OID management

[Olivier G]

Hi everybody,

I have read the documentation and some answers of this mailing list but things are stil unclear. Can you confirm (or not) my understanding of FreeIPA OIDs management:
 * FreeIPA does not allow to add a specific PEN number to its own root CA.
 * FreeIPA (as rootCA) allows to add PEN number to its SubCA thanks to certprofile (which are propagated to the final certificate).
 * FreeIPA used as SubCA keeps and manage specific PEN number 'given' by the root CA.

Thanks in advance for reading,
Olivier

[Alexander Bokovoy]

On Mon, 07 Sep 2026, Olivier G via FreeIPA-users wrote:
> Hi everybody,
>
> I have read the documentation and some answers of this mailing list but
> things are stil unclear. Can you confirm (or not) my understanding of
> FreeIPA OIDs management:
> FreeIPA does not allow to add a specific PEN number to its own root
>
> CA.
> FreeIPA (as rootCA) allows to add PEN number to its SubCA thanks to
>
> certprofile (which are propagated to the final certificate).
> FreeIPA used as SubCA keeps and manage specific PEN number 'given'
>
> by the root CA.

Can you explain what specifically you are looking at? There is no such
thing as 'OID management' in FreeIPA.

Are you trying to add an extension to certificates that includes
something not permitted anywhere? If so, you would need to create a
certificate profile that adds such extension. Then use the profile to
request a certificate, provided that a requester is permitted the use of
that profile against a specific CA (sub-CA).

See https://docs.redhat.com/en/documentation/red_hat_certificate_system/10/html-... for details on the certificate profile input and output (section A) and defaults (section B).

[Olivier G]

Thanks for your answer.

I would like to know the capability of FreeIPA in regards of configuring/adding a PEN (Private Enterprise Number managed by IANA) with the OID 1.3.6.1.4.1.<PEN> in the previously mentioned situation:

* FreeIPA does not allow to add a specific PEN number to its own root CA.
 * FreeIPA (as rootCA) allows to add PEN number to its SubCA thanks to certprofile (which are propagated to the final certificate).
 * FreeIPA used as SubCA keeps and manage specific PEN number 'given' by the root CA and forward it to its subCA (and final certificate).

Thanks in advance for reading,
Olivier

[Alexander Bokovoy]

On Mon, 07 Sep 2026, Olivier G via FreeIPA-users wrote:
> Thanks for your answer.
>
> I would like to know the capability of FreeIPA in regards of
> configuring/adding a PEN (Private Enterprise Number managed by IANA)
> with the OID 1.3.6.1.4.1.<PEN> in the previously mentioned situation:

Sorry, this still does not explain *how* you intend to use this OID
number in FreeIPA's certificates.

Certificates are x.509v3 structures, how do you envision to use that OID
number within x.509v3? Through which specific extension?

Can you be more specific? If you need to add a specific x.509v3
extension, then creating own certificate profile is the answer.

[Olivier G]

Thanks for your answer.

I'm not sure to understand correctly your question and as I'm not an X.509 expert, I apologize for any errors.

My understanding is that there is a standard X.509 mechanism with OID 2.5.29.32 (define in RFC 5280/ section 4.2.1.4) enabling to use the OID 1.3.6.1.4.1.<PEN> as policyInformation / policyIdentifier

OID 1.3.6.1.4.1 being standardly define as a private enterprise OID in RFC 2578 v2 section 4. It's also specified in the IANA web page (in the about) https://www.iana.org/assignments/enterprise-numbers/

Does it answer to your question ?

Thanks in advance for reading.
Olivier

[Alexander Bokovoy]

On Mon, 07 Sep 2026, Olivier G via FreeIPA-users wrote:
> Thanks for your answer.
>
> I'm not sure to understand correctly your question and as I'm not an
> X.509 expert, I apologize for any errors.
>
> My understanding is that there is a standard X.509 mechanism with OID
> 2.5.29.32 (define in RFC 5280/ section 4.2.1.4) enabling to use the OID
> 1.3.6.1.4.1.<PEN> as policyInformation / policyIdentifier

OK, so you are talking about certificate policies. Dogtag has support
for them but they aren't really documented well.

https://github.com/dogtagpki/pki/pull/447

The documentation link I gave earlier has some policy-related defaults
but not real documentation for how to use it. Please bring this to
Dogtag upstream and discuss there.