Create Environment Templates

Code Signing Environment Templates allow the Code Signing Administrator to suggest or require specific values to be used in CodeSign Protect Project Environments. Each project will include at least one environment.

Add a Single Template

Single templates included just one certificate or key.

Certificate Authorities are associated with Project Environments, so the options set in the Certificate Environment Template eventually flow into the certificates that get issued.

  1. Click Certificate from the Add Single Template section of the Actions panel.

  2. Give the template a name. This name is what Project Owners will see in the web interface when using this Environment Template in code signing projects.

    DID YOU KNOW?  When Project Owners select an Environment Template during project creation in the CodeSign Protect web interface, a - Single suffix will automatically be added to the template name you provide here. For example, if you name the template Development, it will appear as Development - Single in the web interface. This is to help Project Owners quickly see whether a project is a single key environment or a per user environment.

  3. Complete the tabs according to the following guidelines:

    NOTE  A number of the tabs include a Do not allow users to enter their own values in projects checkbox. Checking this will restrict the Owner's ability to enter any value other than what is specified in the template.

    Tab Guidelines

    Certificate Authority

    Select which Certificate Authority (CA) Templates will be available to select when creating a Project Environment using this Environment Template. The CA templates must exist in order for them to be selected. For information on creating CA templates, see Create Certificate Authority (CA) templates .

    To add a CA Template

    1. Click the Select Certificate Authority Templates drop-down and select a CA template to add to this Template. You can also search for a template by typing any part of the template name into the Search box.
    2. With a CA template highlighted, click Select. The certificate path populates in the Select Certificate Authority Template box.
    3. Click Add.
    4. Repeat these steps for any other CA templates you want to add.
    5. Click Apply.

    City

    The city name that appears as part of the Subject DN of the certificate. This field is also known as the locale.
    Common Name

    The common name (CN) that appears as part of the Subject DN of the certificate.

    Country

    The two character country code that appears as part of the Subject DN of the certificate. For a list of valid country codes see Country codes.

    E-mail

    The email address to use as a SAN on the certificate.

    Key Storage

    Select which Key Storage locations you want to make available. From the drop-down, select an option, and then click Add. Repeat for each Key Storage location you want to add.

    Any HSM connectors that you have defined will appear in this list.

    Keys

    Select the encryption algorithms that you want to make available to Owners to choose from.

    Organization

    The Organization (O) name that appears as part of the Subject DN of the certificate.

    Organizational Unit

    The Organizational Unit (OU) name that appears as part of the Subject DN of the certificate.

    Request Instance Identification

    Instance identification allows you to select which components to use to uniquely identify signing requests. Select whether to Use Global Settings or Use Custom Settings for this Environment Template. For a description of each setting, see Request Instance Identification tab.

    Settings

    Description: Allows you to specify a custom description for this environment template. The description will appear in the Actions panel of the Venafi Configuration Console, and it will also appear in Aperture during project creation.

    Certificate Container: Allows you to specify the location where certificates associated with this environment will be stored. If left blank, the default location specified in the global code signing properties will be used. To view the global default location, click the Venafi Code Signing node, and then click Properties.

    Signing Flow: Allows you to specify the Flow associated with this environment. Click the drop-down list, and then search for the Flow you want to add. This list is populated from the Flows node within the Venafi Code Signing node.

    NOTE  If you're changing the Flow on an existing template, this change will be inherited by any existing Environments that use this template. This will clear any approvals in process for Environments using this template.

    State

    The state (ST) name that appears as part of the Subject DN of the certificate.

    Visibility

    Select the users or groups that should be able to see this Environment Template. Leaving this field empty makes this template available to all users. Adding users to this field restricts this template to just those users listed.

    All users and groups that are currently assigned have visibility. However, you can only add users and groups that are part of your identity provider. For example, local users can't add Active Directory users or groups, nor can Active Directory users add local users or groups.

    Removing users and groups is possible across identity providers.

    NOTE  If an end-user does not have visibility to any Environment Templates, they will not be able to create new projects.

Certificate Authorities are associated with Project Environments, so the options set in the Certificate Environment Template eventually flow into the certificates that get issued.

  1. Click Apple from the Add Single Template section of the Actions panel.

  2. Give the template a name. This name is what Project Owners will see in the web interface when using this Environment Template in code signing projects.

    DID YOU KNOW?  When Project Owners select an Environment Template during project creation in the CodeSign Protect web interface, a suffix will automatically be added to the template name you provide here. For example, if you name the template Development, it will appear as in the web interface. This is to help Project Owners quickly see whether a project is a single key environment or a per user environment.

  3. Complete the tabs according to the following guidelines:

    NOTE  A number of the tabs include a Do not allow users to enter their own values in projects checkbox. Checking this will restrict the Owner's ability to enter any value other than what is specified in the template.

    Tab Guidelines

    Request Instance Identification

    Instance identification allows you to select which components to use to uniquely identify signing requests. Select whether to Use Global Settings or Use Custom Settings for this Environment Template. For a description of each setting, see Request Instance Identification tab.

    Settings

    Description: Allows you to specify a custom description for this environment template. The description will appear in the Actions panel of the Venafi Configuration Console, and it will also appear in Aperture during project creation.

    Certificate Container: Allows you to specify the location where certificates associated with this environment will be stored. If left blank, the default location specified in the global code signing properties will be used. To view the global default location, click the Venafi Code Signing node, and then click Properties.

