NGTS CA

The NGTS CA driver lets Trust Protection Foundation request, retrieve, renew and revoke private certificates issued by the NextGen Trust Security certificate authority. Before you create the CA template object, create a built-in account in NextGen Trust Security and store its key pair in Trust Protection Foundation as a credential.

What the built-in account needs

• The Certificate Lifecycle use case. A built-in account serves one use case, so an account created for anything else cannot be reused here. When the account's token carries a different use case, the driver refuses the connection and the error names the use case it needs.

• A key pair rather than a password. The account authenticates with an RSA or EC signing key. Trust Protection Foundation signs an assertion with the private key, exchanges it for a short-lived access token, and renews the token on its own.

• The tenant's TSG ID. Trust Protection Foundation builds the NextGen Trust Security service addresses from the TSG ID, so there is no region to select.

Configuring Trust Protection Foundation

Store the built-in account in Trust Protection Foundation before you create the CA template object.

1. In Trust Protection Foundation, create a Private Key Credential. For instructions, refer to Creating private key credentials.

2. In User Name, enter the built-in account's client ID.

3. Attach the private key that belongs to that account.

4. Save the credential. You select it in the Credential field when you configure the NGTS CA template object.

The following topics include the steps required to set up the NGTS CA.