Custom Extension: Set extension value via CMP

[frankschierle]

Hi there,

we are using EJBCAs CMP endpoint to issue certificates. No we have to add a new custom X509 extension to our certificates. The value of the extension is not static and should be provided in the certificate request.

In EJBCA we added an new custom extension of type DERUTF8STRING in System configuration -> Custom Certificate Extensions:

(OID 1.2.3.4 is just used for testing puposes in my local environment. A proper OID will be used later)

The certificate profile is configured to include the new extension and Custom certificate extension data is enabled in the end entity profile.

We added the extension to the Cert Template of our CMP certificate request. However, the issued certificate always includes the default value, defined in the screenshot above. If i specify the Custom certificate extension data at the end entity manually and issue a certificate via RA web, the correct value (as specified in Custom certificate extension data) is included in the certificate.

I had a look in source code and it looks like, EJBCA only respects the KeyUsage extension. All other extensions will be ignored:

ejbca-ce/modules/cesecore-ejb/src/org/cesecore/certificates/certificate/CertificateCreateSessionBean.java

Lines 211 to 225 in 0966b42

	final Extensions exts = requestMessage.getRequestExtensions(); // Optionally requested extensions
	int keyusage = -1;
	if (exts != null) {
	if (log.isDebugEnabled()) {
	log.debug("we have extensions, see if we can override KeyUsage by looking for a KeyUsage extension in request");
	}
	final KeyUsage keyUsage = KeyUsage.fromExtensions(exts);
	if (keyUsage!=null) {
	final DERBitString bitString = (DERBitString) keyUsage.toASN1Primitive();
	keyusage = bitString.intValue();
	if (log.isDebugEnabled()) {
	log.debug("We have a key usage request extension: " + keyusage);
	}
	}
	}

How can we specify the value of our custom extension in a CMP certificate request? Or is it not possible?

Thank you for your help!

[primetomas]

If you want to send in the extension in the request, you do not need to configure custom extensions. You would use the "Allow Extension Override" function in the certificate profiles. That function specifies what extensions will be grabbed directly from the CSR.

[frankschierle]

Thank you very much! It works perfectly!

I didn't think it would be that simple.

[primetomas]

Oh, PKI is very simple ;-)