Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Руководство администратора

Страница: 410 / 554

Chapter 16. Authentication for Enrolling Certificates
388
NOTE
All three enrollment forms work by default with the directory-based authentication
module,
UidPwdDirAuth
, explained in
Section 16.3.1, “Setting up Directory-Based
Authentication”
. Certificate-based enrollment forms can be used with any of the
authentication modules, such as directory- and PIN-based authentication modules.
In general, the following three hidden variables distinguish certificate-based enrollment forms from
other enrollment forms:
•
certauthEnroll
This variable specifies whether certificate-based enrollment is turned
on
or
off
.
•
certauthEnrollType
This variable specifies one of the three certificate-based-enrollment
types:
dual
,
single
, or
encryption
;
dual
specifies that the enrollment request is for
dual certificates;
single
specifies that the enrollment request is for a signing certificate; and
encryption
specifies that the enrollment request is for an encryption certificate.
NOTE
Choosing
dual
requires a client that is capable of generating dual key pairs.
•
doSslAuth
This variable specifies whether the server requests SSL client authentication.
Set the value of this parameter to
on
, and make sure that the port number specified in the
authentication instance is an SSL port.
4. Before modifying a form, look at the default certificate-based enrollment forms.
16.6. Testing Enrollment
For information on testing enrollment through the profiles, see
Chapter 13, Certificate Profiles
. To test
whether end users can successfully enroll for a certificate using the authentication method set:
1. Open the end-entities page.
https://server.example.com:9443/ca/ee/ca
2. In the
Enrollment
tab, open the customized enrollment form.
3. Fill in the values, and submit the request.
4. Enter the password to the key database when prompted.
5. When the correct password is entered, the client generates the key pair.
Do not interrupt the key-generation process. Upon completion of the key generation, the request
is submitted to the server to issue the certificate. The server subjects the request to the certificate
profile and issues the certificate only if the request meets all the requirements.
When the certificate is issued, install the certificate in the browser.