Enrollment Pattern Operations

EnrollmentClosed Certificate enrollment refers to the process by which a user requests a digital certificate. The user must submit the request to a certificate authority (CA). patterns in Keyfactor Command provide a flexible way to streamline certificate enrollment by defining default values, policies, and access configurations for specific certificate templates and certificate authorities. This functionality helps reduce duplication of templates at the CAClosed A certificate authority (CA) is an entity that issues digital certificates. Within Keyfactor Command, a CA may be a Microsoft CA or a Keyfactor gateway to a cloud-based or remote CA. level while meeting diverse business requirements. On this page, you can manage enrollment patterns by adding, editing, and deleting them, configuring system-wide settings, and copying existing patterns to create new ones. These operations ensure enrollment processes are tailored to user groups, enforce security policies, and simplify certificate management.

System-wide settings apply to all enrollments done through Keyfactor Command unless they are overridden by settings configured in the specific enrollment pattern (see Enrollment RegExes Tab, Enrollment Defaults Tab, and Policies Tab). Although system-wide settings are configured on the enrollment patterns page, they also apply to enrollments done without an enrollment pattern (e.g. standalone CAs).

Note:  System-wide metadataClosed Metadata provides information about a piece of data. It is used to summarize basic information about data, which can make working with the data easier. In Keyfactor Command, the certificate metadata feature allows you to create custom metadata fields that allow you to tag certificates with tracking information about certificates. settings are configured on the Metadata page in System Settings, not at the system-wide level in enrollment patterns (see Certificate Metadata).

Settings that may be configured at either the system-wide level or at the individual level include:

To configure system-wide options:

  1. In the Keyfactor Command Management Portal, browse to Locations > Enrollment Patterns.
  2. On the Enrollment Patterns page, click System-Wide Settings at the top of the grid.
  3. When you open the system-wide settings, you will see three tabs. Configure the system-wide setting information with the appropriate data using the following instructions.
  4. Click Save to save the system-wide settings. Click Back to return to the enrollment patterns page.

Regular expressions for enrollment are used to validate that the data entered in the certificate subject fields meets certain criteria.

Tip:  To use a system-wide enrollment regular expressionClosed A regular expression--RegEx--is a pattern used to validate data by ensuring it meets specific criteria. Several fields on the CSR enrollment, CSR generation, and PFX enrollment pages support RegEx validation, including certificate subject and metadata fields. and allow a specific enrollment pattern to bypass that regular expression, you can configure a regular expression at the enrollment pattern level for the desired subject part and set it to nothing.

To configure a system-wide regular expression:

  1. On the Enrollment RegExes tab, double-click a subject part row in the grid, right-click the row and choose Edit from the right-click menu, or highlight the row in the grid and click Edit at the top of the grid.
  2. On the Enrollment RegExClosed A regular expression--RegEx--is a pattern used to validate data by ensuring it meets specific criteria. Several fields on the CSR enrollment, CSR generation, and PFX enrollment pages support RegEx validation, including certificate subject and metadata fields. dialog, in the RegEx field, enter a regular expression against which to validate the subject part. See Regular Expressions for examples.
  3. In the Error field, enter an error message to be displayed to the user in the enrollment pages of the Keyfactor CommandManagement Portal or as a response to an enrollment APIClosed An API is a set of functions to allow creation of applications. Keyfactor offers the Keyfactor API, which allows third-party software to integrate with the advanced certificate enrollment and management features of Keyfactor Command. request when the subject part referenced in the CSR or entered for a PFX does not match the regular expression defined for the subject part field. Note that the error message already includes the subject part followed by a colon (e.g. Organization: or Invalid O provided: depending on the interface). Your custom message follows this.

  4. Toggle the Case-Sensitive Validation button to on enable this option, if desired. If the user's entry does not match the expected case, the Error will display. If the Case-Sensitive Validation option is toggled to off, even if the regular expression contains requirements to enforce case, the case requirement will not be enforced.

    This is broken out from the rest of the regular expression for clarity and to allow the case sensitivity setting to be viewed in the regular expression grid.

