Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 156 / 554

Chapter 5. Registration Authority
134
The RA also supports a range of reusable Perl objects. This enables administrators to build their own
enrollment work flow.
5.1.3. Roles
The RA currently supports the following roles:
• End Users — people who submit enrollment requests
• RA Agents — privileged RA users. They are responsible for daily operations such as request
approval.
• Administrator — the person responsible for installing and configuring the RA. An Administrator has
the necessary privileges to issue RA Agent status to End Users.
5.1.4. Interfaces
The RA provides three main interfaces: End User (or End Entity, EE); Agent; and Administrator.
5.1.4.1. End User Interface
The End User interface provides the following enrollment options:
SCEP Enrollment
In a SCEP enrollment scenario, you use the EE interface to submit a request in order to retrieve a
one-time PIN. The RA agent is notified of the request and, after validating the requestor, approves
it. Approving the request generates a PIN.
The manager gives this PIN to the router installer. On the router, the installer enters the URL to the
RA and provides the one-time PIN. The enrollment can then be initiated.
Enrolling a Server Certificate
In a server certificate enrollment scenario, a server administrator provides site information and the
server certificate request in the enrollment form. The RA Agent is notified of the request and, after
validating the requestor, approves it.
The request is then forwarded from the RA to the CA, which in turn generates a certificate and
returns it to the RA. The RA sends a notification to the server administrator who collects the
certificate by following a URL provided in the notification (typically an email).
Enrolling a User Certificate
In a user certificate enrollment scenario, the user accesses an enrollment page where user
information is collected, and key generation is initiated. The RA Agent is notified of the request
and, after validating the requestor, approves it.
The RA sends a notification to the user, who then collects the certificate by visiting a specified
URL.
In addition to enrolling user certificates, you can use the end entity interface to renew a valid user
certificate in your browser. The renewal feature reuses the keys and the CSR of the selected user
certificate to generate a new certificate.