// Certs 'R Us -- CA/Browser Forum TLS BR Organization Validated (OV) Subscriber Certificate profile
// ---------------------------------------------------------------------------------------------------
// This profile is a complete, machine-checked policy for the OV TLS certificates the fictional issuer
// "Certs 'R Us" CA issues under the CA/Browser Forum TLS Baseline Requirements.
{
  $schema: "https://infrared.turbolightsolutions.com/infrared-profile-2026-10-23.schema.json",
  type: "certificate",
  name: "ov-tls-br-subscriber-certificate",
  version: "1.0.0",
  description: "OV certificates issued in compliance with the TLS BR",
  org: "certs-r-us",
  spec: "ov-subscriber",

  // Includes are allowed: see the list in the "Available $includes" dropdown. Definitions ($defs) and snippets can
  // be shared and reused across profiles.
  $includes: ["stdlib/rfc5280.json5", "stdlib/pkix-algorithms.json5", "stdlib/cabforum-tls-br.json5"],
  $defs: {
    "UTF8String": "0c",
    "OrgName": "Certs 'R Us",

    // Shared issuer DN, spliced into content.issuer below via $use.
    issuerDn: {
      rdns: [
        { countryName: { valueEq: "US" } },
        // Certs 'R Us-operated CAs always use the same organization name, and UTF8String encoding is always used
        { organizationName: { valueEq: "%OrgName%", tags: ["%UTF8String%"] } },
        // Certs 'R Us issues OV certificates from multiple issuers, so the commonName field is unrestricted.
        { commonName: {} },
      ],
    },
  },

  content: {
    version: { valueEq: "v3" },
    serialNumber: { description:  "Generated according to TLS BR 7.1." },
    signatureAlgorithm: { algorithms: ["%sha256WithRSAEncryption%"] },
    signatureValue: { },

    // Example Corp's policy instead caps the validity period's length: 7 days
    // (86400 * 7 seconds), the current CA/Browser Forum short-lived-certificate ceiling.
    validity: {
      validityPeriodSecs: { valueLte: 604800 },
    },

    subjectPublicKey: {
      // Example Corp's policy allows RSA keys only.
      algorithm: { algorithms: ["%rsaEncryption%"] },
      rsa: {
        // RSA modulus length must be 2048, 3072, or 4096 bits.
        modulusLength: { valueOneOf: [ { eq: 2048 }, { eq: 3072 }, { eq: 4096 }] },
        // RSA public exponent must be 65537.
        exponent: { valueEq: 65537 },
      },
    },

    issuer: { $use: "issuerDn" },

    // BR section 7.1.2.7.4 requires countryName and organizationName on an OV Subject. This certificate also
    // carries stateOrProvinceName and localityName to place the organization, plus up to two streetAddress
    // attributes (optional).
    subject: {
      rdns: [
        { countryName: { } },
        { stateOrProvinceName: { } },
        { localityName: { } },
        { streetAddress: { alwaysPresent: false } },
        { streetAddress: { alwaysPresent: false } },
        { organizationName: { } },
      ],
    },

    extensions: {
      // if the CA doesn't want to enforce an ordering on the encoding, it can set ordered to false:
      // ordered: false,
      entries: [
        { basicConstraints: { critical: true, ca: false } },
        {
          keyUsage: {
            critical: true,
            bits: [{ bit: "digitalSignature" }],
          },
        },
        {
          authorityKeyIdentifier: {
            critical: false,
            // Since OV certificates are issued by multiple issuers, the keyIdentifier is unrestricted.
            keyIdentifier: { },
          },
        },
        {
          certificatePolicies: {
            critical: false,
            policies: [{ policyIdentifier: { valueEq: "%cabf-organization-validated%" } }],
          },
        },
        {
          authorityInformationAccess: {
            critical: false,
            accessDescriptions: [
              // Certs R Us uses http://ocsp.certsrus.com for OCSP responses for all issuers.
              { accessMethod: { valueEq: "%id-ad-ocsp%" }, accessLocation: { type: "uniformResourceIdentifier", valueEq: "http://ocsp.certsrus.com" } },
              // Certs R Us uses http://issuer.certsrus.com/ for CA certificates.
              {
                accessMethod: { valueEq: "%id-ad-caIssuers%" },
                accessLocation: { type: "uniformResourceIdentifier", valueStartsWith: "http://issuer.certsrus.com/" }
              },
            ],
          },
        },
        {
          extendedKeyUsage: {
            critical: false,
            // OV certificates are issued for TLS server authentication (required) and no other purposes
            purposes: [{ valueEq: "%id-kp-serverAuth%" }],
          },
        },
        {
          crlDistributionPoints: {
            critical: false,
            distributionPoints: [
              {
                distributionPoint: {
                  // CRLs are published at http://crl.certsrus.com/
                  fullName: { exact: [{ type: "uniformResourceIdentifier", valueStartsWith: "http://crl.certsrus.com/" }] },
                },
              },
            ],
          },
        },
        {
          subjectAltName: {
            critical: false,
            names: {
              // The profile only allows non-wildcard DNS names. Up to 5 names are allowed.
              pattern: { type: "dNSName", valueMatch: "^[^*].+" },
              size: { max: 5 },
            },
          },
        },
        // Pre-certificates will have the precert poison extension, final certificates will have the sctList extension.
        {
          precertificatePoison: {
            critical: true,
            alwaysPresent: false
          },
        },
        {
          sctList: {
            critical: false,
            alwaysPresent: false,
          }
        }
      ],
    },
  },
}