Configuring the DigiCert CA template object

To enable Trust Protection Foundation to manage DigiCert CertCentral certificates, you must use Palo Alto Networks's DigiCert CA template to create and configure a DigiCert CA object.

The DigiCert CA object provides Trust Protection Foundation with the information needed to request, retrieve, and install certificates issued by DigiCert CertCentral. This template supports both TLS/SSL and Secure Email (S/MIME) certificate products available in your DigiCert account.

To create and configure a DigiCert CA object

1. From the Certificate Manager menu bar, click Policy Tree.
2. From the Tree drop-down menu, click Policy.
3. In the Policy tree, select the folder where you want to create the CA Template object, and then click Add.
4. Click CA Template, then select DigiCert to create it.
5. In the CA Name box, type a name for the new DigiCert object.

6. Refer to the following table to complete the remaining CA template settings:

   Field	Description
   Account Settings
   API Key	A key used by the DigiCert CA to identify your organization. This key is encrypted using a password credential. When you create a password credential for use with a DigiCert CA template, you must have used the DigiCert API key as the password. If you didn't, you will likely get an error when you save the DigiCert template. If you need to learn how to create a password credential, see About credential objects.
   Validate	Click Validate to verify the API Key. If an access_denied_invalid_key error occurs, open the Credential, specify the DigiCert password, and then retry. Once the credentials are validated, the Product Name list (below, under Options) is populated with the products available to your organization. NOTE  The templates that appear in the Product Name list depend on how you've set up your DigiCert account.
   Options	Selects whether the approval process is manual or automatic.
   Product Name	Select from the list of products available based on the API Key used to authenticate to the DigiCert CA. The DigiCert driver supports both TLS/SSL and Secure Email (S/MIME) products, including: Secure Email for Employee Secure Email for Individual Mailbox Secure Email for Organization When a Secure Email product is selected, additional certificate request fields appear when configuring certificate objects. These fields are described in DigiCert CertCentral—certificate settings.
   Organization	Select the organization licensed to use the DigiCert product. Generally, this value should be the same as the Organization value specified in the CSR. It does not have to be identical because DigiCert uses fuzzy matching logic to allow for minor differences.
   Subject Alt Name Enabled	Configures the current CA template object to support CSRs with DNS-based subject alt name (SAN) values. NOTE  DNS SANs are included in the Unified Communications Certificates that are used with Microsoft Exchange 2007 and Microsoft Office Communications Server. If you do not select this option, the current CA template object will not accept CSRs with SAN values. If Trust Protection Foundation attempts to submit a CSR with SAN values, the CA Template object returns the following error: Stage 400 (Creating CSR) SubjectAltName not supported by Application and CA. IMPORTANT  Before selecting this option, you must also verify the SAN feature is enabled on your CA engine. It it isn't, the CA returns the same error message when Trust Protection Foundation attempts to submit a CSR with SAN values. For Secure Email (S/MIME) products, at least one Email SAN is required in the certificate request.
   Signature Algorithm	Lets you select the algorithm DigiCert uses when signing a requested certificate. You must select one of the following supported signature algorithms: SHA256 (default) SHA384 SHA512
   Organizational Unit Override	(Optional) Type one or more OU values to submit to DigiCert with the CSR to override the OUs specified by policy or in the CSR. You must enter one OU value per line. If no organizational unit override values are specified on the CA template, then the OUs specified on the CSR are submitted to DigiCert with the CSR.
   Allow Reissuance	Check the Allow Reissuance box and type a number (in days) in the Renewal Window field if you want to allow some certificate renewals to be handled as reissuance requests. This setting is disabled (unchecked) by default. Allow Reissuance is useful in situations where you need to renew a certificate but do not want to change its original expiration date. If you disable Allow Reissuance and a certificate's remaining validity is outside of the Renewal Window, then an error should result indicating the certificate cannot be reissued because the CA template doesn't allow it. If that occurs, then you'll need to request that a Trust Protection Foundation administrator enable Allow Reissuance on the CA template, revoke and then renew the certificate, or create a new certificate object and enroll it using the same CA template (since it would be treated as a first-time enrollment). TIP  If you issue a certificate using the Specific End Date option that is set outside of the renewal window, the certificate is reissued with the expiration date you specified in Specific End Date. EXAMPLE  Suppose you're updating SHA1 certificates to SHA2. However, you know that updating them could result in changing their expiration dates to fall inside of a freeze period—a time in which your IT department is verifying network and system stability. To avoid this collision, you enable Allow Reissuance to ensure that the certificate's expiration date remains the same. You accept the default 90-day renewal window because it is longer than your freeze period.