  5. Click Save to save the regular expression.

Figure 275: Configure System-Wide Enrollment Regular Expressions

Tip:  To prevent users from adding a given SANClosed The subject alternative name (SAN) is an extension to the X.509 specification that allows you to specify additional values when enrolling for a digital certificate. A variety of SAN formats are supported, with DNS name being the most common. field to a certificate, create a regular expression on the field with the following value:
^$

This will disallow entry of any data in the SAN field and thus prevent users from submitting the certificate request with this type of SAN.

Enrollment defaults allow you to define default values for select certificate subject parts that will auto-populate on the PFX enrollment and CSR generation pages in the Keyfactor CommandManagement Portal.

To configure a system-wide enrollment default:

  1. On the Enrollment Defaults tab, double-click a subject part row in the enrollment defaults grid, right-click the row and choose Edit from the right-click menu, or highlight the row in the grid and click Edit at the top of the grid.

  2. On the Enrollment Pattern Default dialog, in the Value field, enter a value to auto-populate in the PFX enrollment and CSR generation pages of the Keyfactor CommandManagement Portal. During PFX enrollment or CSR generation, the user can accept the value or modify it; it is not enforced.

  3. Click Save to save the default.
Note:  System-wide enrollment defaults do not apply to requests made with CSR enrollment or the Keyfactor API.

Figure 276: Configure System-Wide Enrollment Defaults

Tip:  See also the Subject Format application setting, which takes precedence over enrollment defaults at both the system-wide and enrollment pattern level (see Application Settings: Enrollment Tab).

Policies for enrollment patterns cover the following settings:

Enrollment Policies
Supported Key Types

  • RSA Key Sizes

    A list of RSA key sizes that are valid for enrollment through Keyfactor Command. If a key sizeClosed The key size or key length is the number of bits in a key used by a cryptographic algorithm. is not in this list, enrollment will not be supported for requests specifying that key size. To change the selected values, in the dropdown uncheck any values you do not wish to support. The default values are:

    2048, 3072, 4096

  • ECC Curves

    A list of elliptic curve algorithms that are valid for enrollment through Keyfactor Command. To change the selected values, in the dropdown check any values you wish to support. The default values are:

    P-256/prime256v1/secp256r1, P-384/secp384r1, P-521/secp521r1

    Keyfactor recommends using these most commonly used ECCClosed Elliptical curve cryptography (ECC) is a public key encryption technique based on elliptic curve theory that can be used to create faster, smaller, and more efficient cryptographic keys. ECC generates keys through the properties of the elliptic curve equation instead of the traditional method of generation as the product of very large prime numbers. curves (the default values) when possible, if a specific alternate curve is not required. ClosedShow available curves and associated OIDs.

  • Allow Ed448 / Allow Ed25519

    Set system-wide support for allowing Ed448 and/or Ed25519 keys. These key types are only available with EJBCA CAs. The default is disabled.

Figure 277: Configure System-Wide Policies

The options configured in enrollment patterns relate to how they appear and function for PFX and CSR enrollment in the Management Portal.

Tip:  The following permissions (see Security Roles and Claims) are required to use this feature:

Metadata > Types > Modify
Certificate Templates > Read
Enrollment Pattern > Read
Enrollment Pattern > Modify

Settings that may be configured at either the system-wide level or at the individual level include:

  • Regular expressions used to validate that the data entered in the certificate subject fields meets certain criteria.

  • Certificate subject defaults that define default values for select certificate subject parts that will auto-populate on the PFX enrollment and CSR generation pages in the Keyfactor Command Management Portal.

  • Enrollment policies address various topics, including permitted key sizes and types, certificate owner behavior and defaults, and options for enabling wildcards, key reuse, and RFC 2818 enforcement during enrollment.

Settings found only at the individual enrollment pattern level include:

  • Security roles that may enroll with the enrollment pattern, or whether Active Directory permissions are used instead of Keyfactor Command roles.

  • Certificate Authorities (CAs) that may be enrolled against using the enrollment pattern.

