Profiles (or issuance profiles)

Profiles are used to define rules and settings for specific types of certificate requests and orders in ACME-ADCS via appsettings.Production.json. There are essentially two ways to select a profile:

1. via the profile query parameter in the ACME client request
2. by the ACME-ADCS server, based on the identifiers used in the certificate order and the priority of the configured profiles.

A profile contains the supported identifier types, validation rules and the settings for issuing certificates. The following profiles would allow issuing DNS and IP certificates for any account, or those with EAB specifically:

{
  // ...
  "Profiles": {
    // A sample for a DNS and IP profile, the name 'Default' is arbitrary, you can choose any name you like.
    "Default": {
      "SupportedIdentifiers": [
        "dns",
        "ip"
      ],
      "Priority": 10,
      // Optionally you can set allowed challenge-types:
      "AllowedChallengeTypes": {
        "dns": [
          "dns-01"
        ],
        "ip": [
          "http-01"
        ]
      },
      "CertificateServices": [
        {
          "CAServer": "adcs.th11s.corp\\cert-authority-1",
          "TemplateName": "acme-template"
        }
      ]
    },
    "Default-High-Prio": {
      "SupportedIdentifiers": [
        "dns",
        "ip"
      ],
      "Priority": 100,
      // Optionally you can set allowed challenge-types:
      "AllowedChallengeTypes": {
        "dns": [
          "dns-01"
        ],
        "ip": [
          "http-01"
        ]
      },
      "CertificateServices": [
        {
          "CAServer": "adcs.th11s.corp\\cert-authority-1",
          "TemplateName": "acme-template"
        }
      ]
    },
    // A sample for a DNS and IP profile, the name 'Default' is arbitrary, you can choose any name you like.
    "Default-EAB": {
      "SupportedIdentifiers": [
        "dns"
      ],
      "Priority": 10,
      // Optionally you can set allowed challenge-types:
      "AllowedChallengeTypes": {
        "dns": [
          "dns-01"
        ],
        "ip": [
          "http-01"
        ]
      },
      "RequiresExternalAccountBinding": true,
      "CertificateServices": [
        {
          "CAServer": "adcs.th11s.corp\\cert-authority-1",
          "TemplateName": "acme-rsa-template",
          "KeyTypes": [
            "RSA"
          ]
        },
        {
          "CAServer": "adcs.th11s.corp\\cert-authority-1",
          "TemplateName": "acme-ecdsa-template",
          "KeyTypes": [
            "ECDSA"
          ]
        }
      ]
    }
  }
  // ... 
}

Profile preference

If the client did not request a specific profile the server will pick one, which it deems most fitting. The server will order the profiles and pick the first on of that ordered list:

• First order by priority (descending, e.g. higher priorities will be picked first)
• Then order by EAB requirement (candidate profiles that require EAB first)
• Then order by supported identifier count (prefer profiles with minimal required identifiers)
• Then order by profile name

Allowed challenge types

Foreach identifier you can also define the allowed challenge types. This list shows all identifer types as well as their supported challenge types. Defaults are printed bold. Challenges not listed as allowed will not be available during order validation.

• dns, e.g www.example.com
  • http-01
  • dns-01
  • tls-alpn-01
  • dns-persist-01
• dns (wildcard), e.g *.example.com
  • dns-01
  • dns-persist-01
• ip, e.g. 10.94.95.96
  • http-01
  • tls-alpn-01
• permanent-identifier
  • device-attest-01

Identifier validation

The profile selection process will run the identifier validation and only select profiles which match the parameters, e.g. if you want to use different CAs depending on DNS names, you could do something like this:

{
  // ...
  "Profiles": {
    "DNS-A": {
      "SupportedIdentifiers": [
        "dns"
      ],
      "IdentifierValidation": {
        "DNS": {
          "AllowedDNSNames": [
            ".sub-a.example.com"
          ]
        }
      },
      "CertificateServices": [
        {
          "CAServer": "adcs.th11s.corp\\cert-authority-1",
          "TemplateName": "acme-template"
        }
      ]
    },
    "DNS-B": {
      "SupportedIdentifiers": [
        "dns"
      ],
      "IdentifierValidation": {
        "DNS": {
          "AllowedDNSNames": [
            ".sub-b.example.com"
          ]
        }
      },
      "CertificateServices": [
        {
          "CAServer": "adcs.th11s.corp\\cert-authority-1",
          "TemplateName": "acme-template"
        }
      ]
    }
  }
  // ...
}

Device-Attest-01 (experimental)

A profile for device-attest-01 challenges could look like this: Device-Attest-01 is a little bit more involved, since it allows remote validation via an POST reqeuest and needs to be configured with the Apple root certificate. Currently, the device-attest-01 challenge is not standardized, so this profile is experimental and may change in the future - also it only supports the Apple device-attest-01 challenges.

If you are interested in android support or tpm support, please open an issue on the GitHub repository.

  "Profiles": {
    "DeviceAttestProfile": {
      "SupportedIdentifiers": [ "permanent-identifier" ],
      "RequireExternalAccountBinding": true,
      "IdentifierValidation": {
        "PermanentIdentifier": {
          "ValidationRegex": "^[a-zA-Z0-9]{32,64}$"
        }
      },
      "ChallengeValidation": {
        "DeviceAttest01": {
          "RemoteValidationUrl": "https://device-attest-validation.example.com",
          "Apple": {
            "RootCertificates": [
              "MIICJDCC...gN/r"
            ]
          }
        }
      },
      "ADCSOptions": {
        "CAServer": "CA.FQDN.com\\CA Name",
        "TemplateName": "Device-Attest-Template"
      }
    }
  }