Certificate enrollment objects

Certificate enrollment object reference information

Trustpoints let you manage and track CAs and certificates. A trustpoint is a representation of a CA or identity pair. A trustpoint includes the identity of the CA, CA-specific configuration parameters, and an association with one, enrolled identity certificate.

This section describes how to use and manage certificate enrollment objects in your PKI infrastructure.

• Certificate enrollment objects are used to enroll managed devices into your PKI infrastructure and create trustpoints (CA objects) on devices that support VPN connections.

• To manage certificate enrollment objects, go to Objects > PKI > Certificate Enrollment. The following information is shown:

  • Existing certificate enrollment objects are listed in the Name column. Use the search field (the magnifying glass) to filter the list.

  • The enrollment type of each object is shown in the Type column. These enrollment methods can be used:

    • Self Signed—The managed device generates its own self signed root certificate.

    • EST—Enrollment over Secure Transport is used by the device to obtain an identity certificate from the CA.

    • SCEP—(Default) Simple Certificate Enrollment Protocol (SCEP) is used by the device to obtain an identity certificate from the CA.

    • Manual—The process of enrolling is carried out manually by the administrator.

    • PKCS12 File—Import a PKCS12 file on a Threat Defense managed device that supports VPN connectivity. A PKCS#12, or PFX or P12 file holds the server certificate, any intermediate certificates, and the private key in one encrypted file. Enter the Passphrase value for decryption.

  • The Override column indicates whether the object allows overrides (a green check mark) or not (a red X). If a number is displayed, it is the number of overrides in place. Use the Override option to customize the object settings for each device that is part of the VPN configuration. Overriding makes each device's trustpoint details unique. Typically the Common Name or Subject is overridden for each device in the VPN configuration. See Object overrides for details and procedures on overriding objects of any type.

  • Edit a previously created certificate enrollment object by clicking on the edit icon (a pencil). Editing can only be done if the enrollment object is not associated with any managed devices. Refer to the adding instructions for editing a certificate enrollment object. Failed enrollment objects can be edited.

  • Delete a previously created certificate enrollment object by clicking on the delete icon (a trash can). You cannot delete a certificate enrollment object if it is associated with any managed device.

1. Define parameters for CA authentication and enrollment in a certificate enrollment object. Specify shared parameters and use the override facility to specify unique object settings for different devices.

2. Associate and install this object on each managed device that requires the identity certificate. On the device, it becomes a trustpoint.

   When a certificate enrollment object is associated with and then installed on a device, the process of certificate enrollment starts immediately. The process is automatic for self-signed, SCEP, EST, and PKCS12 file enrollment types, meaning it does not require any additional administrator action. Manual certificate enrollment requires extra administrator action.

3. Specify the created trustpoint in your VPN configuration.

Press ()Add Cert Enrollment to open the Add Cert Enrollment dialog and configure a certificate enrollment object, see Add certificate enrollment objects. Then install the certificate on each managed, headend device.

For more information on PKI, digital certificates, and certificate enrollment see PKI infrastructure and digital certificates.