  • Types of enrollment supported by the enrollment pattern (e.g., PFX enrollment, CSR enrollment, and/or CSR generation).

  • Custom enrollment fields used to supply custom request attributes to the CA during the enrollment process.

  • Default metadata values, enrollment handling for each metadata field (whether the field is required, optional, or hidden), regular expressions applied to metadata fields, and options for multiple-choice metadata fields.

    Note:  System-wide metadata settings are configured on the Metadata page in System Settings, not at the system-wide level in enrollment patterns (see Certificate Metadata).

To create a new enrollment pattern or edit an existing one:

  1. In the Keyfactor CommandManagement Portal, browse to Locations > Enrollment Patterns.

  2. On the Enrollment Patterns page:

    • To create a new enrollment pattern, click Add.

    • To edit an existing enrollment pattern, select one of the following:

      • Double-click the row in the enrollment pattern grid.
      • Right-click the row and choose Edit from the right-click menu.
      • Highlight the row in the grid and click Edit at the top of the grid.
  3. When the enrollment pattern opens for editing, you will see multiple tabs. Follow the instructions for each tab provided below to enter the necessary data.
  4. Click Save to save the changes to the enrollment pattern record. Click Back to return to the main enrollment patterns page without saving changes.
Details

The information in the Details section includes:

  • Name: A reference name for the enrollment pattern. Spaces are supported in this field.

  • Description: A description for the enrollment pattern.

  • Template: The templateClosed A certificate template defines the policies and rules that a CA uses when a request for a certificate is received. associated with the enrollment pattern. The template is required.

    Note:  This field cannot be modified on an edit.

  • Default Pattern For Template: A toggle to control whether this enrollment pattern is the default pattern for the associated template (if enabled) or not (if disabled). A certificate template can have only one default enrollment pattern, which is required for the template to be used for enrollment. If no other enrollment pattern for the template exists or is marked as default, this option will automatically be enabled when a new pattern is created.

  • Use AD Template Permissions: A toggle to control whether Active Directory permissions should be used for certificate enrollment authorization (if enabled) or whether Keyfactor Command security roles should be used (if disabled). If disabled, at least one value must be provided for Associated Roles.

    Tip:  The Use AD Template Permissions option was previously called Restrict Allowed Requesters and was configured at the template and CA levels, with opposite functionality. Enabling Use AD Permissions shifts access control to Active Directory, whereas enabling Restrict Allowed Requesters assigned access control through Keyfactor Command roles.

  • Associated Roles: The list of security roles associated with the enrollment pattern. Only users holding ones of these roles will be able to use the enrollment pattern if Use AD Permissions is disabled.

    Tip:  This option was previously called Allowed Requesters and configured at the template and CA levels.

  • Restrict CAs: A toggle to control whether the enrollment pattern should be restricted to use with a specified list of certificate authorities (if enabled) or not (if disabled). If enabled, at least one CA must be configured in Certificate Authorities.

  • Certificate Authorities: The certificate authorities to which the enrollment pattern is restricted, if applicable (see Restrict CAs).

Allowed Enrollment Types

In the Allowed Enrollment Types section, click the toggle buttons to enable the options for any of the follow, as desired:

  • CSR Enrollment

  • PFX Enrollment

  • CSR Generation

Enabling these options causes the enrollment pattern to appear in dropdowns in the corresponding section of the Management Portal. In addition, whether the enrollment patterns appear in CSR Enrollment and PFX Enrollment is affected by the Restrict CA setting as follows:

  • Restrict CAs Disabled: At least one CA that offers the template associated with the enrollment pattern available for enrollment must be configured for enrollment within Keyfactor Command (see HTTPS CAs - Advanced Tab or DCOM CAs - Advanced Tab).
  • Restrict CAs Enabled: At least one CA configured for enrollment within Keyfactor Command (see HTTPS CAs - Advanced Tab or DCOM CAs - Advanced Tab) must be added as a CA within the enrollment pattern.