    Signing Flow: Allows you to specify the Flow associated with this environment. Click the drop-down list, and then search for the Flow you want to add. This list is populated from the Flows node within the Venafi Code Signing node.

    NOTE  If you're changing the Flow on an existing template, this change will be inherited by any existing Environments that use this template. This will clear any approvals in process for Environments using this template.

    Visibility

    Select the users or groups that should be able to see this Environment Template. Leaving this field empty makes this template available to all users. Adding users to this field restricts this template to just those users listed.

    All users and groups that are currently assigned have visibility. However, you can only add users and groups that are part of your identity provider. For example, local users can't add Active Directory users or groups, nor can Active Directory users add local users or groups.

    Removing users and groups is possible across identity providers.

    NOTE  If an end-user does not have visibility to any Environment Templates, they will not be able to create new projects.
  1. Click .NET from the Add Single Template section of the Actions panel.

  2. Give the template a name. This name is what Project Owners will see in the web interface when using this Environment Template in code signing projects.

    DID YOU KNOW?  When Project Owners select an Environment Template during project creation in the CodeSign Protect web interface, a - Single suffix will automatically be added to the template name you provide here. For example, if you name the template Development, it will appear as Development - Single in the web interface. This is to help Project Owners quickly see whether a project is a single key environment or a per user environment.

  3. Complete the tabs according to the following guidelines:

    NOTE  A number of the tabs include a Do not allow users to enter their own values in projects checkbox. Checking this will restrict the Owner's ability to enter any value other than what is specified in the template.

    Tab Guidelines

    Expiration

    		 The time frame for which a key remains valid before being automatically renewed.

    Key Storage

    Select which Key Storage locations you want to make available. From the drop-down, select an option, and then click Add. Repeat for each Key Storage location you want to add.

    Any HSM connectors that you have defined will appear in this list.

    Keys

    Select the encryption algorithms that you want to make available to Owners to choose from.

    Request Instance Identification

    Instance identification allows you to select which components to use to uniquely identify signing requests. Select whether to Use Global Settings or Use Custom Settings for this Environment Template. For a description of each setting, see Request Instance Identification tab.

    Settings

    Description: Allows you to specify a custom description for this environment template. The description will appear in the Actions panel of the Venafi Configuration Console, and it will also appear in Aperture during project creation.

    Key Container: Allows you to specify the location where keys associated with this environment will be stored. If left blank, the default location specified in the global code signing properties will be used. To view the global default location, click the Venafi Code Signing node, and then click Properties.

    Signing Flow: Allows you to specify the Flow associated with this environment. Click the drop-down list, and then search for the Flow you want to add. This list is populated from the Flows node within the Venafi Code Signing node.

    NOTE  If you're changing the Flow on an existing template, this change will be inherited by any existing Environments that use this template. This will clear any approvals in process for Environments using this template.

    Visibility

    Select the users or groups that should be able to see this Environment Template. Leaving this field empty makes this template available to all users. Adding users to this field restricts this template to just those users listed.

    All users and groups that are currently assigned have visibility. However, you can only add users and groups that are part of your identity provider. For example, local users can't add Active Directory users or groups, nor can Active Directory users add local users or groups.

    Removing users and groups is possible across identity providers.

    NOTE  If an end-user does not have visibility to any Environment Templates, they will not be able to create new projects.
  1. Click GPG from the Add Single Template section of the Actions panel.

  2. Give the template a name. This name is what Project Owners will see in the web interface when using this Environment Template in code signing projects.

    DID YOU KNOW?  When Project Owners select an Environment Template during project creation in the CodeSign Protect web interface, a - Single suffix will automatically be added to the template name you provide here. For example, if you name the template Development, it will appear as Development - Single in the web interface. This is to help Project Owners quickly see whether a project is a single key environment or a per user environment.

  3. Complete the tabs according to the following guidelines:

    NOTE  A number of the tabs include a Do not allow users to enter their own values in projects checkbox. Checking this will restrict the Owner's ability to enter any value other than what is specified in the template.

    Tab Guidelines

    Authentication Keys

    Encryption algorithms for the GPG authentication keys that you want to make available to Owners to choose from.

    E-mail

    E-mail address of the person using the GPG key. Together with the Real Name, this becomes part of the user ID (UID). The user ID is used to associate the key with a real person and is used to identify the key when signing.

    Encryption Keys

    Encryption algorithms for the GPG encryption keys that you want to make available to Owners to choose from.

    Expiration

    		 The time frame for which a key remains valid before being automatically renewed.

    Key Storage

    Select which Key Storage locations you want to make available. From the drop-down, select an option, and then click Add. Repeat for each Key Storage location you want to add.

    Any HSM connectors that you have defined will appear in this list.

    Real Name

    Real name of the person using the GPG key. Together with the E-mail address, this becomes part of the user ID (UID). The user ID is used to associate the key with a real person and is used to identify the key when signing.

    For per-user environments, this field supports macros.

