How can we help?

Issue Credential from Sectigo PKI

Anthony - Versasec Support
Anthony - Versasec Support
  • Updated

Introduction

From version 6.2 support has been added to allow the issuance of certificate credentials from Sectigo Certificate Authority (CA). This article will describe how you can configure and use a Sectigo CA to issue a certificate to a credential managed by vSEC:CMS.

In this article we will show you:

  • How to setup a connection to Sectigo CA;
  • Configure a template to issue an S/MINE certificate to a managed credential;
  • Issue a credential;
  • Renew the certificate using the vSEC self service client.
Important
It will be required that at minimum you have already successfully completed the configuration steps described in the article Setup Evaluation Version of vSEC:CMS. The instructions in this document are applicable regardless of whether you are running the evaluation version or a production version.
Important
It will be required to have a Sectigo CA available and it is expected that the reader of this article has knowledge in using/configuring Sectigo CA.

Configure Sectigo Connection

From Options - Connections - Certificate Authorities click Add. Enter a template name and from the drop-down list select Sectigo. In the URL enter the connection URL to Sectigo CA. You can click the Test button to ensure connectivity to the CA. For Customer Uri, Organization ID, User Name and Password enter the appropriate details for your specific account credentials. Click the Test button to ensure that the details are valid.

Click the Request fields button. Depending on how your certificate templates are configured and need to be used you may have different requirements here. In this example we will use 3 fields that we want vSEC:CMS to provide the data for. Click the Fields button. From the left window we will add Certificate validify, Person e-mail and Person first name and click Ok.

It will be necessary to assign values/variables that will be used to populate values to these fields and used when generating the certificate request (CSR). Click the whitespace (as circled below) to open a configuration dialog for the field you want to configure.

In this example we will enter a static value of 90 days for the validity period of the certificate by selecting Use free test and entering the value in the field.

For Person e-mail we select a variable that is configured to map to an AD attribute for the user’s mail attribute (see the article for details on how to create variables Using Variables).

Similarly for Person first name we will assign this to a variable that is mapping to AD attribute cn.

Once complete you should see something like below.

You can click Templates and select Show all followed by Update to see all available certificate templates from your Sectigo CA.

It is recommended to enable Proxy through server checkbox which will mean that all client certificate requests will be proxied through the server.

Configure Credential Template

The next step is to configure an actual credential template where the certificate that is to be issued to the credential token will be set.

1. From Templates - Card Templates click the Add button.

Click the Edit link beside General. Enter a template name. Presuming that you are using one of the minidriver credentials that is supported by vSEC:CMS select Minidriver (Generic minidriver card) for Card type. Leave all other settings as default and click Ok to close and save.

2. Click the Edit link beside Issue Card. In the User ID Options section enable Assign user ID and select the AD connection configured earlier in the drop-down list. In the Enroll Certificate Options section enable Enroll certificate(s) checkbox and click the Add button.Select the Sectigo CA template from the Certificate authority drop-down list and select which CA certificate template you want to use and click Ok. Leave all other settings as is and scroll down to the bottom of the dialog and click Ok to save and close.

3. Click Ok to save and close the template configuration dialog.

Issue Credential

From the Lifecycle page attach a blank credential to your host. If it is a credential that is supported by vSEC:CMS you should see the reader and the credential similar to below.

Important
Depending on the credential that you are testing with it will be necessary to have the appropriate credential drivers installed on your host. Please check with the credential provider that you have the correct credential drivers installed.

Click the Issued oval and select the template from Select card template drop-down list and click Execute.

You will be prompted to enter your operator token passcode before the issuance will begin. Then you will be prompted to select the user from AD that the credential will be issued to. Select the user and at the end of the process you will get a short summary dialog of what operations were performed.

The credential will now show as Issued. The credential PIN by default will be blocked. You will need to set a PIN before you can use the credential. Click the Active oval followed by the Execute button. You will be prompted to authenticate again and then set a PIN that meets the policy supported on the credential.

Once you complete this then you can use the credential certificate for whatever use case it is intended.