Figure 278: Enrollment Pattern: Basic Information Tab

On the Enrollment Fields tab, you can add custom enrollment fields. These are configured at the enrollment pattern level to allow you to submit custom fields with CSR enrollments and PFX enrollments to supply custom request attributes to the CA during the enrollment process. This functionality offers such benefits as:

The Enrollment Fields tab allows you to configure custom fields for your enrollment patterns. These fields enable you to include specific attributes CSR and PFX enrollments, which are then sent to the certificate authorityClosed A certificate authority (CA) is an entity that issues digital certificates. Within Keyfactor Command, a CA may be a Microsoft CA or a Keyfactor gateway to a cloud-based or remote CA. during the enrollment process.

Benefits of using custom enrollment fields include:

  • Ensuring certificate validity: Prevent users from requesting invalid certificates by enforcing specific requirements tied to each enrollment pattern.
  • Providing additional context: Send supplementary information to the CA along with the enrollment request.

Once created on the enrollment pattern, these fields are shown in Keyfactor Command on the PFX and CSR enrollment pages in the Additional Enrollment Fields section. The fields are mandatory during enrollment. For a Microsoft CA, the data submitted in the field(s) will appear on the CA’s Issued Certificates page in the Request Attributes field for certificates enrolled with an enrollment pattern configured with Keyfactor Command enrollment fields.

Note:   These are not metadata fields, so they are not stored in the Keyfactor Command database, but simply passed through to the CA. The CA in turn could, via a gateway or policy module, use this data to perform required actions.

On the Enrollment Fields tab you can add, edit and delete enrollment fields.

To add a new enrollment field:

  1. On the Enrollment Fields tab of the selected enrollment pattern:

    • To create a new enrollment field, click Add.

    • To edit an existing enrollment field, select one of the following:

      • Double-click the row in the enrollment fields grid.
      • Highlight the row in the grid and click Edit at the top of the grid.
  2. Enter a Name for the new custom field. This name will appear on the enrollment pages.
  3. Select a Data Type. The options are:
    • String: A free-form data entry field.
    • Multiple Choice: Provides a list of acceptable values for the field. A text box will open up below this choice for you to enter the list of acceptable values. Add each value on a separate line. Click OK to close the box.
  4. Click Save to save and close the add window.

Figure 279: Enrollment Pattern: Enrollment Fields Tab

Select metadata fields can be configured at three levels:

  • System-wide

  • Template level

  • Enrollment pattern level

The multi-level configurable fields are:

  • Enrollment Handling: Specifies whether the field is Optional, Required, or Hidden during enrollment.

    Tip:  Administrators can control which metadata fields appear at the global, template, or enrollment pattern level. For example, setting fields A and B as Required or Optional and field C as Hidden on the Primary WebServer enrollment pattern ensures only fields A and B appear during enrollment for that pattern. Meanwhile, field C can be set as Required for a different enrollment pattern, allowing it to appear only when that pattern is used.

  • Default Value: A predefined value that populates during enrollment, which users can override.

  • RegEx Message: An error message displayed when the value entered in a string metadata field does not match the configured regular expression.

  • RegEx Validation: An optional regular expression that validates input for string metadata fields during enrollment.

  • Case-Sensitive Validation: A toggle that enforces case-sensitive validation for regular expression checks, overriding any case-sensitivity defined in the regular expression itself.

Note:  The order of precedence for evaluating metadata settings during enrollment is as follows:

  1. Enrollment Pattern:

    The enrollment pattern is evaluated first. If a value is set for the metadata field and setting (e.g. enrollment handling), that value is used, and any configuration for the same metadata field and setting at the template and system-wide levels is ignored.

  2. Template:

    If the enrollment pattern does not have a value set for the metadata field and setting, the template is evaluated. If the template has a value set, that value is used, and any configuration at the system-wide level is ignored. For template metadata configuration, see the certificate template Metadata Tab.

  3. System-Wide Settings:

    If neither the enrollment pattern nor the template has a value set for the metadata field and setting, the system-wide settings are evaluated. Values configured at this level are used if set. For system-wide metadata settings, see Certificate Metadata under System Settings.