    Using suggested macros (available in the user interface)

    Following are commonly-used macros, which are suggested in the user interface:

    "$Identity[$Sign.User$]$"
    Resolves to the username for the key user from the identify provider
    "$Identity[$Sign.User$,Given Name]$"
    Resolves to given name for the key user from the identity provider
    "$Identity[$Sign.User$,Surname]$"
    Resolves to surname for the key user from the identity provider
    "$IdentityEmail[$Sign.User$]$"
    Resolves to surname for the key user from the identity provider
    "$Sign.User$"
    Resolves to the prefix universal GUID
    "$Sign.Project$"
    Resolves to the CodeSign Protect Project name, which is set by the Project Owner
    "$Sign.Environment$"
    Resolves to the CodeSign Protect Environment name, which is set by the Project Owner
    "$Sign.EnvironmentType$"
    Resolves to the environment type

    Using custom macros

    You can also use your own macro. For example, the following macro would resolve to the key user's Department value from your identify provider:

    "$Identity[$Sign.User$,Department]$

    Learn more

    For additional information on macros, see Macro overview.

    Request Instance Identification

    Instance identification allows you to select which components to use to uniquely identify signing requests. Select whether to Use Global Settings or Use Custom Settings for this Environment Template. For a description of each setting, see Request Instance Identification tab.

    If this Template uses a Flow that includes an Approver from Configuration or Fixed Approver action, you need to disable the Command Line instance identifier (which is enabled by default).

    On the Request Instance Identification tab, select the Use Custom Settings radio button, then select the instance identifiers you want to use. The recommended defaults are:

    • Signing Key Identifier
    • Requesting Machine Name
    • Username of requestor on signing machine.

    Settings

    Description: Allows you to specify a custom description for this environment template. The description will appear in the Actions panel of the Venafi Configuration Console, and it will also appear in Aperture during project creation.

    Key Container: Allows you to specify the location where keys associated with this environment will be stored. If left blank, the default location specified in the global code signing properties will be used. To view the global default location, click the Venafi Code Signing node, and then click Properties.

    Signing Flow: Allows you to specify the Flow associated with this environment. Click the drop-down list, and then search for the Flow you want to add. This list is populated from the Flows node within the Venafi Code Signing node.

    NOTE  If you're changing the Flow on an existing template, this change will be inherited by any existing Environments that use this template. This will clear any approvals in process for Environments using this template.

    Signing Keys

    Select the encryption algorithms for the GPG signing keys that you want to make available to Owners to choose from.

    Visibility

    Select the users or groups that should be able to see this Environment Template. Leaving this field empty makes this template available to all users. Adding users to this field restricts this template to just those users listed.

    All users and groups that are currently assigned have visibility. However, you can only add users and groups that are part of your identity provider. For example, local users can't add Active Directory users or groups, nor can Active Directory users add local users or groups.

    Removing users and groups is possible across identity providers.

    NOTE  If an end-user does not have visibility to any Environment Templates, they will not be able to create new projects.

Certificate Authorities are associated with Project Environments, so the options set in the Certificate Environment Template eventually flow into the certificates that get issued.

  1. Click Key Pair from the Add Single Template section of the Actions panel.

  2. Give the template a name. This name is what Project Owners will see in the web interface when using this Environment Template in code signing projects.

    DID YOU KNOW?  When Project Owners select an Environment Template during project creation in the CodeSign Protect web interface, a suffix will automatically be added to the template name you provide here. For example, if you name the template Development, it will appear as in the web interface. This is to help Project Owners quickly see whether a project is a single key environment or a per user environment.

  3. Complete the tabs according to the following guidelines:

    NOTE  A number of the tabs include a Do not allow users to enter their own values in projects checkbox. Checking this will restrict the Owner's ability to enter any value other than what is specified in the template.

    Tab Guidelines

    Expiration

    		 The time frame for which a key remains valid before being automatically renewed.

    Key Storage

    Select which Key Storage locations you want to make available. From the drop-down, select an option, and then click Add. Repeat for each Key Storage location you want to add.

    Any HSM connectors that you have defined will appear in this list.

    Keys

    Select the encryption algorithms that you want to make available to Owners to choose from.

    Request Instance Identification

    Instance identification allows you to select which components to use to uniquely identify signing requests. Select whether to Use Global Settings or Use Custom Settings for this Environment Template. For a description of each setting, see Request Instance Identification tab.

    Settings

    Description: Allows you to specify a custom description for this environment template. The description will appear in the Actions panel of the Venafi Configuration Console, and it will also appear in Aperture during project creation.

    Key Container: Allows you to specify the location where keys associated with this environment will be stored. If left blank, the default location specified in the global code signing properties will be used. To view the global default location, click the Venafi Code Signing node, and then click Properties.

    Signing Flow: Allows you to specify the Flow associated with this environment. Click the drop-down list, and then search for the Flow you want to add. This list is populated from the Flows node within the Venafi Code Signing node.

    NOTE  If you're changing the Flow on an existing template, this change will be inherited by any existing Environments that use this template. This will clear any approvals in process for Environments using this template.

    Visibility

    Select the users or groups that should be able to see this Environment Template. Leaving this field empty makes this template available to all users. Adding users to this field restricts this template to just those users listed.

    All users and groups that are currently assigned have visibility. However, you can only add users and groups that are part of your identity provider. For example, local users can't add Active Directory users or groups, nor can Active Directory users add local users or groups.

    Removing users and groups is possible across identity providers.

    NOTE  If an end-user does not have visibility to any Environment Templates, they will not be able to create new projects.

Add a Per-User Template

Per-User templates allow multiple keys or certificates to be associated with a single Environment. This can be useful for things like individual user GPG keys for git signing.

