Introduction

If you are using a Microsoft Certificate Authority (MS CA) and you have not already configured vSEC:CMS to perform Enrollment Agent (EA) signing on the server-side then follow the instructions in this article to perform such a configuration. This is the recommended way to configure EA signing when using a MS CA with vSEC:CMS.

Prerequisites

It will be expected that you have at minimum in place:

• A fully operational vSEC:CMS already configured and using MS CA;

• The vSEC:CMS service is configured to run under a dedicated Windows account as described in this article Configure Dedicated Windows Service Account.

CA Configuration

Prerequisites

Before going into the details on how to re-configure the CA connection in vSEC:CMS such that EA signing will be performed server-side, it is important that you have made the necessary configurations on the CA.

For this article we will presume that you already have an EA and Windows logon template in place and operational on the MS CA. It will be required to give the dedicated Windows account that vSEC:CMS service is running under the appropriate permissions on the certificate templates on the CA.

For example, below we have a Windows dedicated account that vSEC:CMS service is running under. We have given this account permissions for the EA template on the CA in the Security tab with a minimum permission of Enroll.

Additionally, for the EA it is important that the Issuance Requirements tab are set like below.

For the Windows logon certificate template, in this example, you will need to make sure that the dedicated Windows account for vSEC:CMS service is given the appropriate permissions on such template. For example, you should at minimum add the Windows account to the Security tab and grant the permissions like below.

Finally, the local System account will need to be given revocation permissions on the CA. Right click the root of your CA and select Properties.

From the Security tab click the Add button and add the dedicated Windows account and grant the permissions as in below example.

CA Connection Configuration

It will be required that you RDP directly to vSEC:CMS server and log on with the dedicated Windows account that vSEC:CMS is running under.

With your System Owner (SO) credential attached, open the vSEC:CMS console.

Navigate to Options - Connections - Certificate Authorities and select your CA connection and click Edit. In the Enrollment Agent section enable Sign server-side and click the Request button. If more than one EA template is available in your environment a popup dialog will appear from which you need to select the correct EA template to be used. The EA certificate will then be issued and stored in the local certificate store of the dedicated Windows account that vSEC:CMS service is running under.

Additionally, it is recommended to enable the setting Disable retrieving renewed certificates before revocation.

Click Save to save and close.

vSEC:CMS will then use this EA certificate to sign certificate requests regardless of whether the certificate is being issued by an Operator or via the self-service client.