Once the system-wide metadata has been defined, settings at the enrollment pattern level can be configured.

To configure metadata fields for an enrollment pattern:

  1. On the Metadata tab, select one of the following methods to edit an entry:

    • Double-click the row in the Metadata grid.
    • Highlight the row in the grid and click Edit at the top of the grid.
  2. In the Metadata dialog in the System-Wide Settings section, review the existing system-wide settings for the metadata field.
  3. In the Enrollment Pattern Settings section, click to toggle the Override System-Wide Settings button. Configure the settings for the metadata field. The available fields will vary depending on the type of the metadata field and may include:

    • Choose the enrollment handling for this enrollment pattern by selecting the appropriate radio button:

      • Optional: The metadata field will appear during enrollment with this enrollment pattern, but it will not be required to complete enrollment.

      • Required: This field will be required in order to complete enrollment with this enrollment pattern.

      • Hidden: This field will not be displayed during enrollment with this enrollment pattern.

    • Set the Default Value if desired. If no default value is desired, the field may be left blank. For Multiple Choice type metadata fields, this field will appear as a dropdown where you can select from the existing values configured for the metadata field.
    • If desired, set a RegEx Message and RegEx Validation string specific to the enrollment pattern used to validate the value upon enrollment entry, and any error message to display if the entry does not match the regex definition. For more information, see Adding or Modifying a Metadata Field. This option appears for string type metadata fields.
    • If desired, toggle the Case-Sensitive Validation option to a different value than is set at the system or template level for this metadata field. This toggle only becomes active once the RegEx fields are populated. This option appears for string type metadata fields.
  4. Click Save on the Metadata dialog to save changes for each metadata field.

Figure 280: Enrollment Patterns: Metadata Tab

Enrollment RegExes can be configured at either the individual enrollment pattern level or the system-wide level. They validate certificate subject data entered on the CSR enrollment, CSR generation, and PFX enrollment pages. Enrollment pattern RegExes apply only to enrollments with that specific pattern and override system-wide RegExes, which apply globally (see Configuring System-Wide Settings).

Tip:  To use a system-wide enrollment regular expression for a subject part and allow a specific enrollment pattern to bypass that regular expression, configure a regular expression for the desired subject part at the enrollment pattern level and set it to no value.

To configure regular expression fields for an enrollment pattern:

  1. On the Enrollment RegExes tab, select one of the following methods to edit an entry:

    • Double-click the row in the Enrollment RegExes grid.
    • Highlight the row in the grid and click Edit at the top of the grid.
  2. In the Enrollment RegEx dialog in the System-Wide Settings section, review the existing system-wide settings for the subject part.
  3. In the Enrollment Pattern Settings section, click to toggle the Override System-Wide Settings button. Enter a regular expression in the RegEx field. See Regular Expressions for examples.
  4. In the Error field, enter the error message to display during enrollment if the data entered for the subject part does not meet the validation rule.
  5. If desired, toggle the Case-Sensitive Validation option to a different value than is set at the system level for this regular expression. This toggle only becomes active once the RegEx field is populated.

  6. Click Save on the Enrollment RegEx dialog to save each regular expression.

The regular expressions will be applied at the time of enrollment. Entries that do not match the regular expression requirements will be flagged with an error message during enrollment entry when you click Enroll (or Generate for CSR generation).

Figure 281: Enrollment Patterns: Regular Expression Error on Enrollment

Tip:  To prevent users from adding a given SAN field to a certificate, create a regular expression on the field with the following value:
^$

This will disallow entry of any data in the SAN field and thus prevent users from submitting the certificate request with this SAN.

Figure 282: Enrollment Patterns: Enrollment RegExes Tab

Enrollment defaults allow you to define default values for certificate subject parts that will auto-populate on the PFX enrollment and CSR generation pages in the Keyfactor CommandManagement Portal. They can be configured at either the individual enrollment pattern level or the system-wide level. Enrollment pattern defaults apply only to enrollments with that specific pattern and override system-wide default, which apply globally (see Configuring System-Wide Settings).

