> Markdown version of https://docs.laavat.io/certtemplates/templates/ from the LAAVAT PKI and Signing Platform documentation. All pages: https://docs.laavat.io/llms.txt

# PKI Certificate profile examples

## Profile examples

- [Example](https://docs.laavat.io/certtemplates/endsigning-rsa-4096-SHA256-profile.yaml) of certificate profile used with RAUC signing as an End-Entity certicate.
    - Code signing certificate

- [Example](https://docs.laavat.io/certtemplates/subca-rsa-4096-SHA256-profile.yaml) of certificate profile used with RAUC signing as a Subordinate CA.

- [Example](https://docs.laavat.io/certtemplates/nxp-imx6-habv4-rootca-rsa-4096-SHA256-profile.yaml) of certificate profile (A)HAB Tree roots

- [Example](https://docs.laavat.io/certtemplates/nxp-imx6-habv4-subca-rsa-4096-SHA256-profile.yaml) of certificate profile (A)HAB Tree Subordinate CA. Usually SRK key.

- [Example](https://docs.laavat.io/certtemplates/nxp-imx6-habv4-endentity-rsa-4096-SHA256-profile.yaml) of certificate profile (A)HAB Tree End-Entity certificates. IMG, SGK or CSF

- [Example](https://docs.laavat.io/certtemplates/device-cert-root-rsa-2048-SHA256-profile.yaml) of certificate profile used with Device Certificates as an Issuing CA.

- [Example](https://docs.laavat.io/certtemplates/device-cert-endentity-rsa-2048-SHA256-profile.yaml) of certificate profile used with Device Certificates as an End-Entity certicate.
    - Enforcing unique DN is enabled. If certificate has been issued with same DN then issuance fails.
    - CRLDistributionPoints enabled
    - PolicyIdentifiers enabled
    - Validity period until 9999-12-31T23:59:59Z
    - Used with RSA keys.
    - Signature type is SHA256WithRSA

- [Example](https://docs.laavat.io/certtemplates/device-cert-endentity-ecdsa-p256-SHA256-profile-version1-EnUDNFalse.yaml) of certificate profile used with Device Certificates as an End-Entity certicate.
    - Enforcing unique DN is disabled
    - CRLDistributionPoints enabled
    - PolicyIdentifiers enabled
    - Validity period until 9999-12-31T23:59:59Z
    - Used with EC keys.
    - Signature type is ECDSAWithSHA256
- [Example](https://docs.laavat.io/certtemplates/device-cert-endentity-ecdsa-p256-SHA256-profile-version1-EnUDNTrue.yaml) of certificate profile used with Device Certificates as an End-Entity certicate.
    - Enforcing unique DN is enabled. If certificate has been issued with same DN then issuance fails.
    - CRLDistributionPoints enabled
    - PolicyIdentifiers enabled
    - Validity period until 9999-12-31T23:59:59Z
    - Used with EC keys.
    - Signature type is ECDSAWithSHA256
- [Example](https://docs.laavat.io/certtemplates/device-cert-endentity-ecdsa-p256-SHA256-profile-version1-no-enforcements.yaml) of certificate profile used with Device Certificates as an End-Entity certicate.
    - No enforcements. Same DN and or Public key can be used.
    - CRLDistributionPoints enabled
    - PolicyIdentifiers enabled
    - Validity period until 9999-12-31T23:59:59Z
    - Used with EC keys.
    - Signature type is ECDSAWithSHA256
- [Example](https://docs.laavat.io/certtemplates/device-cert-endentity-ecdsa-p256-SHA256-profile-version2-EnUDNFalse-EnUPKFalse.yaml) of certificate profile used with Device Certificates as an End-Entity certicate.
    - ProfileYamlVersion is 2 which enables more options
    - Enforcing unique DN is disabled. 
    - Enforcing unique Public Key is disabled.
    - CRLDistributionPoints enabled
    - PolicyIdentifiers enabled
    - Validity period until 9999-12-31T23:59:59Z
    - Used with EC keys.
    - Signature type is ECDSAWithSHA256
- [Example](https://docs.laavat.io/certtemplates/device-cert-endentity-ecdsa-p256-SHA256-profile-version2-EnUDNFalse-EnUPKTrue.yaml) of certificate profile used with Device Certificates as an End-Entity certicate.
    - ProfileYamlVersion is 2 which enables more options
    - Enforcing unique DN is disabled. 
    - Enforcing unique Public Key is enabled. If certificate has been issued with same Public Key then issuance fails.
    - CRLDistributionPoints enabled
    - PolicyIdentifiers enabled
    - Validity period until 9999-12-31T23:59:59Z
    - Used with EC keys.
    - Signature type is ECDSAWithSHA256
- [Example](https://docs.laavat.io/certtemplates/device-cert-endentity-ecdsa-p256-SHA256-profile-version2-EnUDNTrue-EnUPKFalse.yaml) of certificate profile used with Device Certificates as an End-Entity certicate.
    - ProfileYamlVersion is 2 which enables more options
    - Enforcing unique DN is enabled. If certificate has been issued with same DN then issuance fails.
    - Enforcing unique Public Key is disabled.
    - CRLDistributionPoints enabled
    - PolicyIdentifiers enabled
    - Validity period until 9999-12-31T23:59:59Z
    - Used with EC keys.
    - Signature type is ECDSAWithSHA256
- [Example](https://docs.laavat.io/certtemplates/device-cert-endentity-ecdsa-p256-SHA256-profile-version2.yaml) of certificate profile used with Device Certificates as an End-Entity certicate.
    - ProfileYamlVersion is 2 which enables more options
    - Enforcing unique DN is enabled. If certificate has been issued with same DN then issuance fails.
    - Enforcing unique Public Key is enabled. If certificate has been issued with same Public Key then issuance fails.
    - CRLDistributionPoints enabled
    - PolicyIdentifiers enabled
    - Validity period until 9999-12-31T23:59:59Z
    - Used with EC keys.
    - Signature type is ECDSAWithSHA256

## Profile versions

Currently there are 2 versions of profiles. Version 2 supports more options regarding the uniqueness checking.

```yaml
# Config file for the End-Entity profile. Do not use TABS
---
ProfileYamlVersion: 2
```