Symantec ALTIRIS OUT OF BAND MANAGEMENT COMPONENT 7.0 SP3 - V1.0 Manual page 34

34 About Out of Band Management Component pages
Configuration Profiles page
Options on the TLS tab (continued)
Table 2-8
Option Description
Server Certificate Select the certification authority (CA) that you want to use to generate
server certificates for the Intel AMT devices that are associated with
the profile.
See
Note:
a single profile. These include the Server certificate that is required
for TLS and any client certificates that are required for 802.1x profiles
or for NAC posture signing. In a normal installation, a single client
certificate would be purchased for all applications in the facility. If
a profile requires more than three certificates, setup of an Intel AMT
device that is based on this profile fails.
Trusted These are the issuers of the client certificates that the Intel AMT
Certificates device recognizes as authentic. These certificates are stored in the
database and then sent to the Intel AMT device during configuration.
Intel AMT can accept up to four trusted root certificates, so no more
than four should be added to a profile.
Click the Add symbol and, in the Select Trusted Root Certificate
dialog box, select the certification authority (CA) that you configured
to issue certificates for TLS with Mutual.
You can also import the trusted root CA certificate from a file.
For more information, see the Out of Band Management Component
Implementation Guide.
CRL (Optional)
The Certificate Revocation List (CRL) is a list of entries that indicate
which certificates have been revoked. The CRL contains certification
authority URLs and the serial numbers of revoked certificates. This
is an optional feature of TLS Mutual Authentication.
Click the Manage CRL symbol to define a CRL.
FQDN Suffixes The Fully Qualified Domain Name (FQDN) suffixes for mutual
authentication.
The Intel AMT device validates that any client certificates that Intel
SCS or Altiris solutions use have one of the listed suffixes in the
certificate subject.
Type the FQDN suffix of the Notification Server computer: for
example, type yourenterprise.com. If you want to type more than
one suffix, use a comma as a delimiter.
"Add Certificate Generation Properties dialog box"
Only three server and client certificates can be associated with
on page 24.