Note:  These default values will not be applied to the additional SANs fields in CSR Enrollment.
Tip:  To use a system-wide enrollment default value in a subject part and allow a specific enrollment pattern to bypass that default value, configure a default value for the desired subject part at the enrollment pattern level and set it to no value.

To configure default values for an enrollment pattern:

  1. On the Enrollment Defaults tab, select one of the following methods to edit an entry:

    • Double-click the row in the Enrollment Defaults grid.
    • Highlight the row in the grid and click Edit at the top of the grid.
  2. In the Enrollment Default dialog in the System-Wide Settings section, review the existing system-wide default value for the subject part.
  3. In the Enrollment Settings section, click to toggle the Override System-Wide Settings button. Enter a default value for the subject part in the Value field.
  4. Click Save on the Enrollment Default dialog to save.
Note:  Enrollment defaults do not apply to requests made with CSR enrollment or the Keyfactor API.
Tip:  See also the Subject Format application setting, which takes precedence over enrollment defaults at both the system-wide and enrollment pattern level (see Application Settings: Enrollment Tab).

Figure 283: Enrollment Patterns: Enrollment Defaults Tab

The Policies Tab allows you to set policy definitions at the enrollment pattern level that take precedence over system-wide settings (see Configuring System-Wide Settings).

Enrollment Policies

The Enrollment Policies section displays the System-Wide Setting (value or Yes/No in the case toggled options) for each of the enrollment policies and allows you to override the system-wide settings for the specific enrollment pattern. Enabling Override System-Wide Setting will cause the system setting to be disregarded and allow you to configure the setting for that policy on the enrollment pattern. Override System-Wide Setting does not automatically set the policy to the value opposite the system-wide setting for toggled policies. The configuration on the policy will supersede any other settings.

  • Allow Wildcards

    Enable this option to allow certificates to be created containing wildcards (e.g. *.keyexample.com) using this enrollment pattern.

  • Allow Public Key Reuse

    Enable this option to allow private keys to be reused on certificate renewals made using this enrollment pattern.

  • Enforce RFC 2818 Compliance

    Enable this option to force certificate enrollments made through Keyfactor Command for this enrollment pattern to include at least one DNS SAN. In the Keyfactor CommandManagement Portal, this causes the CN entered in PFX enrollment to automatically be replicated as a SAN, which the user can either change or accept. For CSR enrollment, if the CSR does not have a SAN that matches the CN, one will automatically be added to the certificate if this is set.

    Tip:  For CA gateways, some cloud providers will automatically include SANs without you needing to enable the Enforce RFC 2818 Compliance option. Some cloud providers won’t support submission of a SAN that matches the CN (which is the default when you enable the RFC compliance option). Keyfactor recommends disabling this option for CA gateways.

  • Certificate Owner Role

    Choose to make selection of a certificate owner for the certificate at enrollment either Optional, Required or Hidden for this enrollment pattern. If Optional or Required, a search select field will be shown on both the PFX and CSR enrollment pages in the Keyfactor CommandManagement Portal when this enrollment pattern is selected allowing the user to select a security role to associate as the owner of the certificate. If Required, a value must be selected in the field. If Hidden, the search select field will not be shown on the enrollment pages. The Required setting also applies to enrollments done through the Keyfactor API. These settings do not apply to the certificate details dialog (see Certificate Details) or the add certificate page (see Add Certificate).

  • Default Certificate Owner Role Name

    If desired, enter a security role name to serve as the default certificate owner for all new certificates associated with this enrollment pattern enrolled through Keyfactor Command or synchronized into Keyfactor Command through CA synchronization, SSL scanning, or certificate store inventory after this value is set for this enrollment pattern. To narrow the list of results in the search select field, begin typing a search string in the search field. For certificates synchronized into Keyfactor Command, this is only used if the enrollment pattern is set as the Default Pattern For Template.

