Step 2: Create the Certificate Profile for SubCAs in Node B

In this step, we create a Certificate Profile for the SubCAs in (Node B). These SubCAs are created in another EJBCA Hardware Appliance (Node A). This profile is used when the RootCA signs the SubCA’s certificate.

1. Open EJBCA Enterprise.

2. In the sidebar, in the CA Functions section, select Certificate Profiles.

3. For the SUBCA profile click Clone:

   
   
   
   

   
   

4. Set Name of new certificate profile to SubCACertificateProfile.
   

5. Click Create from template.

   
   
   
   

   
   

6.  In the List of Certificate Profiles click Edit for SubCACertificateProfile:
   

   
   
   
   

   
   

7. In the Edit form, make the following settings:

   • Available bit lengths: Select 4096 only
     
   • Validity or end date of the certificate: Set to 5y
   • Path Length Constraint: Enable and set Value to 0
   • Key Usage: Enable Key certificate sign and CRL sign.
   • Available CAs (in section Other data): Select RootCA

   
   

8. Click Save to proceed.