Per-user environments allow multiple user-based certificates to be associated with a single environment. In order to help differentiate the certificates that are issued, per-user environments support macros in a number of fields. As such, Code Signing Administrators can use a single per-user environment template to issue unique certificates.

For fields that support macros, the user interface provides suggestions for common macros. You can use the common macros by clicking them. While these macros are suggested, they are not required.

Using suggested macros (available in the user interface)

Following are commonly-used macros, which are suggested in the user interface:

"$Identity[$Sign.User$]$"
Resolves to the username for the key user from the identify provider
"$Identity[$Sign.User$,Given Name]$"
Resolves to given name for the key user from the identity provider
"$Identity[$Sign.User$,Surname]$"
Resolves to surname for the key user from the identity provider
"$IdentityEmail[$Sign.User$]$"
Resolves to surname for the key user from the identity provider
"$Sign.User$"
Resolves to the prefix universal GUID
"$Sign.Project$"
Resolves to the CodeSign Protect Project name, which is set by the Project Owner
"$Sign.Environment$"
Resolves to the CodeSign Protect Environment name, which is set by the Project Owner
"$Sign.EnvironmentType$"
Resolves to the environment type

Using custom macros

You can also use your own macro. For example, the following macro would resolve to the key user's Department value from your identify provider:

"$Identity[$Sign.User$,Department]$

Learn more

For additional information on macros, see Macro overview.

  1. Click Certificate from the Add Per-User Template section of the Actions panel.

  2. Give the template a name. This name is what Project Owners will see in the web interface when using this Environment Template in code signing projects.

    DID YOU KNOW?  When Project Owners select an Environment Template during project creation in the CodeSign Protect web interface, a - Per User suffix will automatically be added to the template name you provide here. For example, if you name the template Development, it will appear as Development - Per User in the web interface. This is to help Project Owners quickly see whether a project is a single key environment or a per user environment.

  3. Complete the tabs according to the following guidelines:

    NOTE  A number of the tabs include a Do not allow users to enter their own values in projects checkbox. Checking this will restrict the Owner's ability to enter any value other than what is specified in the template.

    Tab Guidelines

    Certificate Authority

    Select which Certificate Authority (CA) Templates will be available to select when creating a Project Environment using this Environment Template. The CA templates must exist in order for them to be selected. For information on creating CA templates, see Create Certificate Authority (CA) templates .

    To add a CA Template

    1. Click the Select Certificate Authority Templates drop-down and select a CA template to add to this Template. You can also search for a template by typing any part of the template name into the Search box.
    2. With a CA template highlighted, click Select. The certificate path populates in the Select Certificate Authority Template box.
    3. Click Add.
    4. Repeat these steps for any other CA templates you want to add.
    5. Click Apply.

    City

    The city name that appears as part of the Subject DN of the certificate. This field is also known as the locale.

    For per-user environments, this field supports macros.

    Using suggested macros (available in the user interface)

    Following are commonly-used macros, which are suggested in the user interface:

    "$Identity[$Sign.User$]$"
    Resolves to the username for the key user from the identify provider
    "$Identity[$Sign.User$,Given Name]$"
    Resolves to given name for the key user from the identity provider
    "$Identity[$Sign.User$,Surname]$"
    Resolves to surname for the key user from the identity provider
    "$IdentityEmail[$Sign.User$]$"
    Resolves to surname for the key user from the identity provider
    "$Sign.User$"
    Resolves to the prefix universal GUID
    "$Sign.Project$"
    Resolves to the CodeSign Protect Project name, which is set by the Project Owner
    "$Sign.Environment$"
    Resolves to the CodeSign Protect Environment name, which is set by the Project Owner
    "$Sign.EnvironmentType$"
    Resolves to the environment type

    Using custom macros

    You can also use your own macro. For example, the following macro would resolve to the key user's Department value from your identify provider:

    "$Identity[$Sign.User$,Department]$

    Learn more

    For additional information on macros, see Macro overview.
    Common Name

    The common name (CN) that appears as part of the Subject DN of the certificate.

    NOTE  For per-user Environments, this field requires macros.

    Country

    The two character country code that appears as part of the Subject DN of the certificate. For a list of valid country codes see Country codes.

    E-mail

    The email address to use as a SAN on the certificate.

    For per-user environments, this field supports macros.

    Using suggested macros (available in the user interface)

    Following are commonly-used macros, which are suggested in the user interface:

    "$Identity[$Sign.User$]$"
    Resolves to the username for the key user from the identify provider
    "$Identity[$Sign.User$,Given Name]$"
    Resolves to given name for the key user from the identity provider
    "$Identity[$Sign.User$,Surname]$"
    Resolves to surname for the key user from the identity provider
    "$IdentityEmail[$Sign.User$]$"
    Resolves to surname for the key user from the identity provider
    "$Sign.User$"
    Resolves to the prefix universal GUID
    "$Sign.Project$"
    Resolves to the CodeSign Protect Project name, which is set by the Project Owner
    "$Sign.Environment$"
    Resolves to the CodeSign Protect Environment name, which is set by the Project Owner
    "$Sign.EnvironmentType$"
    Resolves to the environment type

    Using custom macros

    You can also use your own macro. For example, the following macro would resolve to the key user's Department value from your identify provider:

    "$Identity[$Sign.User$,Department]$

    Learn more

    For additional information on macros, see Macro overview.

