Summary: ILM request attributes allow an RA profile to declare what a certificate request requires, where each value comes from, and what a client can never set. This way, the requester completes a short form instead of learning PKI, and the trust guarantees remain exactly where they were.
Nobody wants a certificate. They want what stops working without it. Every additional question you ask is a cost you’re imposing through your own policy.
Consider what a developer typically faces when requesting an internal certificate. Which template? Which algorithm and key size? Which extensions, with what key usages? What should the subject include, and in what order? Which of the various types of subject alternative names applies here?
Every question has a correct answer. However, the developer is rarely the one who knows it. So the answer is usually found by copying a previous request, asking a colleague, or guessing. Then the request is rejected, and the cycle repeats.
Meanwhile, the PKI team is being blamed for being slow. In reality, they are being asked to oversee decisions that were never the applicant’s responsibility.
What do the request attributes actually declare?
Now, an AR profile in ILM can include a request attributes configuration. That configuration is a policy statement, not a form definition. It specifies what attributes a request has and links each attribute to a value source.
These links are the important part. A value can be collected from the applicant, derived by the platform, or set by policy. Consequently, the profile codifies three different types of knowledge that previously resided on a wiki page.
| Source of value | Who decides | Typical example |
|---|---|---|
| Compiled | The applicant | The hostname for which the certificate is issued |
| Derivative | The platform | Owner and group, taken from the authenticated identity |
| Set by policy | The PKI team, just once | Key algorithm, key usage, extension set |
Read the table as a division of labor. The applicant is only asked what they actually know. Everything else is either derived or already decided.
Politics extends even to the application itself.
A form that collects the correct values only solves half the problem. Those values must then be correctly submitted to the certificate signing request.
ILM projects attribute field mappings onto the generated PKCS#10 request. Therefore, the CSR reflects the profile policy rather than what a client library might have assembled. The subject and extensions are constructed from the same declaration completed by the requester.
Uploaded requests receive the same treatment. If you provide your own CSR, ILM validates it against the RA profile’s request attributes policy instead of simply accepting it. Additionally, a request can be registered first and issued later, so pre-registration and issuance are separate steps when a workflow requires it.
Errors that a protocol client can act upon
This is the detail that determines whether the whole process feels seamless. Most certificate requests don’t even come from a person. They come from ACME, EST, SCEP, or CMP clients running unattended.
When a customer like this violates the policy, a generic error message is useless. The customer can’t interpret it, can’t retry in a meaningful way, and can’t provide any actionable information. Someone ends up reading the log days later.
ILM translates request attribute policy violations into native ACME, EST, SCEP, and CMP errors. Because the error is presented in the protocol’s own vocabulary, the client can behave correctly. Furthermore, the request attribute set can be resolved using the CSR attributes endpoint, allowing a client to check what is expected before composing anything.
Asking the platform what it needs is a better protocol than guessing and being rejected.
Extensions without custom code
Certificate extensions are a common reason why organizations end up maintaining custom tools. A policy needs a custom extension, and suddenly the issuance path incorporates a patch.
ILM now incorporates a custom OID registry for certificate extensions, registers known system extensions, and exposes an endpoint that lists system OIDs. This effectively turns a custom extension into a configuration. Additionally, platform RDN codes such as EMAIL are now accepted in subject names, eliminating a known class of rejected requests.
Fluid does not mean permissive
It would be easy to interpret all this as a relaxation of control. It is precisely the opposite, and the distinction matters.
Previously, an applicant could include almost anything in a CSR, and the platform’s job was to detect it afterward. Now, the profile defines what is allowed, values that the client shouldn’t control are derived or set, and uploaded requests are checked against the same policy. In other words, fewer questions for the applicant and fewer opportunities to make a mistake.
Trust in a PKI stems from consistently applying the policy. It has never depended on forcing people to prove they understand it. Therefore, shifting the difficulty to the profile increases trust rather than reducing it.
One honest caveat: someone still needs to write the policy. Request attributes don’t decide what your PKI should allow. They make that decision explicit, reusable, and enforceable from a single source, instead of being repeatedly interpreted by guesswork.
Key points
- An AR profile declares its request attributes and links each one to a source of value: collected, derived, or set by policy.
- The attribute assignments are projected into the generated PKCS#10 request, so that the CSR incorporates the policy instead of relying on client assumptions.
- Uploaded CSRs are validated against the same policy, and requests can be pre-registered and issued later.
- Policy violations return native errors from ACME, EST, SCEP, and CMP, and clients can first query the expected attribute set.
- Registering custom OIDs and accepting platform RDN codes turns extension management into configuration.
Request attributes were added in ILM Core 2.19.0 . For the rest of that version, see What Changed in 2.19.0 . If the shortening of certificate lifecycles is driving you toward automation, read the 47-day countdown and 10 things you can create with ILM . To design a profile for your own environment, contact us .
