Configuring Custom Enrollment Profiles To Use With An Ra; Default Ra Profiles; Creating Ra Enrollment Forms - Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION Admin Manual

Chapter 2. Making Rules for Issuing Certificates
2.3. Configuring Custom Enrollment Profiles to Use with an
RA
The profiles used to submit certificate requests through the RA are created and configured in the
Section 2.2, "Setting up Certificate
CA, as described in
requests and the specific profiles to use for the requests (both for existing and custom profiles) must
be configured in the RA by calling on the RA's request queue plug-ins.

2.3.1. Default RA Profiles

There are already four types of certificates that are processed in the RA: SCEP (router), server, user,
and RA agent.
Profile ID
caDualRAuserCert
caRAagentCert
caRACert
caRARouterCert
caRAserverCert
caRouterCert
Table 2.3. Profiles for the RA

2.3.2. Creating RA Enrollment Forms

Each certificate type configured for the RA has a subdirectory in /var/lib/pki-ra/docroot/ee/
which contains index files and enrollment and processing forms. Each rendered page has two files, a
.cgi script file and .vm HTML template file.
It is easiest to simply copy the docroot directory for one of the existing profiles and adapt it to the new
profile.
To configure new enrollment forms for the RA:
1. Open the end-entities docroot directory.
cd /var/lib/pki-ra/docroot/ee/
2. Copy an existing directory to make a new profile directory. For example:
48
Profiles". However, the way to process those
Profile Name
RA Agent-Authenticated User
Certificate Enrollment
RA Agent-Authenticated Agent
User Certificate Enrollment
Manual Registration Manager
Signing Certificate Enrollment
RA Agent-Authenticated Router
Certificate Enrollment
RA Agent-Authenticated Server
Certificate Enrollment
One Time Pin Router Certificate
Enrollment
Description
Enrolls user certificates with RA
agent authentication.
Enrolls RA agent user
certificates with RA agent
authentication.
Enrolls Registration Manager
certificates.
Enrolls router certificates after
agent approval (as opposed to
automatic enrollment).
Enrolls server certificates with
RA agent authentication.
Enrolls router certificates
using an automatically-
generated, one-time PIN that
the router can use to retrieve its
certificate.