    Key Storage

    Select which Key Storage locations you want to make available. From the drop-down, select an option, and then click Add. Repeat for each Key Storage location you want to add.

    Any HSM connectors that you have defined will appear in this list.

    Organization

    The Organization (O) name that appears as part of the Subject DN of the certificate.

    For per-user environments, this field supports macros.

    Using suggested macros (available in the user interface)

    Following are commonly-used macros, which are suggested in the user interface:

    "$Identity[$Sign.User$]$"
    Resolves to the username for the key user from the identify provider
    "$Identity[$Sign.User$,Given Name]$"
    Resolves to given name for the key user from the identity provider
    "$Identity[$Sign.User$,Surname]$"
    Resolves to surname for the key user from the identity provider
    "$IdentityEmail[$Sign.User$]$"
    Resolves to surname for the key user from the identity provider
    "$Sign.User$"
    Resolves to the prefix universal GUID
    "$Sign.Project$"
    Resolves to the CodeSign Protect Project name, which is set by the Project Owner
    "$Sign.Environment$"
    Resolves to the CodeSign Protect Environment name, which is set by the Project Owner
    "$Sign.EnvironmentType$"
    Resolves to the environment type

    Using custom macros

    You can also use your own macro. For example, the following macro would resolve to the key user's Department value from your identify provider:

    "$Identity[$Sign.User$,Department]$

    Learn more

    For additional information on macros, see Macro overview.

    Organizational Unit

    The Organizational Unit (OU) name that appears as part of the Subject DN of the certificate.

    For per-user environments, this field supports macros.

    Using suggested macros (available in the user interface)

    Following are commonly-used macros, which are suggested in the user interface:

    "$Identity[$Sign.User$]$"
    Resolves to the username for the key user from the identify provider
    "$Identity[$Sign.User$,Given Name]$"
    Resolves to given name for the key user from the identity provider
    "$Identity[$Sign.User$,Surname]$"
    Resolves to surname for the key user from the identity provider
    "$IdentityEmail[$Sign.User$]$"
    Resolves to surname for the key user from the identity provider
    "$Sign.User$"
    Resolves to the prefix universal GUID
    "$Sign.Project$"
    Resolves to the CodeSign Protect Project name, which is set by the Project Owner
    "$Sign.Environment$"
    Resolves to the CodeSign Protect Environment name, which is set by the Project Owner
    "$Sign.EnvironmentType$"
    Resolves to the environment type

    Using custom macros

    You can also use your own macro. For example, the following macro would resolve to the key user's Department value from your identify provider:

    "$Identity[$Sign.User$,Department]$

    Learn more

    For additional information on macros, see Macro overview.

    Request Instance Identification

    Instance identification allows you to select which components to use to uniquely identify signing requests. Select whether to Use Global Settings or Use Custom Settings for this Environment Template. For a description of each setting, see Request Instance Identification tab.

    Settings

    Description: Allows you to specify a custom description for this environment template. The description will appear in the Actions panel of the Venafi Configuration Console, and it will also appear in Aperture during project creation.

    Signing Flow: Allows you to specify the Flow associated with this environment. Click the drop-down list, and then search for the Flow you want to add. This list is populated from the Flows node within the Venafi Code Signing node.

    NOTE  If you're changing the Flow on an existing template, this change will be inherited by any existing Environments that use this template. This will clear any approvals in process for Environments using this template.

    Container and Naming: Allows you to specify the path and a name for each user-based certificate. Each certificate must have a unique DN.

    1. In Base Certificate Location, select a location in the Policy tree to use as the base path for all certificates associated with this Environment.
    2. In Optional Sub-Folders, specify any additional sub-folders to append to the Base Certificate Location. This field supports macros, and clicking in the field opens a list of common macros for you to choose from.
    3. In Name of the Certificate in the sub-folder, specify the naming pattern for the certificates. This field supports macros, and clicking in the field opens a list of common macros for you to choose from.

    The Calculated Object Name box shows an example output.

    State

    The state (ST) name that appears as part of the Subject DN of the certificate.

    For per-user environments, this field supports macros.

    Using suggested macros (available in the user interface)

    Following are commonly-used macros, which are suggested in the user interface:

    "$Identity[$Sign.User$]$"
    Resolves to the username for the key user from the identify provider
    "$Identity[$Sign.User$,Given Name]$"
    Resolves to given name for the key user from the identity provider
    "$Identity[$Sign.User$,Surname]$"
    Resolves to surname for the key user from the identity provider
    "$IdentityEmail[$Sign.User$]$"
    Resolves to surname for the key user from the identity provider
    "$Sign.User$"
    Resolves to the prefix universal GUID
    "$Sign.Project$"
    Resolves to the CodeSign Protect Project name, which is set by the Project Owner
    "$Sign.Environment$"
    Resolves to the CodeSign Protect Environment name, which is set by the Project Owner
    "$Sign.EnvironmentType$"
    Resolves to the environment type

    Using custom macros

    You can also use your own macro. For example, the following macro would resolve to the key user's Department value from your identify provider:

    "$Identity[$Sign.User$,Department]$

    Learn more

    For additional information on macros, see Macro overview.

    Visibility

    Select the users or groups that should be able to see this Environment Template. Leaving this field empty makes this template available to all users. Adding users to this field restricts this template to just those users listed.

