<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<X509Profile xmlns="http://exceet-secure-solutions.de/xml/ns/pki/profile/v1">
<appInfo>
<myDescriptor>
<project>example-pki</project>
<category>End Entity Certificate</category>
<title>Server Certificates</title>
<details>C.EXAMPLE.CMP</details>
</myDescriptor>
</appInfo>
<!-- for a End-Entity Certificate, it must be false -->
<ca>false</ca>
<!-- the validity of certificate in days -->
<validity>1826</validity> <!-- 5 Jahre -->
<!-- either current to use the current time or midnight to use the next
mid-night time -->
<notBeforeTime>current</notBeforeTime>
<!-- whether a new certificate with duplicated key is permitted -->
<duplicateKey>false</duplicateKey>
<!-- whether a new certificate with duplicated subject is permitted -->
<duplicateSubject>true</duplicateSubject>
- whether the request can contain the subject attribute serialNumber --
>
<serialNumberInReq>true</serialNumberInReq>
<!-- permitted public keys. If absent, then all public keys are permitted
-->
<keyAlgorithms>
<algorithm>
<algorithm description="RSA">1.2.840.113549.1.1.1</algorithm>
<parameters>
<RSAParameters>
<modulusLength>
<range min="2048" max="2048"/>
<range min="3072" max="3072"/>
<range min="4096" max="4096"/>
</modulusLength>
</RSAParameters>
</parameters>
</algorithm>
<algorithm>
<algorithm description="EC">1.2.840.10045.2.1</algorithm>
<parameters>
<ECParameters>
<curves>
<curve
description="prime256v1">1.2.840.10045.3.1.7</curve>
<curve description="secp384r1">1.3.132.0.34</curve>
<curve description="secp521r1">1.3.132.0.35</curve>
<curve
description="brainpoolp256r1">1.3.36.3.3.2.8.1.1.7</curve>
<curve
description="brainpoolp384r1">1.3.36.3.3.2.8.1.1.11</curve>
<curve
description="brainpoolp512r1">1.3.36.3.3.2.8.1.1.13</curve>
</curves>
<pointEncodings>
<pointEncoding>4</pointEncoding>
</pointEncodings>
</ECParameters>
</parameters>
</algorithm>
</keyAlgorithms>
<subject>
<dnBackwards>false</dnBackwards>
rialNumber>false</incSerialNumber>
<rdn minOccurs="1" maxOccurs="1">
<type description="cn">2.5.4.3</type>
<minLen>1</minLen>
<maxLen>64</maxLen>
</rdn>
<rdn minOccurs="0" maxOccurs="1">
<type description="serialNumber">2.5.4.5</type>
<minLen>1</minLen>
<maxLen>64</maxLen>
<regex>[-'()=+,.:?/ a-zA-Z0-9]*</regex>
</rdn>
<rdn minOccurs="0" maxOccurs="9">
<type description="ou">2.5.4.11</type>
<minLen>1</minLen>
<maxLen>64</maxLen>
</rdn>
<rdn minOccurs="1" maxOccurs="1">
<type description="o">2.5.4.10</type>
<minLen>1</minLen>
<maxLen>64</maxLen>
</rdn>
<rdn minOccurs="0" maxOccurs="1">
<type description="l">2.5.4.7</type>
<minLen>1</minLen>
<maxLen>128</maxLen>
</rdn>
<rdn minOccurs="0" maxOccurs="1">
<type description="st">2.5.4.8</type>
<minLen>1</minLen>
<maxLen>128</maxLen>
</rdn>
<rdn minOccurs="1" maxOccurs="1">
<type description="c">2.5.4.6</type>
<minLen>1</minLen>
<maxLen>2</maxLen>
</rdn>
<rdn minOccurs="0" maxOccurs="1">
<type description="dc">0.9.2342.19200300.100.1.25</type>
<minLen>1</minLen>
<maxLen>64</maxLen>
</rdn>
ubject>
<extensions>
<extension required="true" permittedInRequest="false">
<type description="subjectKeyIdentifier">2.5.29.14</type>
<critical>false</critical>
</extension>
<extension required="true" permittedInRequest="false">
<type description="authorityKeyIdentifier">2.5.29.35</type>
<critical>false</critical>
<value>
<authorityKeyIdentifier>
<includeIssuerAndSerial>true</includeIssuerAndSerial>
</authorityKeyIdentifier>
</value>
</extension>
<extension required="true" permittedInRequest="false">
<type description="keyUsage">2.5.29.15</type>
<critical>true</critical>
<value>
<keyUsage>
<!-- valid values are digitalSignature, contentCommitment,
keyEncipherment, dataEncipherment,
keyAgreement, keyCertSign, cRLSign, encipherOnly,
decipherOnly -->
<usage required="true">digitalSignature</usage>
<usage required="true">keyEncipherment</usage>
<usage required="true">keyAgreement</usage>
</keyUsage>
</value>
</extension>
<extension required="false" permittedInRequest="true">
<type description="subjectAltNames">2.5.29.17</type>
<critical>false</critical>
<!--
<value>
<subjectAltName>
<rfc822Name/>
</subjectAltName>
</value>
</extension>
<extension required="true" permittedInRequest="false">
<type description="basicConstraints">2.5.29.19</type>
<critical>true</critical>
<value>
<basicConstraints>
<pathLen>0</pathLen>
</basicConstraints>
</value>
</extension>
<extension required="false" permittedInRequest="false">
<type description="certificatePolicies">2.5.29.32</type>
<critical>false</critical>
</extension>
<extension required="false" permittedInRequest="false">
<type description="cRLDistributionPoints">2.5.29.31</type>
<critical>false</critical>
</extension>
<extension required="false" permittedInRequest="false">
<type description="authorityInfoAccess">1.3.6.1.5.5.7.1.1</type>
<critical>false</critical>
</extension>
<extension required="true" permittedInRequest="false">
<type description="extendedKeyUsage">2.5.29.37</type>
<critical>false</critical>
<value>
<extendedKeyUsage>
<usage required="true" description="ip-kp
serverAuth">1.3.6.1.5.5.7.3.1</usage>
<usage required="true" description="ip-kp
clientAuth">1.3.6.1.5.5.7.3.2</usage>
</extendedKeyUsage>
</value>
</extension>
</extensions>
</X509Profile>
