Skip to content

Certificate types & profiles

The specialized certificate shapes the CA can issue.

Beyond ordinary TLS server and client certificates, secsy-pki ships profiles for identity, e-mail, regulated and post-quantum use cases. Each page covers the profile, the extensions that define it, the policy controls that scope who may request it, and the interoperability caveats.

Guide Covers
S/MIME e-mail protection Mailbox-validated S/MIME certificates: the smime/smime-sign/smime-encrypt profiles, RFC 5321/6531 mailbox validation + punycode normalization of rfc822Name SANs, per-profile & per-tenant e-mail domain allowlists, the CA/B Forum S/MIME Baseline Requirements lint rules (smime_* checks, enforce/warn per profile), dual-key sign/encrypt deployment with encryption-key escrow, EST/SCEP enrollment, and openssl smime interop
Smartcard-logon & Kerberos PKINIT Microsoft Windows smartcard-logon and Kerberos PKINIT client-auth certificates for Active Directory: the smartcard-logon/pkinit-client/smartcard-pkinit profiles, the id-ms-UPN (1.3.6.1.4.1.311.20.2.3) User Principal Name otherName SAN + msSmartcardLogon/pkinitClientAuth EKUs, per-profile & per-tenant realm allowlists, -upn CLI flag / upns REST+gRPC field / console field / EST-SCEP CSR extraction, cert.upn audit + metrics, and Go + openssl asn1parse known-answer encoding tests
eIDAS qualified certificates (ETSI EN 319 412-5) EU qualified-certificate semantics via the non-critical id-pe-qcStatements extension (1.3.6.1.5.5.7.1.3): QcCompliance, QcType (esign/eseal/web), QcSSCD, QcRetentionPeriod, QcPDS, and the ETSI TS 119 495 PSD2 QcStatement (PSP roles + NCA name/id); the qualified-esign/qualified-eseal/qualified-web (QWAC) profiles, the per-profile qcstatements: config block, per-request PSD2 override (-psd2-role/-psd2-nca-* CLI, psd2 REST/gRPC field) gated by allow_psd2_override, certlint recognition, CT-safe hand-rolled ASN.1, and a known-answer + openssl x509 -text parse test
SPIFFE SVID workload identity HSM-backed SPIFFE workload identities, both X.509-SVID and JWT-SVID: the short-lived spiffe-svid profile (single spiffe:// URI SAN, CA:false, digitalSignature), POST /api/ca/{id}/svid + secsy-ca svid, the trust-domain allowlist (RBAC-layered), fraction-based short-TTL auto-renewal, the JWKS trust-bundle endpoint, and go-spiffe / SPIRE integration
TLS Delegated Credentials (RFC 9345) Certificates eligible to authorize short-lived TLS delegated credentials via the non-critical id-ce-delegationUsage extension (1.3.6.1.4.1.44363.44, NULL): the delegation_usage per-profile opt-in + built-in server-delegation profile, the fail-closed mutual exclusion with OCSP Must-Staple (RFC 9345 §4.2), the operator-holds-the-leaf-key constraint, secsy-ca delegated-credential mint/verify (offline, operator-held key), POST /api/ca/{id}/delegated-credential (recovers an escrowed PKCS#12 leaf key via an M-of-N quorum), the ≤7-day valid_time cap, RSASSA-PSS-only RSA signing, cert.delegated_credential audit + metrics, and openssl asn1parse DER + sign/verify round-trip tests
Post-quantum & hybrid certificates ML-DSA (FIPS 204) signatures on the CA/issuance paths: pure-PQC and catalyst-hybrid (classical + ML-DSA alternative-signature) certificates, per-profile algorithm selection (pqc-server/hybrid-server), the software-provider fallback for SoftHSM, secsy-ca init-root -algorithm pqc\|hybrid, chain verification, and the interop / trust-store caveats

↩ Back to the documentation map · project README