    All users and groups that are currently assigned have visibility. However, you can only add users and groups that are part of your identity provider. For example, local users can't add Active Directory users or groups, nor can Active Directory users add local users or groups.

    Removing users and groups is possible across identity providers.

    NOTE  If an end-user does not have visibility to any Environment Templates, they will not be able to create new projects.

Per-user environments allow multiple user-based certificates to be associated with a single environment. In order to help differentiate the certificates that are issued, per-user environments support macros in a number of fields. As such, Code Signing Administrators can use a single per-user environment template to issue unique certificates.

For fields that support macros, the user interface provides suggestions for common macros. You can use the common macros by clicking them. While these macros are suggested, they are not required.

Using suggested macros (available in the user interface)

Following are commonly-used macros, which are suggested in the user interface:

"$Identity[$Sign.User$]$"
Resolves to the username for the key user from the identify provider
"$Identity[$Sign.User$,Given Name]$"
Resolves to given name for the key user from the identity provider
"$Identity[$Sign.User$,Surname]$"
Resolves to surname for the key user from the identity provider
"$IdentityEmail[$Sign.User$]$"
Resolves to surname for the key user from the identity provider
"$Sign.User$"
Resolves to the prefix universal GUID
"$Sign.Project$"
Resolves to the CodeSign Protect Project name, which is set by the Project Owner
"$Sign.Environment$"
Resolves to the CodeSign Protect Environment name, which is set by the Project Owner
"$Sign.EnvironmentType$"
Resolves to the environment type

Using custom macros

You can also use your own macro. For example, the following macro would resolve to the key user's Department value from your identify provider:

"$Identity[$Sign.User$,Department]$

Learn more

For additional information on macros, see Macro overview.

  1. Click Apple from the Add Per-User Template section of the Actions panel.

  2. Give the template a name. This name is what Project Owners will see in the web interface when using this Environment Template in code signing projects.

    DID YOU KNOW?  When Project Owners select an Environment Template during project creation in the CodeSign Protect web interface, a suffix will automatically be added to the template name you provide here. For example, if you name the template Development, it will appear as in the web interface. This is to help Project Owners quickly see whether a project is a single key environment or a per user environment.

  3. Complete the tabs according to the following guidelines:

    NOTE  A number of the tabs include a Do not allow users to enter their own values in projects checkbox. Checking this will restrict the Owner's ability to enter any value other than what is specified in the template.

    Tab Guidelines

    Request Instance Identification

    Instance identification allows you to select which components to use to uniquely identify signing requests. Select whether to Use Global Settings or Use Custom Settings for this Environment Template. For a description of each setting, see Request Instance Identification tab.

    Settings

    Description: Allows you to specify a custom description for this environment template. The description will appear in the Actions panel of the Venafi Configuration Console, and it will also appear in Aperture during project creation.

    Signing Flow: Allows you to specify the Flow associated with this environment. Click the drop-down list, and then search for the Flow you want to add. This list is populated from the Flows node within the Venafi Code Signing node.

    NOTE  If you're changing the Flow on an existing template, this change will be inherited by any existing Environments that use this template. This will clear any approvals in process for Environments using this template.

    Container and Naming: Allows you to specify the path and a name for each user-based . Each must have a unique DN.

    1. In Base Certificate Location, select a location in the Policy tree to use as the base path for all associated with this Environment.
    2. In Optional Sub-Folders, specify any additional sub-folders to append to the Base Certificate Location. This field supports macros, and clicking in the field opens a list of common macros for you to choose from.
    3. In Name of the Certificate in the sub-folder, specify the naming pattern for the . This field supports macros, and clicking in the field opens a list of common macros for you to choose from.

    The Calculated Object Name box shows an example output.

    Visibility

    Select the users or groups that should be able to see this Environment Template. Leaving this field empty makes this template available to all users. Adding users to this field restricts this template to just those users listed.

    All users and groups that are currently assigned have visibility. However, you can only add users and groups that are part of your identity provider. For example, local users can't add Active Directory users or groups, nor can Active Directory users add local users or groups.

    Removing users and groups is possible across identity providers.

    NOTE  If an end-user does not have visibility to any Environment Templates, they will not be able to create new projects.

Per-user environments allow multiple user-based keys to be associated with a single environment. In order to help differentiate the keys that are issued, per-user environments support macros in a number of fields. As such, Code Signing Administrators can use a single per-user environment template to issue unique keys.

For fields that support macros, the user interface provides suggestions for common macros. You can use the common macros by clicking them. While these macros are suggested, they are not required.

Using suggested macros (available in the user interface)

Following are commonly-used macros, which are suggested in the user interface:

"$Identity[$Sign.User$]$"
Resolves to the username for the key user from the identify provider
"$Identity[$Sign.User$,Given Name]$"
Resolves to given name for the key user from the identity provider
"$Identity[$Sign.User$,Surname]$"
Resolves to surname for the key user from the identity provider
"$IdentityEmail[$Sign.User$]$"
Resolves to surname for the key user from the identity provider
"$Sign.User$"
Resolves to the prefix universal GUID
"$Sign.Project$"
Resolves to the CodeSign Protect Project name, which is set by the Project Owner
"$Sign.Environment$"
Resolves to the CodeSign Protect Environment name, which is set by the Project Owner
"$Sign.EnvironmentType$"
Resolves to the environment type

Using custom macros

You can also use your own macro. For example, the following macro would resolve to the key user's Department value from your identify provider:

"$Identity[$Sign.User$,Department]$

Learn more

For additional information on macros, see Macro overview.

