Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION, Admin Manual

Page: 132 / 564

Chapter 4. Requesting, Enrolling, and Managing Certificates
110
4.6.3.1. Auto Enrollment Proxy Registry Settings
The Auto Enrollment Proxy stores its configuration settings in the Windows registry, underneath the
following key:
HKEY_LOCAL_MACHINE\SOFTWARE\Red Hat\RHCSProxy\Config
This entry defines the basic behaviors of the proxy service.
Name Description Example
RequestType The type of certificate request
to send to the CA. The only
supported value is
PKCS10
.
PKCS10
LogOptions An decimal integer representing
a bitmask of all the selected log
options. 503
AuthenticationCertificate A hash of the chosen
certificate to use for SSL client
authentication to the CA.
CACertificate A binary value, for the DER
encoded binary CA certificate.
RetryInterval The number of seconds to wait
before trying to use a CA which
was previously failing.
Table 4.3. Auto Enrollment Proxy Registry Settings
4.6.3.2. Listing and Adding CAs in the Windows Domain
All of the CAs configured for enrollment services for a domain are listed in Active directory in the
CN=Enrollment Services,CN=Public Key Services
subtree. This subtree can be queried to
show what Certificate Managers are configured for the proxy and what certificate templates and other
settings they have available. For example:
dsquery * "CN=Example RHCS CA,CN=Enrollment Services,CN=Public Key
Services,CN=Services,CN=Configuration,DC=server,DC=example,DC=com" -scope base -attr *
The actual configuration for the Certificate Manager is defined in the registry entries for the proxy
service. All proxy CAs are listed in the registry under the following key:
HKEY_LOCAL_MACHINE\SOFTWARE\Red Hat\RHCSProxy\Config\CertificateAuthorities
Each configured CA is then a subkey under the main entry.
[HKEY_LOCAL_MACHINE\SOFTWARE\Red Hat\RHCSProxy\Config\CertificateAuthorities\1]
"hostname"="ca.example.com" "port"="9444" "catype"="3"
New CAs can be added by directly editing the registry entry and adding a new CA or by opening the
proxy configuration console and adding a new entry there.