ODKG - On Device Key Generation

The ODKG page provides the ability to enroll for a certificate using a private key Private keys are used in cryptography (symmetric and asymmetric) to encrypt or sign content. In asymmetric cryptography, they are used together in a key pair with a public key. The private or secret key is retained by the key's creator, making it highly secure. generated on the target hosting the certificate store to which the certificate will be deployed. This option is supported for selected certificate store types (see Certificate Store ODKG).

To request a certificate via ODKG:

1. In the Keyfactor CommandManagement Portal, browse to Enrollment > ODKG.

2. From the Certificate Authority Information section select an enrollment pattern from the Enrollment Pattern dropdown.

   The enrollment patterns are organized by configuration tenant A grouping of CAs. The Microsoft concept of forests is not used in EJBCA so to accommodate the new EJBCA functionality, and to avoid confusion, the term forest needed to be renamed. The new name is configuration tenant. For EJBCA, there would be one configuration tenant per EJBCA server install. For Microsoft, there would be one per forest. Note that configuration tenants cannot be mixed, so Microsoft and EJBCA cannot exist on the same configuration tenant. (formerly known as forest An Active Directory forest (AD forest) is the top most logical container in an Active Directory configuration that contains domains, and objects such as users and computers.). If you have multiple configuration tenants and enrollment patterns with similar names, be sure to select the enrollment pattern in the correct configuration tenant.

   The list of enrollment patterns that appears in the dropdown depends on the enrollment pattern’s configurations for Use AD Permissions and Associated Roles (see Basic Information Tab):

   • Use AD Permissions Enabled: An enrollment pattern appears if the user is an Active Directory user, the user has certificate request permissions on the template associated with the enrollment pattern, and Keyfactor Command is installed on a domain-joined Windows server.

   • Use AD Permissions Disabled: An enrollment pattern appears if the user holds a Keyfactor Command security role listed in Associated Roles for the enrollment pattern.

   

   Figure 130: Select an Enrollment Pattern

3. In the Certificate Authority field, select the Certificate Authority from which the certificate should be requested, or accept the default.

   Note:   The list of CAs that appears in the dropdown depends on the enrollment pattern's Restrict CAs setting (see Basic Information Tab) and the configuration tenant of the template associated with the enrollment pattern:

   • Restrict CAs Enabled: The CAs listed in the enrollment pattern’s Certificate Authorities list, limited to those in the same configuration tenant as the associated template.

   • Restrict CAs Disabled: All enterprise CAs defined in Keyfactor Command that share the same configuration tenant as the associated template.

   In either case, in order for the CA to appear in the dropdown:

   • The CA must have the Use for Enrollment option enabled in Keyfactor Command.

   • The template associated with the enrollment pattern must be available for enrollment on the CA.

   • The template must have certificate request permissions granted to the appropriate user (see HTTPS CAs - Advanced Tab or DCOM CAs - Advanced Tab).

   

   Figure 131: Select an Enrollment Pattern and CA

4. In the Certificate Subject Information section of the page, populate the fields as appropriate for the certificate being requested. Although Keyfactor Command does not strictly require the Common Name, the product does ship with a default regular expression A regular expression--RegEx--is a pattern used to validate data by ensuring it meets specific criteria. Several fields on the CSR enrollment, CSR generation, and PFX enrollment pages support RegEx validation, including certificate subject and metadata fields. requiring a value for this field since it is common for a CA to require this. This regular expression may have been altered in your environment (see Enrollment Pattern Operations).

   

   Figure 132: Certificate Subject Information

5. In the Subject Alternative Names (SANs) section of the page, click Add to add SANs if needed. In the Add SANs dialog, select a Type in the dropdown and in the Value box add one or more SANs of the selected type and save. Only SANs of a single type may be added in a single add action. Click Edit to change a SAN The subject alternative name (SAN) is an extension to the X.509 specification that allows you to specify additional values when enrolling for a digital certificate. A variety of SAN formats are supported, with DNS name being the most common. field. The Edit SAN dialog includes only one SAN, not the multi-SAN block. Click Delete to delete a SAN.

   The SAN field in this interface supports: DNS name, IP version 4 address, IP version 6 address, User Prinicpal Name, Email. Alternate SANs may be submitted in requests using the Keyfactor API An API is a set of functions to allow creation of applications. Keyfactor offers the Keyfactor API, which allows third-party software to integrate with the advanced certificate enrollment and management features of Keyfactor Command..