  1. Click GPG from, the Add Per-User Template section of the Actions panel.

  2. Give the template a name. This name is what Project Owners will see in the web interface when using this Environment Template in code signing projects.

    DID YOU KNOW?  When Project Owners select an Environment Template during project creation in the CodeSign Protect web interface, a - Per User suffix will automatically be added to the template name you provide here. For example, if you name the template Development, it will appear as Development - Per User in the web interface. This is to help Project Owners quickly see whether a project is a single key environment or a per user environment.

  3. Complete the tabs according to the following guidelines:

    NOTE  A number of the tabs include a Do not allow users to enter their own values in projects checkbox. Checking this will restrict the Owner's ability to enter any value other than what is specified in the template.

    Tab Guidelines

    Authentication Keys

    Encryption algorithms for the GPG authentication keys that you want to make available to Owners to choose from.

    E-mail

    E-mail address of the person using the GPG key. Together with the Real Name, this becomes part of the user ID (UID). The user ID is used to associate the key with a real person and is used to identify the key when signing.

    For per-user environments, this field supports macros.

    Using suggested macros (available in the user interface)

    Following are commonly-used macros, which are suggested in the user interface:

    "$Identity[$Sign.User$]$"
    Resolves to the username for the key user from the identify provider
    "$Identity[$Sign.User$,Given Name]$"
    Resolves to given name for the key user from the identity provider
    "$Identity[$Sign.User$,Surname]$"
    Resolves to surname for the key user from the identity provider
    "$IdentityEmail[$Sign.User$]$"
    Resolves to surname for the key user from the identity provider
    "$Sign.User$"
    Resolves to the prefix universal GUID
    "$Sign.Project$"
    Resolves to the CodeSign Protect Project name, which is set by the Project Owner
    "$Sign.Environment$"
    Resolves to the CodeSign Protect Environment name, which is set by the Project Owner
    "$Sign.EnvironmentType$"
    Resolves to the environment type

    Using custom macros

    You can also use your own macro. For example, the following macro would resolve to the key user's Department value from your identify provider:

    "$Identity[$Sign.User$,Department]$

    Learn more

    For additional information on macros, see Macro overview.

    Encryption Keys

    Encryption algorithms for the GPG encryption keys that you want to make available to Owners to choose from.

    Expiration

    		 The time frame for which a key remains valid before being automatically renewed.

    Key Storage

    Select which Key Storage locations you want to make available. From the drop-down, select an option, and then click Add. Repeat for each Key Storage location you want to add.

    Any HSM connectors that you have defined will appear in this list.

    Real Name

    Real name of the person using the GPG key. Together with the E-mail address, this becomes part of the user ID (UID). The user ID is used to associate the key with a real person and is used to identify the key when signing.

    For per-user environments, this field supports macros.

    Using suggested macros (available in the user interface)

    Following are commonly-used macros, which are suggested in the user interface:

    "$Identity[$Sign.User$]$"
    Resolves to the username for the key user from the identify provider
    "$Identity[$Sign.User$,Given Name]$"
    Resolves to given name for the key user from the identity provider
    "$Identity[$Sign.User$,Surname]$"
    Resolves to surname for the key user from the identity provider
    "$IdentityEmail[$Sign.User$]$"
    Resolves to surname for the key user from the identity provider
    "$Sign.User$"
    Resolves to the prefix universal GUID
    "$Sign.Project$"
    Resolves to the CodeSign Protect Project name, which is set by the Project Owner
    "$Sign.Environment$"
    Resolves to the CodeSign Protect Environment name, which is set by the Project Owner
    "$Sign.EnvironmentType$"
    Resolves to the environment type

    Using custom macros

    You can also use your own macro. For example, the following macro would resolve to the key user's Department value from your identify provider:

    "$Identity[$Sign.User$,Department]$

    Learn more

    For additional information on macros, see Macro overview.

    Request Instance Identification

    Instance identification allows you to select which components to use to uniquely identify signing requests. Select whether to Use Global Settings or Use Custom Settings for this Environment Template. For a description of each setting, see Request Instance Identification tab.

    If this Template uses a Flow that includes an Approver from Configuration or Fixed Approver action, you need to disable the Command Line instance identifier (which is enabled by default).

    On the Request Instance Identification tab, select the Use Custom Settings radio button, then select the instance identifiers you want to use. The recommended defaults are:

    • Signing Key Identifier
    • Requesting Machine Name
    • Username of requestor on signing machine.

    Settings

    Description: Allows you to specify a custom description for this environment template. The description will appear in the Actions panel of the Venafi Configuration Console, and it will also appear in Aperture during project creation.

    Signing Flow: Allows you to specify the Flow associated with this environment. Click the drop-down list, and then search for the Flow you want to add. This list is populated from the Flows node within the Venafi Code Signing node.

    NOTE  If you're changing the Flow on an existing template, this change will be inherited by any existing Environments that use this template. This will clear any approvals in process for Environments using this template.

    Container and Naming: Allows you to specify the path and a name for each user-based key. Each key must have a unique DN.

    1. In Base Certificate Location, select a location in the Policy tree to use as the base path for all keys associated with this Environment.
    2. In Optional Sub-Folders, specify any additional sub-folders to append to the Base Certificate Location. This field supports macros, and clicking in the field opens a list of common macros for you to choose from.
    3. In Name of the Certificate in the sub-folder, specify the naming pattern for the keys. This field supports macros, and clicking in the field opens a list of common macros for you to choose from.

