Certificate Manager; How The Certificate Manager Works; Enrollment - Red Hat CERTIFICATE SYSTEM 7.2 - ADMINISTRATION Administration Manual

Chapter 4.

Certificate Manager

The Certificate Manager subsystem serves as a Certificate Authority (CA) in the PKI. It can issue and
revoke certificates; create and issue CRLs; and publish certificates and CRLs.
This chapter discusses the Certificate Manager subsystem. It provides an overview of the subsystem
including an overview of processes, information about cross-signed CA certificates, and other
information for maintaining the Certificate Manager.

4.1. How the Certificate Manager Works

This section explains how the Certificate Manager works during certificate enrollment and revocation
and when publishing certificates and CRLs to give a better understanding of how the Certificate
System needs configured for better performance of the PKI.

4.1.1. Enrollment

An end entity enrolls in the PKI by submitting an enrollment request through the end-entity interface.
There can be many kinds of enrollment that use different enrollment methods or require different
authentication methods. For each enrollment, there is a separate enrollment page created that is
specific to the type of enrollment, type of authentication, and the certificate profiles associated with
the type of certificate. The forms associated with enrollment can be customized for both appearance
and content. Alternatively, the enrollment process can be customized by creating certificate profiles
for each enrollment type. Certificate profiles dynamically-generate forms which are customized by
configuring the inputs associated with the certificate profile.
4.1.1.1. The Certificate Enrollment Process
When an end entity enrolls in a PKI by requesting a certificate, the following events can occur,
depending on the configuration of the PKI and the subsystems installed:
1. The end entity provides the information in one of the enrollment forms and submits a request.
The information gathered from the end entity is customizable in the form depending on the
information collected to store in the certificate or to authenticate against the authentication method
associated with the form. The form creates a request that is then submitted to the Certificate
Manager.
2. The enrollment form triggers the creation of the public and private keys or for dual-key pairs for the
request.
3. The end entity provides authentication credentials before submitting the request, depending on
the authentication type. This can be LDAP authentication, PIN-based authentication, or certificate-
based authentication.
4. The request is submitted either to an agent-approved enrollment process or an automated
process.
• The agent-approved process, which involves no end-entity authentication, sends the request to
the request queue in the agent services interface, where an agent must processes the request.
An agent can then modify parts of the request, change the status of the request, reject the
request, or approve the request.
101