Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 399 / 554

Chapter 16.
377
Authentication for Enrolling
Certificates
This chapter covers how to enroll end entity certificates, how to create and manage server certificates,
the authentication methods available in the Certificate System to use when enrolling end entity
certificates, and how to set up those authentication methods.
16.1. Enrollment Overview
Enrollment
is the process of issuing certificates to an end entity. The process is creating and
submitting the request, authenticating the user requesting it, and then approving the request and
issuing the certificate.
The method used to authenticate the end entity determines the entire enrollment process. There are
three ways that the Certificate System can authenticate an entity:
• In
agent-approved
enrollment, end-entity requests are sent to an agent for approval. The agent
approves the certificate request.
• In
automatic
enrollment, end-entity requests are authenticated using a plug-in, and then the
certificate request is processed; an agent is not involved in the enrollment process.
• In
CMC enrollment
, a third party application can create a request that is signed by an agent and
then automatically processed.
A Certificate Manager is initially configured for agent-approved enrollment and for CMC authentication.
Automated enrollment is enabled by configuring one of the authentication plug-in modules.
More than one authentication method can be configured in a single instance of a subsystem.
The HTML registration pages contain hidden values specifying the method used. With certificate
profiles, the end-entity enrollment pages are dynamically-generated for each enabled profile. The
authentication method associated with this certificate profile is specified in the dynamically-generated
enrollment page.
16.1.1. The Authentication Process
An end entity submits a request for enrollment. The form used to submit the request identifies the
method of authentication and enrollment. All HTML forms are dynamically-generated by the profiles,
which automatically associate the appropriate authentication method with the form.
If the authentication method is an agent-approved enrollment, the request is sent to the request queue
of the CA agent. If the automated notification for a request in queue is set, an email is sent to the
appropriate agent that a new request has been received. The agent can modify the request as allowed
for that form and the profile constraints. Once approved, the request must pass the certificate profiles
set for the Certificate Manager, and then the certificate is issued. When the certificate is issued, it is
stored in the internal database and can be retrieved by the end entity from the end-entities page by
serial number or by request ID.
If the authentication method is automated, the end entity submits the request along with required
information to authenticate the user, such as an LDAP username and password. When the user is