6.2. Creating a certificate profile

Procedure

1. Create a custom profile by copying an existing default profile:

   $ ipa certprofile-show --out smime.cfg caIPAserviceCert
   ------------------------------------------------
   Profile configuration stored in file 'smime.cfg'
   ------------------------------------------------
     Profile ID: caIPAserviceCert
     Profile description: Standard profile for network services
     Store issued certificates: TRUE

2. Open the newly created profile configuration file in a text editor.

   $ vi  smime.cfg

3. Change the Profile ID to a name that reflects the usage of the profile, for example smime.

   注意

   When you are importing a newly created profile, the profileId field, if present, must match the ID specified on the command line.

4. Update the Extended Key Usage configuration. The default Extended Key Usage extension configuration is for TLS server and client authentication. For example for S/MIME, the Extended Key Usage must be configured for email protection:

   policyset.serverCertSet.7.default.params.exKeyUsageOIDs=1.3.6.1.5.5.7.3.4

5. Import the new profile:

   $ ipa certprofile-import smime --file smime.cfg \
     --desc "S/MIME certificates" --store TRUE
   
   ------------------------
   Imported profile "smime"
   ------------------------
     Profile ID: smime
     Profile description: S/MIME certificates
     Store issued certificates: TRUE