   Important:  If the Enforce RFC 2818 Compliance option has been enabled for the selected enrollment pattern (see Enrollment Pattern Operations) or system-wide, a SAN will automatically be added with a DNS The Domain Name System is a service that translates names into IP addresses. SAN matching the CN A common name (CN) is the component of a distinguished name (DN) that represents the primary name of the object. The value varies depending on the type of object. For a user object, this would be the user's name (e.g. CN=John Smith). For SSL certificates, the CN is typically the fully qualified domain name (FQDN) of the host where the SSL certificate will reside (e.g. servername.keyexample.com or www.keyexample.com). entered for the certificate. This SAN will not appear in the grid and cannot be edited.

   

   Figure 133: Add SANs

   Note:  If you are enrolling against an EJBCA CA, by default the total SAN length cannot exceed 2000 characters. If you need to enter SANs that will cause the total length to exceed this maximum, see Appendix - Configuring Support for Large or Custom SANs with EJBCA.

   Microsoft CAs by default support a total SAN size of 4k. If you need to enter SANs that will cause the total size to exceed this, please refer to this article:

   https://learn.microsoft.com/en-us/troubleshoot/windows-server/certificates-and-public-key-infrastructure-pki/expand-maximum-extension-size-limit-ad-cs#expand-the-limit-by-using-an-administrative-command-prompt
   Note:  If a regular expression is defined system-wide or at the enrollment pattern level (see Enrollment RegExes Tab) for a subject part or SAN, and that field is left blank, the regular expression will still be applied to an empty string. For example, if a regular expression is defined for the organization field but no organization is provided, the system treats the empty string as the input and applies the regular expression accordingly.

6. If enrollment fields have been defined for the selected enrollment pattern (see Enrollment Fields Tab), the fields will display in the Additional Enrollment Fields section. Additional enrollment fields have a data type of either string or multiple choice. String fields will appear as a text box; multiple choice fields will appear as a dropdown. All additional enrollment fields are required.

   

   Figure 134: Populate Enrollment Fields

1. In the Certificate Metadata section of the page, populate any defined certificate metadata Metadata provides information about a piece of data. It is used to summarize basic information about data, which can make working with the data easier. In Keyfactor Command, the certificate metadata feature allows you to create custom metadata fields that allow you to tag certificates with tracking information about certificates. fields (see Certificate Metadata, Configuring Template Options, and Adding or Modifying an Enrollment Pattern) as appropriate. These fields may be required or optional depending on your metadata configuration. Required fields will be marked with *Required next to the field label. Any completed values will be associated with the certificate once it has been imported into Keyfactor Command. The order in which the metadata fields appear can be changed (see Sorting Metadata Fields).

   Email metadata fields will allow for multiple email addresses to be added via a pop-up text box where email addresses are entered separated by comma or semicolon. During entry the addresses will appear as a single row in the metadata grid. However, after saving each email address will be displayed on a separate row.

   Tip:  If a hint has been provided for a specific metadata field, it will display in parentheses to the right of the metadata label.

   

   Figure 135: Populate Metadata Fields

3. The Certificate Owner section of the page appears if you set the Certificate Owner Role policy to Optional or Required at either the system-wide or enrollment policy level (see Configuring System-Wide Settings and Policies Tab). In the Owner Role Name field, select an owner for the certificate, if appropriate. The certificate owner is a security role defined in Keyfactor Command (see Security Roles and Claims). If the user assigning the owner is an administrator, the Owner Role Name will be a search select field in which to enter the new certificate owner. To narrow the list of results in the search select field, begin typing a search string in the search field. If the user assigning the owner is a limited access user, the Owner Role Name will be a dropdown. Only security roles of which the user is a member will appear in the dropdown.

   

   Figure 136: Select a Certificate Owner

3. In the Certificate Delivery Format section of the page, select Include Certificate Stores to open the Select Certificate Store Locations dialog.

   Note:  Only one certificate store may be chosen for ODKG at a time.
   Select Certificate Store Locations Dialog

   The Select Certificate Store Locations dialog allows you to run queries against your certificate store list to select the store to which to deploy.

   Note:   Certificate stores appear in the grid if:

   • They are of a type that supports on-device key generation (see Certificate Store ODKG).
   • They are in containers to which you have permissions.

   Tip:  You may change the search results by using the search fields at the top of the dialog. All of the Keyfactor Command grid search features are available to assist your search. See Using the Certificate Store Search Feature for more information on the available search fields. The default search criteria is AgentAvailable is equal to True.

   The actions on the Select Certificate Store Locations dialog are:

   • Include

     Click this to add the selected certificate store to your certificate selection and leave the search dialog open for further searches. Only one certificate can be selected. If you select another certificate and click Change or Change and Close, it will replace the first certificate you selected.