    The Calculated Object Name box shows an example output.

    Signing Keys

    Select the encryption algorithms for the GPG signing keys that you want to make available to Owners to choose from.

    Visibility

    Select the users or groups that should be able to see this Environment Template. Leaving this field empty makes this template available to all users. Adding users to this field restricts this template to just those users listed.

    All users and groups that are currently assigned have visibility. However, you can only add users and groups that are part of your identity provider. For example, local users can't add Active Directory users or groups, nor can Active Directory users add local users or groups.

    Removing users and groups is possible across identity providers.

    NOTE  If an end-user does not have visibility to any Environment Templates, they will not be able to create new projects.

Per-user environments allow multiple user-based keys to be associated with a single environment. In order to help differentiate the keys that are issued, per-user environments support macros in a number of fields. As such, Code Signing Administrators can use a single per-user environment template to issue unique keys.

For fields that support macros, the user interface provides suggestions for common macros. You can use the common macros by clicking them. While these macros are suggested, they are not required.

Using suggested macros (available in the user interface)

Following are commonly-used macros, which are suggested in the user interface:

"$Identity[$Sign.User$]$"
Resolves to the username for the key user from the identify provider
"$Identity[$Sign.User$,Given Name]$"
Resolves to given name for the key user from the identity provider
"$Identity[$Sign.User$,Surname]$"
Resolves to surname for the key user from the identity provider
"$IdentityEmail[$Sign.User$]$"
Resolves to surname for the key user from the identity provider
"$Sign.User$"
Resolves to the prefix universal GUID
"$Sign.Project$"
Resolves to the CodeSign Protect Project name, which is set by the Project Owner
"$Sign.Environment$"
Resolves to the CodeSign Protect Environment name, which is set by the Project Owner
"$Sign.EnvironmentType$"
Resolves to the environment type

Using custom macros

You can also use your own macro. For example, the following macro would resolve to the key user's Department value from your identify provider:

"$Identity[$Sign.User$,Department]$

Learn more

For additional information on macros, see Macro overview.

  1. Click Key Pair from the Add Per-User Template section of the Actions panel.

  2. Give the template a name. This name is what Project Owners will see in the web interface when using this Environment Template in code signing projects.

    DID YOU KNOW?  When Project Owners select an Environment Template during project creation in the CodeSign Protect web interface, a suffix will automatically be added to the template name you provide here. For example, if you name the template Development, it will appear as in the web interface. This is to help Project Owners quickly see whether a project is a single key environment or a per user environment.

  3. Complete the tabs according to the following guidelines:

    NOTE  A number of the tabs include a Do not allow users to enter their own values in projects checkbox. Checking this will restrict the Owner's ability to enter any value other than what is specified in the template.

    Tab Guidelines

    Expiration

    		 The time frame for which a key remains valid before being automatically renewed.

    Key Storage

    Select which Key Storage locations you want to make available. From the drop-down, select an option, and then click Add. Repeat for each Key Storage location you want to add.

    Any HSM connectors that you have defined will appear in this list.

    Keys

    Select the encryption algorithms that you want to make available to Owners to choose from.

    Request Instance Identification

    Instance identification allows you to select which components to use to uniquely identify signing requests. Select whether to Use Global Settings or Use Custom Settings for this Environment Template. For a description of each setting, see Request Instance Identification tab.

    Settings

    Description: Allows you to specify a custom description for this environment template. The description will appear in the Actions panel of the Venafi Configuration Console, and it will also appear in Aperture during project creation.

    Signing Flow: Allows you to specify the Flow associated with this environment. Click the drop-down list, and then search for the Flow you want to add. This list is populated from the Flows node within the Venafi Code Signing node.

    NOTE  If you're changing the Flow on an existing template, this change will be inherited by any existing Environments that use this template. This will clear any approvals in process for Environments using this template.

    Container and Naming: Allows you to specify the path and a name for each user-based . Each must have a unique DN.

    1. In Base Certificate Location, select a location in the Policy tree to use as the base path for all associated with this Environment.
    2. In Optional Sub-Folders, specify any additional sub-folders to append to the Base Certificate Location. This field supports macros, and clicking in the field opens a list of common macros for you to choose from.
    3. In Name of the Certificate in the sub-folder, specify the naming pattern for the . This field supports macros, and clicking in the field opens a list of common macros for you to choose from.

    The Calculated Object Name box shows an example output.

    Visibility

    Select the users or groups that should be able to see this Environment Template. Leaving this field empty makes this template available to all users. Adding users to this field restricts this template to just those users listed.

    All users and groups that are currently assigned have visibility. However, you can only add users and groups that are part of your identity provider. For example, local users can't add Active Directory users or groups, nor can Active Directory users add local users or groups.

    Removing users and groups is possible across identity providers.

    NOTE  If an end-user does not have visibility to any Environment Templates, they will not be able to create new projects.

After configuring Environment Templates, they are now ready for Owners to use in Code Signing Projects.

Edit existing Environment Templates

From the Environment Templates node in the Venafi Configuration Console, select the Environment Template you want to edit, and then click Properties in the Actions Panel. Follow the instructions from the procedure above for guidelines on filling in the template values.