Setting Up Automated Cep Enrollment - Red Hat CERTIFICATE SYSTEM 7.1 - ADMINISTRATOR Administrator's Manual

CEP Enrollment

Setting Up Automated CEP Enrollment

You can configure the Certificate Manager to use either the challenge password or the
subject name (all or a part of it) as an authentication token during a CEP enrollment, thus
enabling users to get router certificates without any action on the part of the Certificate
Manager agent.
CS does not install an authentication module for CEP enrollment, but does provide a sample
along with the CS SDK that you can register and then configure, named
This plug-in uses a file, called an authentication token, containing information that will be
provided by the enrollee to uniquely identify it, and the password created for the enrollee
that they present during enrollment to authenticate themselves.
To set this up, you must create the authentication-token file, and register and configure the
plug-in. See "Authentication-Token File," on page 396 and "Setting Up the CEP Plug-In,"
on page 397.
Authentication-Token File
You create a text file with CEP-enrollee information that is used by the plug-in to
authenticate the entity. The format of the authentication-token file is as follows:
<attribute>: <value>
<attribute>: <value>
...
<attribute>: <value>
<attribute>: <value>
Each enrolling user is represented by a sequence of attribute-value pairs, terminated by a
blank line or end-of-file (EOF). The attributes can be any part of the subject name from the
request, for example
challenge password (
UNSTRUCTUREDNAME
UNSTRUCTUREDADDRESS
396 Red Hat Certificate System Administrator's Guide • September 2005
,
SERIALNUMBER UNSTRUCTUREDADDRESS
). These attributes are described as follows:
pwd
Specifies the DNS name of the router (for example,
router32.example.com). This is always specified in the
request.
Specifies the IP address of the router (for example,
101.22.33.124). This may not be in the request—a user may
not want to include this in the subject name of the router
certificate, and hence choose not to specify one during
enrollment.
FlatFileAuth
, , , , or the
CN OU UID
.