Struct EnrollmentProfile 

pub struct EnrollmentProfile {

    pub name: String,
    pub max_validity_days: u32,
    pub key_usage: Vec<String>,
    pub extended_key_usage: Vec<String>,
    pub include_ski: bool,
    pub include_aki: bool,
    pub min_rsa_bits: u32,
    pub min_ecdsa_curve: String,
    pub ct_enabled: bool,
    pub allowed_ml_dsa_levels: Vec<String>,
    pub allowed_ml_kem_levels: Vec<String>,
    pub allow_composite_ml_dsa: bool,
    pub require_dual_cert: bool,
    pub must_staple: bool,
}

Enrollment profile defining constraints for issued certificates.

Supports classical (RSA, ECDSA), post-quantum (ML-DSA, ML-KEM), and composite hybrid algorithms for PQC migration scenarios.

Fields

name: String

Profile name (referenced in OTP records and EST label config).

max_validity_days: u32

Maximum validity period in days.

key_usage: Vec<String>

Key usage flags to set (e.g., digitalSignature, keyEncipherment).

extended_key_usage: Vec<String>

Extended key usage OIDs (e.g., serverAuth, clientAuth).

include_ski: bool

Whether to include Subject Key Identifier.

include_aki: bool

Whether to include Authority Key Identifier.

min_rsa_bits: u32

Minimum RSA key size in bits.

min_ecdsa_curve: String

Minimum ECDSA curve (P-256, P-384).

ct_enabled: bool

Whether to inject Certificate Transparency SCTs.

allowed_ml_dsa_levels: Vec<String>

Allowed ML-DSA levels for signing key CSRs (FIPS 204). Empty means ML-DSA is not accepted for this profile. Values: “ml-dsa-44”, “ml-dsa-65”, “ml-dsa-87”.

allowed_ml_kem_levels: Vec<String>

Allowed ML-KEM levels for KEM key CSRs (FIPS 203). Used with /serverkeygen for KRA-based key generation. Values: “ml-kem-512”, “ml-kem-768”, “ml-kem-1024”.

allow_composite_ml_dsa: bool

Whether to accept composite ML-DSA+classical CSRs. Per draft-ietf-lamps-pq-composite-sigs-19.

require_dual_cert: bool

Require dual certificates (paired legacy + PQC) for hybrid migration scenarios per IDM-5563 lifecycle requirements. When true, a classical enrollment triggers automatic paired PQC enrollment (and vice versa) as linked certificates.

must_staple: bool

Include the TLS Feature Extension (RFC 7633, OID 1.3.6.1.5.5.7.1.24) in issued certificates.

RFC 7633 Section 4: when set, the issued certificate declares that the TLS server presenting it MUST provide an OCSP stapled response (status_request, TLS extension type 5) during the TLS handshake. Clients that understand this extension MUST abort the handshake if the server fails to staple a valid OCSP response.

This is required for NIAP CA PP compliance and is commonly referred to as “must-staple”.

When true, the certificate will contain:

TLS Feature Extension (id-pe-tlsfeature):
  OID:   1.3.6.1.5.5.7.1.24
  Value: SEQUENCE { INTEGER 5 }   -- status_request

Default: false.

Trait Implementations

impl Clone for EnrollmentProfile

fn clone(&self) -> EnrollmentProfile

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for EnrollmentProfile

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for EnrollmentProfile

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for EnrollmentProfile

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for EnrollmentProfile

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.