Private organizational policy OID: 1.3.6.1.4.1.55555.1.1. Profiles constrain subject fields, SAN types, algorithms, validity, KU/EKU, key handling, approval, renewal, and issuer selection. External certificates retain their outside issuer and explicit trust classification.