Configuring the RSA Certificate Manager CA Template object

To enable Trust Protection Platform to manage RSA certificates, you must configure the RSA Certificate Manager CA Template object. This object provides the information Trust Protection Platform needs to request, retrieve, and install certificates issued by the RSA Certificate Manager CA.

BEST PRACTICE Consider managing CA Template object settings using a policy. For more information, see Managing CA templates using policies.

To create and configure a DigiCert CA template

From the TLS Protect menu bar, click Policy Tree.
From the Tree drop-down menu, click Policy.
In the Policy tree, select the folder where you want to create the CA Template object, and then click Add.
Click CA Template, then select RSA to create it.
In the CA Name box, type a name for the new RSA object.

Refer to the following table to complete the remaining CA template settings:

RSA Certificate Manager Template Configuration

Field	Description
Connection
LDAP Host	IP address or hostname of the RSA Certificate Manager CA’s LDAP server. Policy Tree supports both IPv4 or IPv6 connections.
LDAP Port	Port used by Trust Protection Platform to connect to the RSA Certificate Manager CA.
Credential	Certificate Credential required to connect to the RSA Certificate Manager CA. To select the Credential Click the Browse button. The Credential Selector dialog appears. Select the Certificate Credential that stores certificate and private key password required to connect to the RSA Certificate Manager CA server, and then click Select.
Options
Retrieve Jurisdictions	Retrieves your organization’s Jurisdiction information from the RSA Certificate Manager CA.
Enter Jurisdiction Manually	Allows you to manually enter your organization’s Jurisdiction information.
Jurisdiction	The jurisdiction of the RSA Certificate Manager CA that will be issuing certificates for your organization. This field is automatically populated when you retrieve a jurisdiction.
Jurisdiction ID	Unique value used to identify your organization. This ID is included in your organization’s standard certificates. The Jurisdiction ID is found in the Jurisdiction Configuration page on the RSA Administrator site. This field is automatically populated when you retrieve a jurisdiction.
CA Name	The name of your organization’s RSA Certificate Manager CA server. This field is automatically populated when you retrieve a jurisdiction.
CA MD5	MD5 hash of the instance of the RSA Certificate Manager CA that will issue certificates for your organization The CA MD5 hashes are found in the Jurisdiction Configuration page on the RSA Administrator site. This field is automatically populated when you retrieve a jurisdiction.
Retrieve Global Profiles	Allows Trust Protection Platform to retrieve profiles from the global RSA Certificate Manager CA if the designated Admin certificate does not have permissions to profiles in the current RSA Certificate Manager CA.
Certificate Profile	The Certificate Profile you want to associate with the current CA Template object. Trust Protection Platform references this profile when it submits the CSR. A profile defines everything associated with the issuance of a particular type of certificate. The certificate that is issued from a profile request contains the default content with values derived from the parameters associated with those defaults. For example, you could set up a profile for an SSL certificate that defines all aspects of that certificate including a default validity period of two years. When a user sends a request associated with this profile, the issued certificate contains the information specified in the profile defaults and is valid for two years. To associate a profile (Optional) Select Retrieve Global Profiles. Click Retrieve. Trust Protection Platform downloads the available certificate profiles from the RSA Certificate Manager CA. From the Certificate Profile drop-down list, select the profile you want to associate with the current CA Template object. If new Certificate Profiles are added to the CA, you must click Retrieve to update the Certificate Profile menu.
Subject Alt Name Enabled	Configures the current CA template object to support CSRs with DNS-based subject alt name (SAN) values. NOTE DNS SANs are included in the Unified Communications Certificates that are used with Microsoft Exchange 2007 and Microsoft Office Communications Server. If you do not select this option, the current CA template object will not accept CSRs with SAN values. If Trust Protection Platform attempts to submit a CSR with SAN values, the CA Template object returns the following error: Stage 400 (Creating CSR) SubjectAltName not supported by Application and CA. IMPORTANT Before selecting this option, you must also verify the SAN feature is enabled on your CA engine. It it isn't, the CA returns the same error message when Trust Protection Platform attempts to submit a CSR with SAN values. For additional information on defining SAN values in the certificate, see Subject Alt Name in the topic About certificate object settings.
Validity Period	Allows you to control which Validity Periods can be selected when configuring an RSA certificate. The Validity Period is the period of time (in years) that the certificate is valid.
Available Validity Periods (Years)	Validity Periods that are supported by the RSA CA.
Supported Validity Periods (Years)	Validity Periods that are available when configuring an RSA certificate. To populate this list, select the Supported Validity Periods you want to be available when configuring RSA certificates in Policy Tree, and then click the Right-arrow. Press Shift+click to select multiple, contiguous events. Press Ctrl+click to select multiple, discontiguous events.

(Optional) To see additional attributes, review the settings on the Support tab.
Click Save.

What's next?

After you create a CA object, you can select it from the Policy tree, and then view important information and manage various settings.

Click the General tab to view and modify log and permissions settings.
- Click the Log sub-tab to view any logged events that are triggered by the template object.
  
  IMPORTANT You must have the Read permission to view the Log tab.
  
  For more information about options found on the Log tab, see Viewing log events.
- On the Permissions sub-tab, you can configure the users or groups to whom you want to grant permissions to the new template object.
  
  Consider managing object permissions via parent objects so that you can take advantage of inheritance. For more information, see Permission inheritance and flow down.