Adding the Trusted Root Certificates

You must upload the trusted root certificates for the PKI method. These certificates must meet the following requirements:

  • Root CA certificate is in the .pem format.

  • You can also upload intermediate certificate if the root certificate is not self signed or it is cross signed by another CA.

  • All certificates in the certification path (except Root CA) contain AIA and CDP http link to check revocation status.

  • The certificate for PKI device contains a key pair: public and private key in the x509 format. The certificates that do not comply with the requirements are ignored and hidden during enrollment.

For more information, see Single Tier PKI Hierarchy Deployment and Two Tier PKI Hierarchy Deployment.

To upload a new trusted root certificate, perform the following steps:

  1. Click Add in the PKI page.

  2. Click Browse.

  3. Choose a .pem certificate file and click Upload.

  4. Click Save.

You can configure the PKI method (with certificates) in one of the following ways:

NOTE:Advanced Authentication supports the p7b format of parent certificates. These p7b format files can contain certificates and chain certificates, but not the private key. They are Base64 encoded ASCII files with extensions .p7b or.p7c.

Configuring Active Directory Certificate Services for a Standalone Root CA

For generating the root CA certificate on Microsoft Windows Active Directory Certificate Services (ADCS), perform the following steps:

  1. Install Web Server (IIS) Role.

  2. Create the CertEnroll Folder and grant Share & NTFS permissions to the Cert Publishers group.

  3. Create CertEnroll Virtual Directory in IIS.

  4. Enable Double Escaping on IIS Server.

  5. Install Enterprise Root CA using Server Manager.

  6. Enable Object Access Auditing on CA.

  7. Configure the AIA and CDP.

  8. Publish the Root CA Certificate to AIA.

  9. Export Root CA in .der format and convert the format to .pem.

  10. Export personal certificate (that was signed by Root CA) with private key and place it on a PKI device.

Configuring Active Directory Certificate Services for a Subordinate CA

For generating the subordinate CA certificate on Microsoft Windows Active Directory Certificate Services (ADCS), perform the following steps:

  1. Install Web Server (IIS) Role.

  2. Create the CertEnroll Folder and grant Share & NTFS permissions to Cert Publishers group.

  3. Create CertEnroll Virtual Directory in IIS.

  4. Enable Double Escaping on IIS Server.

  5. Install the Standalone Offline Root CA.

  6. Create a CAPolicy.inf for the standalone offline root CA.

  7. Installing the Standalone Offline Root CA.

  8. Enable Auditing on the Root CA.

  9. Configure the AIA and CDP.

  10. Install Enterprise Issuing CA.

  11. Create CAPolicy.inf for Enterprise Root CA.

  12. Publish the Root CA Certificate and CRL.

  13. Install Subordinate Issuing CA.

  14. Submit the Request and Issue subordinate Issuing CA Certificate.

  15. Install the subordinate Issuing CA Certificate.

  16. Configure Certificate Revocation and CA Certificate Validity Periods.

  17. Enable Auditing on the Issuing CA.

  18. Configure the AIA and CDP.

  19. Install and configure the Online Responder Role Service.

  20. Add the OCSP URL to the subordinate Issuing CA.

  21. Configure and publish the OCSP Response Signing Certificate on the subordinate Issuing CA.

  22. Configure Revocation Configuration on the Online Responder.

  23. Configure Group Policy to provide the OCSP URL for the subordinate Issuing CA.

  24. Export Root CA in .der format and convert the format to .pem.

  25. Export personal certificate (that was signed by subordinate CA) with private key and place it on a PKI device.