Authentication For Enrolling Certificates; Configuring Agent-Approved Enrollment - Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION Admin Manual

Chapter 9.
Authentication for Enrolling
Certificates
This chapter covers how to enroll end entity certificates, how to create and manage server certificates,
the authentication methods available in the Certificate System to use when enrolling end entity
certificates, and how to set up those authentication methods.
Enrollment is the process of issuing certificates to an end entity. The process is creating and
submitting the request, authenticating the user requesting it, and then approving the request and
issuing the certificate.
The method used to authenticate the end entity determines the entire enrollment process. There are
three ways that the Certificate System can authenticate an entity:
• In agent-approved enrollment, end-entity requests are sent to an agent for approval. The agent
approves the certificate request.
• In automatic enrollment, end-entity requests are authenticated using a plug-in, and then the
certificate request is processed; an agent is not involved in the enrollment process.
• In CMC enrollment, a third party application can create a request that is signed by an agent and
then automatically processed.
A Certificate Manager is initially configured for agent-approved enrollment and for CMC authentication.
Automated enrollment is enabled by configuring one of the authentication plug-in modules. More than
one authentication method can be configured in a single instance of a subsystem.
NOTE
An email can be automatically sent to an end entity when the certificate is issued for any
authentication method by configuring automated notifications. See
Automated Notifications

9.1. Configuring Agent-Approved Enrollment

The Certificate Manager is initially configured for agent-approved enrollment. An end entity makes
a request which is sent to the agent queue for an agent's approval. An agent can modify request,
change the status of the request, reject the request, or approve the request. Once the request is
approved, the signed request is sent to the Certificate Manager for processing. The Certificate
Manager processes the request and issues the certificate.
The agent-approved enrollment method is not configurable. If a Certificate Manager is not configured
for any other enrollment method, the server automatically sends all certificate-related requests to
a queue where they await agent approval. This ensures that all requests that lack authentication
credentials are sent to the request queue for agent approval.
To use agent-approved enrollment, leave the authentication method blank in the profile's .cfg file. For
example:
auth.instance_id=
for more information on notifications.
Chapter 10, Using
235