Testing Enrollment - Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION Administration Manual

Chapter 16. Authentication for Enrolling Certificates
NOTE
All three enrollment forms work by default with the directory-based authentication
module, UidPwdDirAuth, explained in
Authentication". Certificate-based enrollment forms can be used with any of the
authentication modules, such as directory- and PIN-based authentication modules.
In general, the following three hidden variables distinguish certificate-based enrollment forms from
other enrollment forms:
• certauthEnroll This variable specifies whether certificate-based enrollment is turned on or
off.
• certauthEnrollType This variable specifies one of the three certificate-based-enrollment
types: dual, single, or encryption; dual specifies that the enrollment request is for
dual certificates; single specifies that the enrollment request is for a signing certificate; and
encryption specifies that the enrollment request is for an encryption certificate.
NOTE
Choosing dual requires a client that is capable of generating dual key pairs.
• doSslAuth This variable specifies whether the server requests SSL client authentication.
Set the value of this parameter to on, and make sure that the port number specified in the
authentication instance is an SSL port.
4. Before modifying a form, look at the default certificate-based enrollment forms.

16.6. Testing Enrollment

For information on testing enrollment through the profiles, see
whether end users can successfully enroll for a certificate using the authentication method set:
1. Open the end-entities page.
https://server.example.com:9443/ca/ee/ca
2. In the Enrollment tab, open the customized enrollment form.
3. Fill in the values, and submit the request.
4. Enter the password to the key database when prompted.
5. When the correct password is entered, the client generates the key pair.
Do not interrupt the key-generation process. Upon completion of the key generation, the request
is submitted to the server to issue the certificate. The server subjects the request to the certificate
profile and issues the certificate only if the request meets all the requirements.
When the certificate is issued, install the certificate in the browser.
388
Section 16.3.1, "Setting up Directory-Based
Chapter 13, Certificate Profiles. To test