   • Include and Close

     Click this to close the search dialog and add the selected certificate store to your certificate selection, which will then be displayed and ready for updates as per the instructions in Add to Certificate Stores.

   • Close

     Click this to cancel the operation and return to the main page with no certificate stores selected.

   

   Figure 137: Select Certificate Store Locations Dialog

   Additional fields will appear on the page in a grid section once you have selected a certificate store.

   Certificate Stores - Delivery

   The additional fields that appear on the page once you select the certificate store to distribute your certificate to include a grid section with required or optional additional fields below this, which vary depending on the certificate store type.

   Above this section are the following options:

   • Change Certificate Stores

     Open the Select Certificate Store Locations dialog again.

   • Schedule when to run the job for the certificate store

     In the Schedule dropdown, select a time at which the job to add the certificate to the store should run. The choices are Immediate or Exactly Once at a specified date and time. If you choose Exactly Once, enter the date and time for the job. A job scheduled for Immediate running will run within a few minutes of saving the operation. The default is Immediate.

   For the selected certificate store you can apply the following actions:

   • Overwrite

     Check Overwrite below the grid to allow the selected certificate to overwrite any existing certificate in the same location with the same name or alias.

   • Alias

     Add an Alias below the grid, if applicable, for the certificate store type. See the Information Required by Certificate Store section, below, for more information.

     Note:   The tab heading of the certificate location will display an alert if an alias is required for the location.

   The Alias field is a search-select entry type. The dropdown lists all aliases associated with the selected certificate store.

   • If an alias appears in multiple certificate stores, the number of locations is shown in parentheses next to the alias name. This indicator does not appear if the alias exists in only one selected store.
   • Users can enter a new alias as long as Custom Aliases are not forbidden on the certificate store type Certificate Store Types.
   • If you select an existing alias without checking Overwrite, the Save will fail and the certificate store(s) in which that alias already exists will be listed.

   • Custom Fields

     Add values for custom fields, if displayed.

   You may return to the Select Certificate Store Locations dialog by clicking Change Certificate Stores above the grid. The current selections will be retained until you change them.

   

   Figure 138: ODKG Enrollment: Certificate Store Delivery Format

   Information Required by Certificate Stores

   Each type of certificate store has different requirements for providing an alias or other additional information.

   The certificate store type fields that are relevant to certificate store use are:

   • Supports Entry Password

     If your certificate store type has this enabled, you will have the option to enter a password for the certificate entry in the certificate store on the addition of an entry into the certificate store.

     

     Figure 139: Certificate Store Type Configuration: Basic Tab

   • Supports Custom Alias

     A value of Required indicates that a custom alias will be required when a certificate is added to a certificate store. Optional indicates an alias can be associated with the entry if desired. If your certificate store type sets this to Forbidden, the Alias field will not display when adding a certificate to a certificate store unless Overwrite is checked on the add page. In this case, you’re not associating an alias with the certificate you’re adding to the store but rather specifying the alias of the certificate already in the store that you wish to replace (in function) with the new certificate you’re adding.

     The format of custom alias values varies depending on the certificate store type. In many cases, the alias is the thumbprint of the certificate. In some cases, it’s the file name of the certificate file or a custom alias provided at the time the certificate was added to the certificate store. For instance:

     Note:  Keyfactor Command will automatically strip out any spaces between the octets in thumbprints in the alias field, so it does not matter whether you enter the thumbprint with or without spaces.
     Tip:  When adding a certificate to a certificate store, you have the option to overwrite an existing certificate with the current certificate. If you choose this option, you will need to provide the alias of the certificate you wish to overwrite.

     The Alias field is a search-select entry type. The dropdown lists all aliases associated with the selected certificate store.

     • If an alias appears in multiple certificate stores, the number of locations is shown in parentheses next to the alias name. This indicator does not appear if the alias exists in only one selected store.
     • Users can enter a new alias as long as Custom Aliases are not forbidden on the certificate store type Certificate Store Types.
     • If you select an existing alias without checking Overwrite, the Save will fail and the certificate store(s) in which that alias already exists will be listed.

   • Entry Parameters

     Not all certificate store types will have entry parameters. The ones shown in Figure 140: Certificate Store Type Configuration: Entry Parameters Tab are for the custom Windows Certificate type for the Keyfactor custom-built IIS Certificate Store Manager extension (see Installing Custom-Built Extensions).

     

     Figure 140: Certificate Store Type Configuration: Entry Parameters Tab

1. At the bottom of the page, click Enroll to begin the certificate request process.

   

   Figure 141: ODKG Enrollment Completed Successfully