Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 71 / 554

Configuring a CA
49
http://server.example.com:9080/ca/admin/console/config/login?pin=kI7E1MByNIUcPJ6RKHmH
Using this URL skips the login screen.
Alternatively, log into the setup wizard through admin link on the services page and supply the
preop.pin
value from the
CS.cfg
file when prompted.
http://server.example.com:9080/ca/services
2. Create a new security domain.
The default CA instance must create a new security domain; subsequent CAs can create a new
domain or join an existing security domain.
3. Enter a name for the new instance.
4. Set up the PKI hierarchy. It is recommended that the first CA be a root, or self-signed, CA,
meaning that it signs its own CA signing certificate rather than submitting its certificates to a third-
party CA for issuance. Subsequent CAs can be subordinate CAs.
5. Fill in the information for the LDAP server which will authenticate the subsystem's users. This
requires connection information for the Directory Server instance, such as the hostname, port
number, bind DN (username), and password. This step also creates a database in the Directory
Server and a corresponding base directory entry (base DN) to use for the subsystem's entries.
6. Select the key store token; a list of detected hardware tokens and databases is given.
To determine whether a token is detected by the Certificate System, use the
TokenInfo
tool. For
more information on this tool, see the
Certificate System Command-Line Tools Guide
.
7. Set the key size. The default RSA key size is 2048.
8. Optionally, give subject names for the certificates.
9. The next panels generate and show certificate requests, certificates, and key pairs.
If an external CA is used to issue the certificates, configuration cannot go forward until they are
received from the external CA. When they are issued, paste the certificates into this panel to
add them to the CA database, and then proceed with the installation. Click
Apply
to view the
certificates as they are imported.
10. If the subsystem will ever be cloned, or as a protection if keys or certificates are ever lost, back up
the keys and certificates when prompted.
11. Give the information for the new subsystem administrator.
12. Click
Next
through the remaining panels to import the agent certificate into the browser and
complete the configuration.
13. When the configuration is complete, restart the subsystem.
/etc/init.d/rhpki-ca restart