   Renewal Window (days)	Specify the number of days before expiration that you plan to renew certificates. The default renewal window is 32 days for all newly created DigiCert templates. Typically, 30 to 90 days ensures sufficient time for all the necessary approvals and processes to be completed so that the renewed certificate is in place before the old certificate expires. You must select a value that is greater than 0 and less than (or equal to) 365 days.
   Skip Approval	The DigiCert driver updated to support DigiCert's new Skip Approval option for faster performance. DID YOU KNOW?  Skip Approval streamlines the processes for an increase in performance of up 30%. To take advantage of this, the Manual Approval option has been removed from the Palo Alto Networks DigiCert driver workflow resulting in quicker certificate approvals.
   Certificate Transparency	Select Send certificate to a CT log server to enable support for your Entrust CT log server. This is the default setting. To disable it, select Do not send certificates to a CT log server. The second option requires that you have configured your DigiCert account to allow this action. To configure DigiCert CertCentral to allow disabling CT log server function Open the DigiCert CertCentral web portal. Click Settings > Preferences. Click Advanced Settings, and then scroll down to the Certificate Requests section. Select the Allow users to change CT logging per request check box to opt out of CT logging for certificates enrolled using a CA template.
   Validity Period	Assign a validity period to be used when enrolling certificates. Options include 90 days, 6 months, and 1 year (default). TIP  If you need to define multiple validity periods, create additional CA objects that differ only in the validity period assignment.
   Allow Users to Specify End Date	The Allow Users to Specify End Date option lets users specify expiration (end) dates for certificates requested from the CA so that they do not expire during your known freeze periods. Typically, renewing certificates that expire during freeze periods requires a more challenging approval process. Setting expiration (or end) dates that fall outside of freeze periods avoids potential interruptions. When a specific end date has been specified, the issued certificate has that date as its expiration date. This check box is cleared after successful enrollment (so that the validity period takes effect thereafter).
   Custom Fields	Custom Fields allow you to extend out-of-the-box capabilities to capture data points unique to your environment. Before custom fields can be selected on a CA template or certificate object, they must first be created in Aperture (Configuration > Custom Fields) and applied to the Certificate object type. For more information on creating or configuring custom fields, see Working with custom fields. To enable Custom Fields with DigiCert CertCentral: Click Add/Remove below Custom Fields. The Add or Remove Custom Fields dialog box appears. Select a previously created custom field in the Select Custom Field drop down. Click Add. Your previously selected custom field add to the Custom Field(s) box. Click Done. NOTE: Any custom field configured here that is not also present in your DigiCert account will be silently ignored during the enrollment process. Ensure your DigiCert account is configured to accept these specific fields to avoid data loss.

7. (Optional) To see additional attributes, review the settings on the Support tab.
8. Click Save.

What's next?

After you create a CA object, you can select it from the Policy tree, and then view important information and manage various settings.

• Click the General tab to view and modify log and permissions settings.

  • Click the Log sub-tab to view any logged events that are triggered by the template object.

    IMPORTANT  You must have the Read permission to view the Log tab.

    For more information about options found on the Log tab, see Viewing log events.

  • On the Permissions sub-tab, you can configure the users or groups to whom you want to grant permissions to the new template object.

    Consider managing object permissions via parent objects so that you can take advantage of inheritance. For more information, see Permission inheritance and flow down.

Related Topics