Table of Contents
Advertisement
Agent Certificates
All agents must have an agent's certificate. This certificate is used to sign all
requests made by the agent. This section details the procedure for getting agent
certificates, and turning on the revocation status checking of agents' certificates.
There is a special form for an administrator to get the first agent certificate from
CMS for the Certificate Manger administrator set up during installation to be able
to access the agent's services interface. See "First Agent Certificate for a Certificate
Manager," on page 337 for details.
A generalized procedure for getting an agent certificate from a public CA or from
CMS is included here for your convenience. See "Getting an Agent's Certificate
from a Public CA," on page 339 and "Getting an Agent's Certificate from
Certificate Management System," on page 340.
You can set up a feature that checks the revocation status of agent certificates. See
"Revocation Status Checking of Agent Certificates," on page 341 for details about
setting up this feature.
First Agent Certificate for a Certificate Manager
CMS adds the administrator set up during installation of a Certificate Manager as
the first agent if this option is selected during installation. A special agent
enrollment form is provided for this administrator to get the agent certificate. This
form is automatically disabled after this initial request is approved and the
certificate is issued. This is done so that no one else can acquire a certificate without
agent approval or some form of automated authentication.
To get the first agent certificate:
Go to the following URL:
1.
https://<hostname>:<admin_port>/ca/adminEnroll.html
where:
<hostname>
<admin_port>
Is the fully qualified name of the machine on which
CMS is installed; for example,
CAmachine.example.com
Is the TCP port specified during installation for
administration over SSL.
Agent Certificates
.
Chapter 8
Authorization
337
Advertisement
Table of Contents
