Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 233 / 554

TPS Configuration Parameters
211
Parameter Description
• op.enroll.
tokenType
.keyGen.encryption.private.keyCapabilities.token
op.enroll.
tokenType
.keyGen.encryption.label The token label for the encryption certificate.
The valid values are
$pretty_cuid$
,
$cuid$
,
$msn$
,
$userid$
, and
$profileId$
. These
variables are replaced by the user-supplied
information when the certificate is generated.
op.enroll.
tokenType
.keyGen.encryption.cuid_label The CUID to show in the certificate.
op.enroll.
tokenType
.keyGen.encryption.overwrite Specifies if the encryption certificate on the token
should be overwritten. The valid values are
true|false
.
op.enroll.
tokenType
.keyGen.encryption.ca.profileId The CA profile to use for enrolling
encryption certificates. The default value is
caTokenUserEncryptionKeyEnrollment
.
op.enroll.
tokenType
.keyGen.encryption.ca.conn The CA connection to use to generate encryption
certs. The default value is
ca1
.
op.enroll.
tokenType
.update.applet.emptyToken.enable Specifies whether TPS should upload an applet
to the token when it does not have one. The valid
values are
true|false
.
op.enroll.
tokenType
.update.applet.enable Specifies if applet upgrade is turned on. The
valid values are
true|false
.
op.enroll.
tokenType
.update.applet.requiredVersion The version of the applet to use. It should be
the filename of the applet without the
.ijc
extension.
op.enroll.
tokenType
.update.applet.directory The local filesystem directory where the applets
are located.
op.enroll.
tokenType
.update.symmetricKeys.enable Specifies if the key changeover feature should
be enabled. The valid values are
true|
false
. When enabled, TPS checks to see
the key version sent by the token matches
symmetricKeys.requiredVersion
.
op.enroll.
tokenType
.update.symmetricKeys.requiredVersion The required key version.
op.enroll.
tokenType
.loginRequest.enable Specifies if the login request should be
sent to the token. This parameter enables
authentication. The valid values are
true|
false
.
op.enroll.
tokenType
.pinReset.enable Specifies if the token's PIN should be reset.
The default value is
true
. The valid values are
true|false
.
op.enroll.
tokenType
.pinReset.pin.minLen The minimum number of characters for the PIN.
op.enroll.
tokenType
.pinReset.pin.maxRetries The maximum number of times PIN
authentication can be attempted on the token
before the key is locked. This value is set on the
token when the PIN is reset.
op.enroll.
tokenType
.pinReset.pin.maxLen The maximum number of characters for the PIN.