Custom Certificate Extensions Workflow

Configuration of custom certificate extensions is described in the following sections

Add Custom Certificate Extension

Reminder you can visit the Accessing Your Environment page for details on how to find your AdminWeb Portal

To add a new custom certificate extension, do the following:

1. Open a browser and access your AdminWeb Portal

2. Click System Configuration >> System Configuration

3. Click on the Custom Certificate Extensions tab

4. In the Object Identifier (OID) field, enter 1.2.3.4 as unique Object Identifier (OID) for the custom extension

5. In the Label field, enter MyCustomExtension as label for the custom extension

6. Click the Add button under actions

7. Click the Edit button under actions for the newly added custom certificate extension

8. Set Dynamic to true

9. Set Encoding to DERUTF8STRING

10. Click Save

Enable Custom Certificate Extension in Certificate Profile

Reminder you can visit the Accessing Your Environment page for details on how to find your AdminWeb Portal

To enable a custom extension for a certificate profile, do the following:

1. Open a browser and access your AdminWeb Portal

2. Click CA Functions >> Certificate Profiles

3. For the CustomExtensionCertificateProfile, click Edit

4. In the Used Custom Certificate Extensions list, select MyCustomExtension

5. In the Available CAs list, select Sub CA

6. Click Save

Enable Entering Custom Certificate Extension Data in End Entity Profile

Reminder you can visit the Accessing Your Environment page for details on how to find your AdminWeb Portal

To enable entering dynamic custom certificate extension data for end entities, perform following:

1. Open a browser and access your AdminWeb Portal

2. Click RA Functions >> End Entity Profiles

3. In the List of End Entity Profiles list, select CustomExtensionEndEntityProfile

4. Click Edit End Entity Profile

5. In the Default CA list, select Sub CA

6. In the Available CAs list, select Sub CA

7. In the Other certificate data section, check the Use checkbox for Custom certificate extension data

8. Click Save

Issue Certificate with Custom Certificate Extension

Reminder you can visit the Accessing Your Environment page for details on how to find your RA Web Portal

To issue a certificate with a custom extension containing dynamic data, do the following:

1. Open a browser and click RA Web, from the ribbon menu across the top of page

2. Click Enroll >> Make New Request

3. In the Certificate Type drop-down list, select CustomExtensionEndEntityProfile

4. In the Key-pair generation selection, select By the CA

5. In the CN, Common name field, enter training_customextension

6. The Certificate Data Extension field, expects the data in oid key=attribute value format, i.e. custom oid.value=some text.
   In the Certificate Extension Data field, enter 1.2.3.4.value=This is the custom certificate extension value. As shown here.

1. In the Username field, enter training_customextension

2. In the Enrollment code field, enter foo123

3. In the Confirm enrollment code field, enter foo123

4. Click Download PEM

5. Save the file as training_customextension.pem

Viewing Certificate Extension using openssl

To view the certificate in order to confirm that the custom certificate extension is used, do the following:

1. Open the TERMINAL application on the desktop & change directory to the downloaded PEM file

2. Run the following openssl command

cd ~/Downloads
openssl x509 -in training_customextension.pem -text -noout

3. Verify the following line is present in the certificate dump:

1.2.3.4:
  This is the custom certificate extension value

Viewing Certificate Extension using RAWeb

Reminder you can visit the Accessing Your Environment page for details on how to find your PublicWeb Portal

To view the certificate in order to confirm that the custom certificate extension is used, do the following:

1. Open a browser and click RA Web, from the ribbon menu across the top of page

2. Click Tools >> Inspect certificate/CSR

3. Click Upload a file

4. Click Home >> Downloads

5. Select training_customextension.pem

6. Click Select

7. The following line should present in the certificate dump:

critical(false) 1.2.3.4 value = UTF8String(This is the custom certificate extension value)

Questions and Answers