ML-KEM template

Example:

{
  "key_gen": {
    "enabled": true,
    "key_type": {
      "allowed_types": [
        "rsa",
        "ecdsa",
        "Ed25519",
        "MLDSA",
        "SLHDSA",
        "ml-kem"
      ],
      "default_key_type": "ml-kem"
    },
    "rsa_key_size": {
      "min_bits": 1024,
      "max_bits": 4096,
      "default_bits": 2048
    },
    "ecdsa_curve": {
      "allowed_curves": [
        "P-256",
        "P-384",
        "P-521"
      ],
      "default_curve": "P-256"
    },
    "dilithium_key_size": {
      "allowed_sizes": [
        "MLDSA-44",
        "MLDSA-65",
        "MLDSA-87"
      ],
      "default_size": "MLDSA-44"
    },
    "sphincs_key_size": {
      "allowed_sizes": [
        "SLHDSA-SHAKE-128f",
        "SLHDSA-SHA2-128s",
        "SLHDSA-SHAKE-128s",
        "SLHDSA-SHA2-128f",
        "SLHDSA-SHAKE-192s",
        "SLHDSA-SHA2-192f",
        "SLHDSA-SHA2-192s",
        "SLHDSA-SHAKE-192f",
        "SLHDSA-SHAKE-256f",
        "SLHDSA-SHA2-256s",
        "SLHDSA-SHAKE-256s",
        "SLHDSA-SHA2-256f"
      ],
      "default_size": "SLHDSA-SHAKE-128f"
    },
    "mlkem_key_size": {
      "allowed_sizes": [
        "ML-KEM-512",
        "ML-KEM-768",
        "ML-KEM-1024"
      ],
      "default_size": "ML-KEM-512"
    }
  },
  "issue_types": [
    "client_authentication"
  ],
  "signature_algorithm": {
    "allowed_algorithms": [
      "sha256WithRSA",
      "sha384WithRSA",
      "sha512WithRSA",
      "sha256WithECDSA",
      "sha384WithECDSA",
      "sha512WithECDSA",
      "sha3_256WithRSA",
      "sha3_384WithRSA",
      "sha3_512WithRSA",
      "MLDSA-44",
      "MLDSA-65",
      "MLDSA-87",
      "SLHDSA-SHA2-128f",
      "SLHDSA-SHA2-128s",
      "SLHDSA-SHA2-192f",
      "SLHDSA-SHA2-192s",
      "SLHDSA-SHA2-256f",
      "SLHDSA-SHA2-256s",
      "SLHDSA-SHAKE-128f",
      "SLHDSA-SHAKE-128s",
      "SLHDSA-SHAKE-192f",
      "SLHDSA-SHAKE-192s",
      "SLHDSA-SHAKE-256f",
      "SLHDSA-SHAKE-256s",
      "match_issuer"
    ],
    "default_algorithm": "match_issuer"
  },
  "subject": {
    "attributes": [
      {
        "type": "common_name",
        "include": "optional",
        "encoding": "auto",
        "allowed_source": [
          "csr",
          "fixed_value",
          "user_supplied"
        ]
      },
      {
        "type": "organization_name",
        "include": "optional",
        "encoding": "auto",
        "allowed_source": [
          "csr",
          "fixed_value",
          "user_supplied"
        ]
      },
      {
        "type": "organization_unit",
        "include": "optional",
        "encoding": "auto",
        "allowed_source": [
          "csr",
          "fixed_value",
          "user_supplied"
        ]
      },
      {
        "type": "street_address",
        "include": "optional",
        "encoding": "auto",
        "allowed_source": [
          "csr",
          "fixed_value",
          "user_supplied"
        ]
      },
      {
        "type": "postal_code",
        "include": "optional",
        "encoding": "auto",
        "allowed_source": [
          "csr",
          "fixed_value",
          "user_supplied"
        ]
      },
      {
        "type": "locality",
        "include": "optional",
        "encoding": "auto",
        "allowed_source": [
          "csr",
          "fixed_value",
          "user_supplied"
        ]
      },
      {
        "type": "state",
        "include": "optional",
        "encoding": "auto",
        "allowed_source": [
          "csr",
          "fixed_value",
          "user_supplied"
        ]
      },
      {
        "type": "country",
        "include": "optional",
        "encoding": "auto",
        "allowed_source": [
          "csr",
          "fixed_value",
          "user_supplied"
        ]
      },
      {
        "type": "email",
        "include": "optional",
        "encoding": "auto",
        "allowed_source": [
          "csr",
          "fixed_value",
          "user_supplied"
        ]
      }
    ]
  },
  "extensions": {
    "key_usage": {
      "critical": true,
      "required_usages": {
        "rsa": [
          "digital_signature",
          "key_encipherment"
        ],
        "ecdsa": [
          "digital_signature"
        ],
        "dilithium": [
          "digital_signature"
        ],
        "sphincs": [
          "digital_signature"
        ],
        "ml-kem": [
          "key_encipherment"
        ]
      },
      "optional_usages": {
        "rsa": [
          "data_encipherment"
        ],
        "ecdsa": [
          "key_agreement"
        ],
        "dilithium": [
          "non_repudiation"
        ],
        "sphincs": [
          "non_repudiation"
        ]
      }
    },
    "extended_key_usage": {
      "critical": true,
      "include": "optional",
      "required_usages": [
        {
          "oid": "client_authentication",
          "name": "Client Authentication"
        }
      ],
      "optional_usages": [
        {
          "oid": "1.2.3.4",
          "name": "Custom Extension"
        }
      ]
    }
  },
  "serial_number_size": 20,
  "validity": {
    "min_duration": {
      "value": 1,
      "unit": "DAYS"
    },
    "max_duration": {
      "value": 10,
      "unit": "YEARS"
    },
    "default_duration": {
      "value": 10,
      "unit": "YEARS"
    }
  },
  "is_composite": false
}