infrared — Certificate Profile Validator

Submit a Certificate Profile

Profile:

// Certs 'R Us -- CA/Browser Forum TLS BR Organization Validated (OV) Subscriber Certificate profile
// ---------------------------------------------------------------------------------------------------
// This profile is a complete, machine-checked policy for the OV TLS certificates the fictional issuer
// "Certs 'R Us" CA issues under the CA/Browser Forum TLS Baseline Requirements.
{
  type: "certificate",
  name: "ov-tls-br-subscriber-certificate",
  version: "1.0.0",
  description: "OV certificates issued in compliance with the TLS BR",
  org: "certs-r-us",
  spec: "ov-subscriber",

// The demo website doesn't demonstrate the $includes mechanism for security reasons, but definitions ($defs) and
  // snippets can be shared and reused across profiles.
  // $includes: ["rfc5280.json5", "cabforum-tls-br.json5", "certs-r-us-common.json5"],
  $defs: {
    // DER encoding of the SHA-256 with RSA encryption algorithm identifier
    sha256WithRsaEncryption: "300d06092a864886f70d01010b0500",
    // DER encoding of the RSA encryption algorithm identifier
    rsaEncryption: "300d06092a864886f70d0101010500",
    // CA/Browser Forum Reserved Certificate Policy Identifier for Organization Validated certificates.
    cabfOrganizationValidatedPolicyOid: "2.23.140.1.2.2",
    // id-kp-serverAuth (RFC 5280 §4.2.1.12).
    "id-kp-serverAuth": "1.3.6.1.5.5.7.3.1",
    "UTF8String": "0c",
    "OrgName": "Certs 'R Us",

// Shared issuer DN, spliced into content.issuer below via $use.
    issuerDn: {
      rdns: [
        { countryName: { valueEq: "US" } },
        // Certs 'R Us-operated CAs always use the same organization name, and UTF8String encoding is always used
        { organizationName: { valueEq: "%OrgName%", tags: ["%UTF8String%"] } },
        // Certs 'R Us issues OV certificates from multiple issuers, so the commonName field is unrestricted.
        { commonName: {} },
      ],
    },
  },

content: {
    version: { valueEq: "v3" },
    serialNumber: { description:  "Generated according to TLS BR 7.1." },
    signatureAlgorithm: { algorithms: ["%sha256WithRsaEncryption%"] },
    signatureValue: { },

// Example Corp's policy instead caps the validity period's length: 7 days
    // (86400 * 7 seconds), the current CA/Browser Forum short-lived-certificate ceiling.
    validity: {
      validityPeriodSecs: { valueLte: 604800 },
    },

subjectPublicKey: {
      // Example Corp's policy allows RSA keys only.
      algorithm: { algorithms: ["%rsaEncryption%"] },
      rsa: {
        // RSA modulus length must be 2048, 3072, or 4096 bits.
        modulusLength: { valueOneOf: [ { eq: 2048 }, { eq: 3072 }, { eq: 4096 }] },
        // RSA public exponent must be 65537.
        exponent: { valueEq: 65537 },
      },
    },

issuer: { $use: "issuerDn" },

// BR section 7.1.2.7.4 requires countryName and organizationName on an OV Subject. This certificate also
    // carries stateOrProvinceName and localityName to place the organization, plus up to two streetAddress
    // attributes (optional).
    subject: {
      rdns: [
        { countryName: { } },
        { stateOrProvinceName: { } },
        { localityName: { } },
        { streetAddress: { alwaysPresent: false } },
        { streetAddress: { alwaysPresent: false } },
        { organizationName: { } },
      ],
    },

extensions: {
      // if the CA doesn't want to enforce an ordering on the encoding, it can set ordered to false:
      // ordered: false,
      entries: [
        { basicConstraints: { critical: true, ca: false } },
        {
          keyUsage: {
            critical: true,
            bits: [{ bit: "digitalSignature" }],
          },
        },
        {
          authorityKeyIdentifier: {
            critical: false,
            // Since OV certificates are issued by multiple issuers, the keyIdentifier is unrestricted.
            keyIdentifier: { },
          },
        },
        {
          certificatePolicies: {
            critical: false,
            policies: [{ policyIdentifier: "%cabfOrganizationValidatedPolicyOid%" }],
          },
        },
        {
          authorityInformationAccess: {
            critical: false,
            accessDescriptions: [
              // Certs R Us uses http://ocsp.certsrus.com for OCSP responses for all issuers.
              { method: "ocsp", accessLocation: { type: "uniformResourceIdentifier", valueEq: "http://ocsp.certsrus.com" } },
              // Certs R Us uses http://issuer.certsrus.com/ for CA certificates.
              {
                method: "caIssuers",
                accessLocation: { type: "uniformResourceIdentifier", valueStartsWith: "http://issuer.certsrus.com/" }
              },
            ],
          },
        },
        {
          extendedKeyUsage: {
            critical: false,
            // OV certificates are issued for TLS server authentication (required) and no other purposes
            purposes: [{ oid: "%id-kp-serverAuth%" }],
          },
        },
        {
          crlDistributionPoints: {
            critical: false,
            distributionPoints: [
              {
                distributionPoint: {
                  // CRLs are published at http://crl.certsrus.com/
                  fullName: { exact: [{ type: "uniformResourceIdentifier", valueStartsWith: "http://crl.certsrus.com/" }] },
                },
              },
            ],
          },
        },
        {
          subjectAltName: {
            critical: false,
            names: {
              // The profile only allows non-wildcard DNS names. Up to 5 names are allowed.
              pattern: { type: "dNSName", valueMatch: "^[^*].+" },
              size: { max: 5 },
            },
          },
        },
        // Pre-certificates will have the precert poison extension, final certificates will have the sctList extension.
        {
          precertificatePoison: {
            critical: true,
            alwaysPresent: false
          },
        },
        {
          sctList: {
            critical: false,
            alwaysPresent: false,
          }
        }
      ],
    },
  },
}

Paste JSON5 profile text, or drag and drop a .json5/.json file onto the box. $includes aren't supported here, so put everything in one document.

Profile file:

Certificate:

Paste PEM or base64 certificate text, or drag and drop a PEM/DER file in the text box.

File:

or try an example:

Certificate Profile Validation Results

No findings — conformant.

Certificate Details (powered by pv-certificates-viewer)

Loading certificate viewer…

Eliminate profile drift at your CA

Want to discuss deploying single source of truth profiles at your CA to streamline operations and eliminate risk?

Contact Me