sets the fields to sign a file to show it has not been tampered with.

This input creates the following fields:

caAgentFileSigning.cfg:input.i2.class_id=fileSigningInputImpl

The Image input sets the field to sign an image file. The only field which this input creates is Image URL, which gives the location of the image which is to be signed.

The Key Generation input is used for enrollments in which a single key pair will be generated, generally user-based certificate enrollments.

This input puts the following fields into the enrollment form:

caDualCert.cfg:input.i1.class_id=keyGenInputImpl

The Token Key input is used to enroll keys for hardware tokens for agents to use later for certificate-based authentication.

This input puts the following fields into the enrollment form:

caTempTokenDeviceKeyEnrollment.cfg:input.i1.class_id=nsHKeyCertReqInputImpl

The Token User Key input is used to enroll keys for the user of a hardware token, for agents to use the token later for certificate-based authentication. This input puts the following fields into the enrollment form:

caTempTokenUserEncryptionKeyEnrollment.cfg:input.i1.class_id=nsNKeyCertReqInputImpl

The Serial Number Renewal Input is used to set the serial number of an existing certificate so that the CA can pull the original certificate entry and use the information to regenerate the certificate. The input inserts a Serial Number field into the enrollment form.

This is the only input that needs to be used with a renewal form; all the other information is supplied by the certificate entry.

caTokenUserEncryptionKeyRenewal.cfg:input.i1.class_id=serialNumRenewInputImpl

The Subject DN input allows the user to input the specific DN to set as the certificate subject name, and the input inserts a single Subject Name field into the enrollment form.

caAdminCert.cfg:input.i3.class_id=subjectDNInputImpl

The Subject Name input is used for enrollment when DN parameters need to be collected from the user. The parameters are used to formulate the subject name in the certificate. This input puts the following fields into the enrollment form:

caDualCert.cfg:input.i2.class_id=subjectNameInputImpl

The Submitter Information input collects the certificate requester’s information such as name, email, and phone.

This input puts the following fields into the enrollment form:

caAdminCert.cfg:input.i2.class_id=submitterInfoInputImpl

The Generic Input allows admins to specify any number of input fields to be used with extension plugins that handle patterns. For example, the ccm and GUID parameters are used in the patterned Subject Alternative Name Extension Default plugin:

input.i3.class_id=genericInputImpl
input.i3.params.gi_display_name0=ccm
input.i3.params.gi_param_enable0=true
input.i3.params.gi_param_name0=ccm
input.i3.params.gi_display_name1=GUID
input.i3.params.gi_param_enable1=true
input.i3.params.gi_param_name1=GUID
input.i3.params.gi_num=2
…
policyset.set1.p6.default.class_id=subjectAltNameExtDefaultImpl
policyset.set1.p6.default.name=Subject Alternative Name Extension Default
policyset.set1.p6.default.params.subjAltExtGNEnable_0=true
policyset.set1.p6.default.params.subjAltExtGNEnable_1=true
policyset.set1.p6.default.params.subjAltExtPattern_0=$request.ccm$
policyset.set1.p6.default.params.subjAltExtType_0=DNSName
policyset.set1.p6.default.params.subjAltExtPattern_1=(Any)1.3.6.1.4.1.311.25.1,0410$request.GUID$
policyset.set1.p6.default.params.subjAltExtType_1=OtherName
policyset.set1.p6.default.params.subjAltNameExtCritical=false
policyset.set1.p6.default.params.subjAltNameNumGNs=2

The Subject Alternative Name Extension Input is used along with the Subject Alternative Name Extension Default plugin. It allows admins to enable the numbered parameters in URI with the pattern req_san_pattern_# into the input and therefore the SubjectAltNameExt extension. For example, URI containing:

...&req_san_pattern_0=host0.Example.com&req_san_pattern_1=host1.Example.com

injects host0.Example.com and host1.Example.com into the SubjectAltNameExt extension from the profile below.

input.i3.class_id=subjectAltNameExtInputImpl
input.i3.name=subjectAltNameExtInputImpl
…
policyset.serverCertSet.9.constraint.class_id=noConstraintImpl
policyset.serverCertSet.9.constraint.name=No Constraint
policyset.serverCertSet.9.default.class_id=subjectAltNameExtDefaultImpl
policyset.serverCertSet.9.default.name=Subject Alternative Name Extension Default
policyset.serverCertSet.9.default.params.subjAltExtGNEnable_0=true
policyset.serverCertSet.9.default.params.subjAltExtPattern_0=$request.req_san_pattern_0$
policyset.serverCertSet.9.default.params.subjAltExtType_0=DNSName
policyset.serverCertSet.9.default.params.subjAltExtGNEnable_1=true
policyset.serverCertSet.9.default.params.subjAltExtPattern_1=$request.req_san_pattern_1$
policyset.serverCertSet.9.default.params.subjAltExtType_1=DNSName
policyset.serverCertSet.9.default.params.subjAltExtGNEnable_2=false
policyset.serverCertSet.9.default.params.subjAltExtPattern_2=$request.req_san_pattern_2$
policyset.serverCertSet.9.default.params.subjAltExtType_2=DNSName
policyset.serverCertSet.9.default.params.subjAltNameExtCritical=false
policyset.serverCertSet.9.default.params.subjAltNameNumGNs=3

This output displays the certificate in pretty-print format. This output cannot be configured or changed. It does not display anything other than the certificate in pretty-print format.

This output needs to be specified for any automated enrollment. Once a user successfully authenticates using the automated enrollment method, the certificate is automatically generated, and this output page is returned to the user. In an agent-approved enrollment, the user can get the certificate, once it is issued, by providing the request ID in the end-entities page.

caAdminCert.cfg:output.o1.class_id=certOutputImpl

This output returns the certificate and the certificate chain in PKCS #7 format. PKCS #7 format is the Cryptographic Message Syntax Standard, which is used for signing. This output cannot be configured or changed.

caAgentFileSigning.cfg:output.o1.class_id=pkcs7OutputImpl

This class implements the output plugin that returns the DER encoded certificates for token keys.

This output returns the certificate in Certificate Management Messages Formats (CMMF). CMMF govern communication between different parts of a PKI and is used for requesting certificates and requesting certificate revocation.