Supported Key Types

The Supported Key Types section displays the System-Wide Setting (value or Yes/No in the case toggled options) for the supported key typeClosed The key type identifies the type of key to create when creating a symmetric or asymmetric key. It references the signing algorithm and often key size (e.g. AES-256, RSA-2048, Ed25519). and allows you to override the system-wide settings for the specific enrollment pattern. Enabling Override System-Wide Setting will cause the system-wide setting to be disregarded, enable the settings field, and allow you to select the setting for that policy on the enrollment pattern. Override System-Wide Setting does not automatically set the policy to the value opposite the system-wide setting for toggled policies. The configuration on the policy will supersede any other settings.

Note:  The supported key algorithms for an enrollment pattern are determined based on the key size(s), type(s), and curve(s) returned for the associated certificate template from the CA and the Keyfactor Command enrollment pattern policy settings at both the system-wide and enrollment pattern levels. Evaluation using both the CA configurations and the Keyfactor Command policy allows for a key size to be set on an enrollment pattern in Keyfactor Command for validation purposes that can be different than the CA template key size setting (perhaps the CA supports RSA 2048, RSA 4096, and ECC 256 for the template but the Keyfactor Command enrollment pattern policy is set to disallow RSA and allow only ECC 256).

When configuring policies at the enrollment pattern level for key information, only algorithms, sizes, and curves supported for the associated template by the CA will appear as options for configuration.

Depending on the template associated with the enrollment pattern, one or more of these settings will be available for configuration:

  • RSA Key Sizes

    A list of RSA key sizes that are valid for enrollment through Keyfactor Command for this enrollment pattern. If a key size is not in this list, enrollment will not be supported for requests specifying that key size. To change the selected values, in the dropdown check any values you wish to support. The values supported by Keyfactor Command are: 2048, 3072, 4096, 6144, 8192, and 16384. Only values that are valid for the associated certificate template on the CA will appear as available for selection.

  • ECC Curves

    A list of elliptic curve algorithms that are valid for enrollment through Keyfactor Command for this enrollment pattern. To change the selected values, in the dropdown check any values you wish to support. The default values are: P-256/prime256v1/secp256r1, P-384/secp384r1, and P-521/secp521r1. Only values that are valid for the associated template on the CA will appear as available for selection.

    Keyfactor recommends using the most commonly used ECC curves (the default values) when possible, if a specific alternate curve is not required. ClosedShow available curves and associated OIDs.

  • Allow Ed448 / Allow Ed25515

    Enable or disable support for Ed448 or Ed25519 keys on the enrollment pattern.

Figure 284: Enrollment Patterns: Policies Tab

You can use the copy action to create multiple similar enrollment patterns. For example, this is useful when creating several enrollment patterns for the same template but with different default subjects.

To copy an enrollment pattern:

  1. In the Keyfactor CommandManagement Portal, browse to Locations > Enrollment Patterns.

  2. On the Enrollment Patterns page, highlight the row in the enrollment patterns grid and click Copy at the top of the grid or from the right-click menu.

  3. A new enrollment pattern will open for editing populated with the values from the enrollment pattern you copied. Modify the values as needed, following the instructions as per Adding or Modifying an Enrollment Pattern.
  4. Click Save to save the changes to the enrollment pattern record. Click Back to return to the main enrollment patterns page without saving changes.

An enrollment pattern can be deleted unless it is the default enrollment pattern for a certificate template and the certificate template has more than one enrollment pattern. If that is the case, an alternate default enrollment pattern must first be configured before the enrollment pattern can be deleted.

When an enrollment pattern is deleted:

To delete an enrollment pattern:

  1. In the Keyfactor CommandManagement Portal, browse to Locations > Enrollment Patterns.

  2. On the Enrollment Patterns page, highlight the row in the enrollment patterns grid and click Delete at the top of the grid or from the right-click menu.

  3. At the Confirm Operation prompt, click OK.
  4. If the enrollment pattern is associated with certificates or certificate requests pending at the CA level, a warning dialog will pop up asking you to confirm that you really want to delete it. Type the name of the enrollment pattern in the Confirm Operation field and click Delete.