Chapter 6. Creating and managing certificate profiles in Identity Management

Procedure

1. Create a custom profile by copying an existing default profile:

   $ ipa certprofile-show --out smime.cfg caIPAserviceCert
   ------------------------------------------------
   Profile configuration stored in file 'smime.cfg'
   ------------------------------------------------
     Profile ID: caIPAserviceCert
     Profile description: Standard profile for network services
     Store issued certificates: TRUE

2. Open the newly created profile configuration file in a text editor.

   $ vi  smime.cfg

3. Change the Profile ID to a name that reflects the usage of the profile, for example smime.

   Note

   When you are importing a newly created profile, the profileId field, if present, must match the ID specified on the command line.

4. Update the Extended Key Usage configuration. The default Extended Key Usage extension configuration is for TLS server and client authentication. For example for S/MIME, the Extended Key Usage must be configured for email protection:

   policyset.serverCertSet.7.default.params.exKeyUsageOIDs=1.3.6.1.5.5.7.3.4

5. Import the new profile:

   $ ipa certprofile-import smime --file smime.cfg \
     --desc "S/MIME certificates" --store TRUE
   
   ------------------------
   Imported profile "smime"
   ------------------------
     Profile ID: smime
     Profile description: S/MIME certificates
     Store issued certificates: TRUE

Procedure

1. Create a new group for the users of the certificate profile:

   $ ipa group-add smime_users_group
   ---------------------------------
   Added group "smime users group"
   ---------------------------------
     Group name: smime_users_group
     GID: 75400001

2. Create a new user to add to the smime_user_group group:

   $ ipa user-add smime_user
   First name: smime
   Last name: user
   ----------------------
   Added user "smime_user"
   ----------------------
     User login: smime_user
     First name: smime
     Last name: user
     Full name: smime user
     Display name: smime user
     Initials: TU
     Home directory: /home/smime_user
     GECOS: smime user
     Login shell: /bin/sh
     Principal name: smime_user@IDM.EXAMPLE.COM
     Principal alias: smime_user@IDM.EXAMPLE.COM
     Email address: smime_user@idm.example.com
     UID: 1505000004
     GID: 1505000004
     Password: False
     Member of groups: ipausers
     Kerberos keys available: False

3. Add the smime_user to the smime_users_group group:

   $ ipa group-add-member smime_users_group --users=smime_user
     Group name: smime_users_group
     GID: 1505000003
     Member users: smime_user
   -------------------------
   Number of members added 1
   -------------------------

4. Create the CA ACL to allow users in the group to access the certificate profile:

   $ ipa caacl-add smime_acl
   ------------------------
   Added CA ACL "smime_acl"
   ------------------------
     ACL name: smime_acl
     Enabled: TRUE

5. Add the user group to the CA ACL:

   $ ipa caacl-add-user smime_acl --group smime_users_group
     ACL name: smime_acl
     Enabled: TRUE
     User Groups: smime_users_group
   -------------------------
   Number of members added 1
   -------------------------

6. Add the certificate profile to the CA ACL:

   $ ipa caacl-add-profile smime_acl --certprofile smime
     ACL name: smime_acl
     Enabled: TRUE
     Profiles: smime
     User Groups: smime_users_group
   -------------------------
   Number of members added 1
   -------------------------

Procedure

1. Generate a certificate request for the user. For example, using OpenSSL:

   $ openssl req -new -newkey rsa:2048 -days 365 -nodes -keyout private.key -out cert.csr -subj '/CN=smime_user'

2. Request a new certificate for the user from the IdM CA:

   $ ipa cert-request cert.csr --principal=smime_user --profile-id=smime

   Optionally pass the --ca sub-CA_name option to the command to request the certificate from a sub-CA instead of the root CA.

Procedure

1. Determine the certificate profile ID for the certificate profile you are modifying. To display all certificate profiles currently stored in IdM:

   # ipa certprofile-find
   
   ------------------
   4 profiles matched
   ------------------
     Profile ID: caIPAserviceCert
     Profile description: Standard profile for network services
     Store issued certificates: TRUE
   
     Profile ID: IECUserRoles
     ...
   
     Profile ID: smime
     Profile description: S/MIME certificates
     Store issued certificates: TRUE
   --------------------------
   Number of entries returned
   --------------------------

2. Modify the certificate profile description. For example, if you created a custom certificate profile for S/MIME certificates using an existing profile, change the description in line with the new usage:

   # ipa certprofile-mod smime --desc "New certificate profile description"
   ------------------------------------
   Modified Certificate Profile "smime"
   ------------------------------------
       Profile ID: smime
       Profile description: New certificate profile description
       Store issued certificates: TRUE

3. Open your customer certificate profile file in a text editor and modify to suit your requirements:

   # vi smime.cfg

   For details on the options which can be configured in the certificate profile configuration file, see Certificate profile configuration parameters.

4. Update the existing certificate profile configuration file:

   # ipa certprofile-mod _profile_ID_ --file=smime.cfg