This relates to my earlier question on why FreeIPA would not sign a CSR for an intermediate CA. I ask what certificate profile would be appropriate to sign an intermediate certificate signing request, and where do I find that profile so I can import it into my FreeIPA instance, and sign the certificate.
Fraser Tweedale's mostly excellent blog post on FreeIPA and certificate profiles fails to point the less initiated (me) to a real-world source of certificate profile information. Tweedale casually states
The Extended Key Usage extension is defined in RFC 5280 §22.214.171.124. The two OIDs in the default profile are for TLS WWW server authentication and TLS WWW client authentication respectively. For S/MIME, we need to assert the Email protection key usage, so we change this line to: policyset.serverCertSet.7.default.params.exKeyUsageOIDs=126.96.36.199.188.8.131.52.4
To all but a small group of PKI experts, this would be a heady effort to understand.