1

This relates to my earlier question on why FreeIPA would not sign a CSR for an intermediate CA. I ask what certificate profile would be appropriate to sign an intermediate certificate signing request, and where do I find that profile so I can import it into my FreeIPA instance, and sign the certificate.

Fraser Tweedale's mostly excellent blog post on FreeIPA and certificate profiles fails to point the less initiated (me) to a real-world source of certificate profile information. Tweedale casually states

The Extended Key Usage extension is defined in RFC 5280 §4.2.1.12. The two OIDs in the default profile are for TLS WWW server authentication and TLS WWW client authentication respectively. For S/MIME, we need to assert the Email protection key usage, so we change this line to: policyset.serverCertSet.7.default.params.exKeyUsageOIDs=1.3.6.1.5.5.7.3.4

To all but a small group of PKI experts, this would be a heady effort to understand.

| improve this question | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.