lb pki-profile

The lb pki-profile command creates the certificate profiles that carry the common settings of the certificates that will be created with the internal CA. The profile applies the same lifetime, renewal threshold and key settings to every certificate created. Its panel equivalent is the Certificate Profiles screen.

Command Summary

TR7 WEB-CLI · lb pki-profile

# Tab after the command

admin@TR7LBWAF01> lb pki-profile

add delete list show update

 

admin@TR7LBWAF01> lb pki-profile list # list all of them

admin@TR7LBWAF01> lb pki-profile show <id> # show one

admin@TR7LBWAF01> lb pki-profile add name <name> usage <usage> …

admin@TR7LBWAF01> lb pki-profile update id <id> … # change

admin@TR7LBWAF01> lb pki-profile delete <id> # delete

admin@TR7LBWAF01>  

Required Fields

Order	Field	Status	What it does	What is written after it
1	name	Required	Gives a name to the profile	The name of the profile; it must be unique in the collection
2	usage	Required	Determines for which kind of certificates the profile will be used	server the server certificates · client the client certificates

Optional Fields

Field	What it does	What is written after it
--lifetimeDays	Determines for how many days the created certificate will be valid	The number of days (default 365)
--renewBeforeDays	Determines how many days before the expiry it will be renewed	The number of days (default 30)
--eku.N	Determines the extended key usage of the certificate	serverAuth · clientAuth (default serverAuth); each with its own index
--sanTemplate	Determines the additional name template that will be used in the creation	The template text
--keyAlgo	Selects the algorithm of the key to be created	rsa2048 (default) · rsa3072 · rsa4096 · ecP256 · ecP384

Examples

TR7 WEB-CLI · the server and client profiles

admin@TR7LBWAF01> lb pki-profile add name internal-server usage server \

--lifetimeDays 90 --renewBeforeDays 15 --eku.0 serverAuth --keyAlgo ecP256

 

admin@TR7LBWAF01> lb pki-profile add name internal-client usage client \

--lifetimeDays 365 --eku.0 clientAuth

 

# the profile is selected in the internal creation

admin@TR7LBWAF01> lb certificate issue-internal name internal-service caId <intermediate-ca> profileId <profile> cn servis.kurum.local

admin@TR7LBWAF01>  

Things to Know

• The profile is selected during the creation. In the lb certificate issue-internal command it is written in the profileId field.
• The usage area has to be compatible with the CA. In an intermediate CA that will create server certificates a usage server profile is selected, and in a CA that will create client certificates a usage client profile.
• The renewal threshold has to be smaller than the lifetime. The --renewBeforeDays value should be selected smaller than the --lifetimeDays value; otherwise the certificate enters the renewal queue as soon as it is created.
• The name is unique. A second profile with the same name cannot be created.