User interface generation in view of constraints of a certificate profile

A method comprising:

• receiving user input at a first processing device that selects one of a plurality of certificate profiles for requesting a certificate, wherein each of the plurality of certificate profiles defines a set of defaults of the certificate's contents and a set of constraints for values associated with the certificate's contents contained in the certificate, wherein the set of constraints comprises a key-type constraint that specifies one or more permissible key types for a key contained in the certificate and a renewal grace period constraint;
• determining, by the first processing device, whether a second processing device of the user requesting the certificate supports the one or more permissible key types;
• generating, by the first processing device, an enrollment page with a profile enrollment form using the set of defaults and the set of constraints associated with the selected certificate profile, wherein the generating the enrollment page comprises generating the profile enrollment form to include an input mechanism that only displays the key types that are supported by the second processing device so that a user requesting the certificate is unable to request a key type that is not supported by the second processing device;
• presenting, by the first processing device, the enrollment page with the profile enrollment form to the user;
• responsive to the user selection of one of the key types presented in the enrollment form, sending a request for information about the key type to a browser of a client;
• receiving the requested information about the selected key type from the browser of the client;
• responsive to receiving the requested information about the selected key type from the browser of the client, determining whether the client supports the selected key type in view of the requested information from the browser;
• receiving the profile enrollment form from the user with input provided by the user;
• generating an enrollment request for the certificate using the profile enrollment form and the input provided by the user in connection with the profile enrollment form;
• and
• sending the enrollment request to a certificate system (CS) subsystem to authenticate, authorize and issue the certificate, wherein the enrollment request complies with the set of constraints of the selected certificate profile before sending the enrollment request to the CS subsystem, and wherein the enrollment request specifies a selection of one of the key types that are supported by the second processing device before sending the enrollment request to the CS subsystem.

A certificate system, comprising:

• a data storage device to store records of a plurality of certificate profiles, wherein each of the plurality of certificate profiles defines a set of defaults of a certificate's contents and a set of constraints for values associated with the certificate's contents contained in the certificate, wherein the set of constraints comprises a renewal grace period constraint and a key type constraint that specifies one or more permissible key types for a key contained in the certificate;
• and
• a certificate manager, coupled to the data storage device, to receive user input that selects one of the plurality of certificate profiles for requesting a certificate, to generate an enrollment page with a profile enrollment form using the set of defaults and the set of constraints associated with the selected certificate profile, and to present the enrollment page with the profile enrollment form to a user at a client, wherein the enrollment page is a web-based service page and the enrollment form is a Hypertext Transport Protocol (HTTP) based enrollment form, and wherein the certificate manager is to generate the enrollment page by:
• retrieving a template file associated with the selected certificate profile for the enrollment form;
• modifying the template file according to the set of constraints associated with the selected certificate profile so that a user requesting the certificate is unable to request a certificate that does not comply with the set of constraints of the selected certificate profile, and
• wherein the certificate manager is further to:
• receive the profile enrollment form from the user with input provided by the user;
• generate an enrollment request for the certificate using the profile enrollment form and the input provided by the user in connection with the profile enrollment form;
• send the enrollment request to a certificate system (CS) subsystem to authenticate, authorize and issue the certificate, wherein the enrollment request complies with the set of constraints of the selected certificate profile before sending the enrollment request to the CS subsystem;
• and wherein the key type constraint is checked at the client by:
• responsive to a user selection of one of the key types presented in the enrollment form, sending a request for information about the key type to a browser of the client;
• receiving the requested information about the selected key type from the browser of the client;
• and
• responsive to receiving the requested information about the selected key type from the browser of the client, determining whether the client supports the selected key type in view of the requested information from the browser.

A non-transitory machine-readable storage medium having instructions, which when executed, cause a processing device to execute operations comprising:

• receiving user input that selects one of a plurality of certificate profiles for requesting a certificate, wherein each of the plurality of certificate profiles defines a set of one or more defaults of the certificate's contents and a set of constraints for values associated with the certificate's contents contained in the certificate, wherein the set of constraints comprises a renewal grace period constraint and a key type constraint that specifies one or more permissible key types for a key contained in the certificate;
• generating, by the processing device, an enrollment page with a profile enrollment form using the set of defaults and the set of constraints associated with the selected certificate profile, wherein the enrollment page is a web-based service page and the enrollment form is a Hypertext Transport Protocol (HTTP) based enrollment form, and wherein the generating the enrollment page comprises:
• retrieving a template file associated with the selected certificate profile for the enrollment form;
• modifying the template file according to the set of constraints associated with the selected certificate profile so that a user requesting the certificate is unable to request a certificate that does not comply with the set of constraints of the selected certificate profile;
• and
• presenting, by the processing device, the enrollment page with the profile enrollment form to the user at a client;
• receiving the profile enrollment form from the user with input provided by the user;
• generating an enrollment request for the certificate using the profile enrollment form and the input provided by the user in connection with the profile enrollment form;
• sending the enrollment request to a certificate system (CS) subsystem to authenticate, authorize and issue the certificate, wherein the enrollment request complies with the set of constraints of the selected certificate profile before sending the enrollment request to the CS subsystem;
• and wherein the key type constraint is checked at the client by:
• responsive to a user selection of one of the key types presented in the enrollment form, sending a request for information about the key type to a browser of the client;
• receiving the requested information about the selected key type from the browser of the client;
• and
• responsive to receiving the requested information about the selected key type from the browser of the client, determining whether the client supports the selected key type in view of the requested information from the browser.