Red Hat CERTIFICATE 7.1 ADMINISTRATOR, Руководство администратора

Страница: 154 / 840

How a Registration Manager Works
154 Red Hat Certificate System Administrator’s Guide • September 2005
Enrollment
An end entity can enroll in your PKI by submitting an enrollment request in the end-entity
interface. You can create more than one type of enrollment that either uses a different
enrollment method, has different certificate issuance policies, or requires a different method
of authentication, or all three. You can do this by creating separate enrollment pages that are
specific to the type of enrollment, type of authentication, and the certificate issuance
policies associated with this type of certificate. The forms associated with enrollment are
customizable allowing you to change the content and the look and feel of the forms. You
can also do this by creating certificate profiles for each with a dynamically generated form
associated with each certificate profile. You customize the dynamically created certificate
profile forms by configuring the inputs associated with the certificate profile.
The Certificate Enrollment Process
When an end-entity enrolls in your PKI requesting a certificate, a number of things can
happen depending on your configuration and the subsystems you have installed. The
following lists those events in the approximate order they occur:
• The end entity provides the information and submits a request. The information
gathered from the end entity is customizable in the form depending on the information
you want to collect, or you need to collect to store in the certificate that is issued or to
authenticate against the authentication method associated with the form. The form
creates a request that is then submitted to the Registration Manager.
• The enrollment form can trigger the creation of the public and private keys for this
request, or for dual-key pairs.
• The end entity may have to provide some form of authentication before submitting the
request. You can configure directory-based authentication, Pin-based authentication, or
certificate-based authentication.
• The request may be submitted using an agent-approved enrollment process or an
automated process.
❍
The agent-approved process sends the request to the request queue in the agent
services interface where an agent must process the request. An agent can then
change the status of the request, reject the request, or approve the request. The
agent can also change some aspects of the request.
You can set up an automated notification that send an email any time a request
appears in the queue to the agent, or an automated job that sends a list of the
contents of the queue to agents on a preconfigured schedule. See Chapter 13,
“Automated Notifications” and Chapter 14, “Automated Jobs.”