About Enrollment (Trust Authority)

At this level, Trust Protection Foundation interfaces directly with Certificate Authorities (CAs) to initiate and auto-enroll new or to-be-renewed certificate and key generation requests according to organization-defined workflow and approved folders.

Trust Protection Foundation automatically generates and submits CSRs to CAs using the parameters defined in designated CA Template objects. If preferred, administrators can manually generate the CSR, then upload it to Trust Protection Foundation to complete the enrollment process with the appropriate CA.

Trust Protection Foundation can renew external certificates through integration with several supported external CAs using existing or new private keys. In each case, the term of the renewed certificate is extended to include any life remaining on the previous certificate.

After the CA signs the certificate, Trust Protection Foundation retrieves the certificate and securely stores it in the Secret Store. The administrator can then download the certificate from the Secret Store and install it on the target system(s).

Enrollment is available only for network SSL certificates. Enrollment is enabled in the Certificate object configuration. For more information, see Managing certificate configuration.

For an explanation of the managed stages of the certificate lifecycle, see About certificate lifecycle management.

Changing a certificate's management type

Network Device Enrollment

In addition to conventional certificate enrollment, Trust Protection Foundation now supports certificate enrollment via the SCEP protocol. When Network Device Enrollment is configured, Trust Protection Foundation can receive a CSR from a SCEP-enabled device, renew the certificate with the appropriate CA, then allow the device to download the renewed certificate from the Trust Protection Foundation server.

As a non-CA-based certificate enrollment solution for SCEP systems, Trust Protection Foundation can manage certificate enrollment with multiple CAs using multiple CA templates. Additionally, Trust Protection Foundation provides a robust system of hierarchical, policy-based rules that allow administrators to manage where Certificate objects are created in the Policy tree.

For more information on Network Device Enrollment, see Certificate enrollment via SCEP protocol.