Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 26 / 554

Chapter 1. Overview
4
1.1.9. Registration Authority
A Registration Authority (RA) is a subsystem that accepts enrollment requests and authenticates them
in a local context (e.g., a department of an organization, or an organization within an association).
Upon the successful authentication, the RA then forwards the enrollment request to the designated
Certificate Authority (CA) to generate the certificate.
Depending on the type of enrollment, an RA can be set up with the appropriate authentication plugin
to authenticate the request in an automated fashion. Alternatively, the RA has a local request queue
where requests can be stored and reviewed by local RA agents for manual authentication.
1.1.10. SCEP
SCEP (Simple Certificate Enrollment Protocol) is a protocol designed by Cisco. It is designed to
specify a way for a router to communicate with an RA/CA for enrollment.
Normally, a router installer enters the RA's URL and a Challenge password (sometimes referred
as a one-time PIN) into the router and issues a command to initiate the enrollment. The router then
communicates with the RA using the SCEP protocol to:
• Retrieve CA requests
• Submit a PKCS#10 request
• Retrieve the issued certificate
• Queries the request status if the request is pending
SCEP suggests two modes of operation: RA mode; and CA mode. In the RA mode, the enrollment
request is encrypted with the RA signing certificate. In the CA mode, the request is encrypted with the
CA signing certificate.
The current implementation of RA and CA only supports the CA mode.
1.1.11. Certificate Issuance
The Certificate System supports enrolling and issuing certificates and processing certificate requests
from a variety of end entities, such as web browsers, servers, and virtual private network (VPN)
clients. Issued certificates conform to X.509 version 3 standards.
The Certificate Manager can issue certificates with the following characteristics:
• Certificates that are X.509 version 3-compliant
• Unicode support for the certificate subject name and issuer name
• Support for empty certificate subject names
• Support for customized subject name components
• Support for customized extensions
Additionally, smart cards can have certificates enrolled and maintained through the Enterprise Security
Client. The Enterprise Security Client communicates directly with the TPS system, which, in turn,
processes requests through the CA and DRM subsystems. Certificates are generated automatically