Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 253 / 554

Requesting Certificates
231
•
Section 11.2.1, “Requesting Certificates”
•
Section 11.2.2, “Submitting Certificate Requests”
•
Section 11.2.3, “Retrieving Certificates from the End-Entities Page”
11.2.1. Requesting Certificates
The different methods of requesting certificates allow different types of certificates which can be
requested. End users can request client certificates, either agent or user certificates for the Certificate
System or for use with other applications. Administrators can request certificates for servers and
Certificate System instances.
•
End-Entities Page: User and Agent Certificates
The end-entities pages can be accessed by any user. Those enrollment forms can be used to
request user and agent certificates. See
Section 11.2.1.1, “Requesting a User or Agent Certificate
through the End-Entities Page”
.
•
Certificate Wizard: Server and Subsystem Certificates
The administrative console can only be accessed by administrators. The Console can be used
to create requests for CA, OCSP, and CRL signing certificates; SSL server certificates; client
certificates; and DRM transport certificates. See
Section 11.2.1.2, “Requesting a Subsystem, Server,
or Signing Certificate through the Console”
.
•
certutil: All Certificates
The
certutil
utility can be used by administrators or users to generate any certificate.
11.2.1.1. Requesting a User or Agent Certificate through the End-Entities
Page
End entities can use the HTML enrollment forms on the Certificate Management end-entities page
to create user certificates for email and SSL authentication. Other enrollment forms are available for
adding certificates to tokens and signing files. For more information about the end-entities enrollment
forms, see the
Certificate System Agent's Guide
.
The following forms are used to create user certificates:
• Manual User Dual-Use Certificate Enrollment
• Manual User Signing and Encryption Certificates Enrollment
• Directory-Authenticated User Dual-Use Certificate Enrollment (if directory authentication has been
configured)
NOTE
It is important that the agent or user generate and submit the client request from the
computer that will be used later to access the subsystem because part of the request
process generates a private key on the local machine. If location independence is