Configure general KMES Series 3 settings
This section shows you the configurations to make on the KMES Series 3 to enable Venafi TTP to integrate through its Adaptable CA functionality.
To configure the KMES, perform the following tasks, detailed in this section:
- Enable the required Host API commands.
- Create KMES credentials for Venafi TPP.
- Create a signing approval group.
- Create an issuing CA.
- Add an issuance policy.
- Allow user-defined extensions for X.509 Extension Profiles (optional).
Because Venafi TPP connects to the Host API port on the KMES, you must define which Host API commands to enable. To set the allowed commands, complete the following steps:
Log in to the KMES Series 3 application interface with the default Admin identities.
Go to Administration > Configuration > Host API Options and enable the following commands:
Command
Description
RAGX
Retrieve Request (X.509 CSR)
RASX
Manipulate Signed Request
RAUX
Upload Request (X.509 CSR)
RAYX
Approve Requests
RKLO
Login User
RKRK
Retrieve Generated Keys
Select [ Save ] to finish.
Venafi TPP supports two options for user credential management. The single-user role option establishes one user per issuance policy that is permitted to submit certificate issuance requests, approve or deny requests, and revoke certificates. The dual-user role option establishes two users per issuance policy, with one permitted only to submit certificate issuance requests and one permitted only to approve or deny issuance requests or revoke issued certificates.
For a greater degree of administrative separation and adherence to principles of role-based access control, we recommend using the dual-user method.
Perform the following steps to set up a single-user role to control certificate requests, approval, and revocation.
Log in to the KMES Series 3 application interface with the default Admin identities.
Go to Identity Management > Roles and select [ Add ] at the bottom of the page.
On the Info tab of the Role Editor window, specify a name for the role and set the number of logins required to 1.
On the Permissions tab, enable the following permissions:
Permission
Subpermission
Certificate Authority
Export, Upload
Signing Approval
Approve
On the Advanced tab, allow authentication to the Host API port only.
Select [ OK ] to finish creating the role.
Go to Identity Management > Identities, right-click anywhere in the window, and select Add > Client Application.
On the Info tab of the Identity Editor window, select Application for the storage location and specify a name for the identity.
On the Assigned Roles tab, select the role you just created.
On the Authentication tab, remove the default API Key mechanism, add the Password authentication mechanism, and configure it.
Select [ OK ] to finish creating the identity.
Perform the following steps to set up a dual-user role to control certificate requests, approval, and revocation. One user is solely responsible for submitting certificate issuance requests, while the other is solely responsible for approving, rejecting, and revoking certificates.
Log in to the KMES Series 3 application interface with the default Admin identities.
Go to Identity Management > Roles and select [ Add ] at the bottom of the window.
On the Info tab of the Role Editor window, specify a name for the role and set the number of logins required to 1.
On the Permissions tab, enable the following permissions:
Permission
Subpermission
Certificate Authority
Export, Upload
On the Advanced tab, allow authentication to the Host API port only.
Select [ OK ] to finish creating the role.
Go to Identity Management > Identities, right-click anywhere in the window, and select Add > Client Application.
On the Info tab of the Identity Editor window, select Application for the storage location, and specify a name for the identity.
On the Assigned Roles tab, select the role you just created.
On the Authentication tab, remove the default API Key authentication mechanism, add the Password authentication mechanism, and configure it.
Select [ OK ] to finish creating the identity.
Use the preceding steps to configure a second role and identity, but enable the Approve permission under the Signing Approval permission category instead.
To enable certificate signing approval workflows on the KMES Series 3, perform the following steps to create a signing approval group:
Log in to the KMES Series 3 application interface with the default Admin identities.
Go to PKI > Signing Workflow.
Select [ Add Approval Group ].
Specify a name for the approval group and select [ OK ] to save.
Right-click the newly-created approval group and select [ Permission ].
Grant the Venafi Adaptable CA role the Use permission and select [ OK ] to save.
Remember the group name because you use it to configure the Adaptable CA driver configuration in a later section of this guide.
Perform the following steps to create an issuing CA certificate tree on the KMES Series 3:
Log in to the KMES Series 3 application interface with the default Admin identities.
Go to PKI > Certificate Authorities and select [ Add CA ] at the bottom of the page.
In the Certificate Authority window, enter a name for the certificate container, select the Venafi Adaptable CA role in the Owner group drop-down menu, and select [ OK ].
Right-click the certificate container and select Add Certificate > New Certificate.
On the Subject DN tab, set a Common Name for the certificate, such as RootCA.
On the Basic Info tab, leave the fields set to the default values.
On the V3 Extensions tab, select the Certificate Authority profile and select [ OK ] to create the certificate.
Right-click the root CA certificate and select Add Certificate > New Certificate.
On the Subject DN tab, set a Common Name for the certificate, such as IssuingCA.
On the Basic Info tab, leave the default values set.
On the V3 Extensions tab, select the Certificate Authority profile, then select [ OK ] to create the certificate
The root and issuing CA certificates now display in the Venafi Adaptable CA certificate container.
Log in to the KMES Series 3 application interface with the default Admin identities.
Go to PKI > Certificate Authorities.
Right-click the issuing CA certificate and select Issuance Policy > Add.
On the Basic Info tab of the Issuance Policy window, set an alias for the issuance policy (optional), set the desired number of approvals required for certificate requests, and set the hashes that you want to allow.
On the X.509 tab, perform the following actions:
- Select the Allow CSR uploads checkbox.
- Set the Default approval group to the approval group you created.
- If you set the number of required approvals to 0, you must select the Allow self approval checkbox. Otherwise, leave it unchecked.
- Add at least one Extension Profile.
If you set the number of approvals required to 0, you must set Anonymous Signing security usage on the issuing CA certificate. To do so, right-click on the issuing CA certificate and select Change Security Usage. Then, in the drop-down menu, select Anonymous Signing and select [ OK ] to save the changes.
Select [ OK ] to save the issuance policy.
If you want to allow users to define Subject Alternate Names (SANs) or other custom X.509 v3 extensions in Venafi TPP when creating certificates, choose one of the following options:
Perform the following steps to enable the Allow User-Defined Extensions option for the X.509 v3 extension profiles you plan to use with Venafi Adaptable CA:
Log in to the KMES Series 3 application interface with the default Admin identities.
Go to PKI > X.509 Extensions.
Right-click the X.509 v3 extension profile you want to modify and select [ Edit ].
Select the Allow User-Defined Extensions checkbox.
Select [ OK ] to save changes.
Perform the following steps to add Subject Alternate Names (SANs) to the X.509 v3 extension profiles you plan to use with Venafi Adaptable CA:
Log in to the KMES Series 3 application interface with the default Admin identities.
Go to PKI > X.509 Extensions.
Right-click the X.509 v3 extension profile you want to modify and select [ Edit ].
Select [ Add ], select the Subject Alternate Name extension type in the drop-down menu, and select [ OK ].
Add at least one subject alternate name entry and select [ OK ].
Select [ OK ] to save changes.