This relates to my earlier question on why FreeIPA would not sign a CSR for an intermediate CA. I ask what certificate profile would be appropriate to sign an intermediate certificate signing request, and where do I find that profile so I can import it into my FreeIPA instance, and sign the certificate.

Fraser Tweedale's mostly excellent blog post on FreeIPA and certificate profiles fails to point the less initiated (me) to a real-world source of certificate profile information. Tweedale casually states

The Extended Key Usage extension is defined in RFC 5280 § The two OIDs in the default profile are for TLS WWW server authentication and TLS WWW client authentication respectively. For S/MIME, we need to assert the Email protection key usage, so we change this line to: policyset.serverCertSet.7.default.params.exKeyUsageOIDs=

To all but a small group of PKI experts, this would be a heady effort to understand.

| improve this question | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.