ADSS Admin Guide

If it is required to generate certificates as per CA/B Forum and WebTrust Guidelines, then enable following properties in Global Settings > Advanced Settings > General page:

• Enable CA validation check
• Debian weak Keys

​The ADSS Server Developers Guide explains the XML schema used for both the certification service request messages and certification service response messages. It also describes Java and .Net APIs that can be used to build the client application.

Items

Description

CA Certificate Info: 

Defines the following: 

Status

A CA may be marked either Active or Inactive.  As suggested by its name, an Inactive CA will not be used to issue/renew/revoke certificates until its status is later changed to Active.

Mark it the default CA

If selected, this identifies this Local CA as the default to be used for generating certificates within ADSS Server.

CA Friendly Name

An operator-defined unique name for easy management of certificate authorities within ADSS Server. This is only for human identification purposes and not used within the certification request/response messages.

Description

This can be used to describe the CA in more detail (e.g. in which circumstances will this CA will be used). This is for information purposes only.

CA Certificate

The drop-down menu will only show the certificates within the ADSS Key Manager that have their key usage extension marked for Cert/CRL signing (i.e. Key Usage = cRLSign, keyCertSign).  These certificates are the certificates for the keys that were given a purpose of Certificate/CRL Signing when they were created by Key Manager.

Select the certificate that you want to configure as a CA. This CA will be used as the Certificate and CRL issuer.

Certificate Validity Settings:

This option is used to define the validity time/date procedure of a certificate according to the issuer's certificate validity date/time. The possible values are:

• Issue the Certificate
  Select this option if you wish to issue the target certificates beyond the CA's expiry date.
• Use CA's Expiry Date/Time
  By selecting this option, ADSS Server will silently set the CA's expiry date (Valid To) in the target certificate (Valid To) if user provided the target certificate validity period beyond the CAs expiry date.
• Return Error
  When this option is selected then an error message will be returned to the user if the user provided the target certificate's expiry date is beyond the CA's expiry date.

Note: If the user provides a time period for target certificate that is not beyond the CAs expiry date/time then the target certificate will be generated using the user provided date/time regardless of which option is selected.

Certificate Extensions:

Defines the following: 

CDP Address (HTTP)

The address configured here will be used within the CDP extension field of certificates issued by this CA.

CDP Address (LDAP)

The address configured here will be used within the CDP extension field of certificates issued by this CA.

AIA Address (OCSP)

The address configured here will be placed within the AIA extension field of certificates issued by this CA and can be used to check the certificate revocation status over OCSP. Multiple addresses can be added by clicking on '+' button.

AIA Address (CA Issuers)

The address configured here will be placed within the AIA extension field of certificates issued by this CA.  It can be used to access certificates that were issued to this CA and other information about this CA (e.g. online validation services and CA Policy data). Multiple addresses can be added by clicking on '+' button.

Issuer Alternative Name OID (otherName)

This field is used to define the Issuer Alternative Name of type otherName. Specify the OID in the first field and its value in the second (Value) field.

There are multiple scenarios by which we can define the Issuer Alternative Name of type otherName. These are as follows: 

1. If Issuer Alternative Name OID is configured in Manage CA and also enabled in certificate template, then.

• We can add configured Manage CA OID in issuer SAN (other SAN values retained) and put it as an IAN in end entity certificate.
• We can put OID and configured value in Manage CA as IAN in end entity certificate in case where there is no SAN and IAN in issuer certificate.

2. If Issuer Alternative Name OID is not configured in Manage CA, then, we can add issuer SAN as IAN in end entity certificate as per standard.

Certificate Issuance Reporting Settings:

ADSS Server can report on the issuance and revocation of certificates. When the ADSS Server Local CA chains to an external CA e.g. GlobalSign CA then this option allows each issued and revoked certificate to be reported to the external CA e.g. GlobalSign Cert Safe service.

When this option is selected the following items are also shown:

Account Name

The Account Name issued for this CA.

Service URL

The Issuer CA URL i.e. Cert-Safe URL.

TLS Client Authentication

The TLS Client Certificate required for authentication with Issuer CA URL i.e. Cert-Safe service URL.

Certificate Transparency Settings:

Certificate Transparency helps identifying TLS Server certificates which have been mistakenly issued by a certification authority or maliciously acquired from an otherwise unimpeachable certification authority. This approach requires CAs to publicly publish information about their issued certificates so that anyone can check whether a certificate has been properly issued. Certificate Transparency (CT) does not stop fraudulent certificates being created, but it enables them to be quickly and easily detected. When this license controlled option is enabled for a CA, it manages the TLS Server certificates issuance and interacts with certificate transparency log servers.

When this option is selected the following items are also shown:

Log Server Address

This specify the address of a log server. Log Servers are used to store information about the issued TLS Server Certificate by a particular CA. These accept a yet to be issued certificate from a CA and return an SCT (Signed Certificate Timestamp); a proof that the certificate has been received by the Log Server.

Log Server Public Key

Log Server(s) generate the Signed Certificate Timestamp(SCT) against the CA request and log server public key is use to verify it.

List of Configured Log Servers

Set the order for the addresses of log servers where the TLS Server Certificate will be stored.

Number of SCTs required

This defines the number of log servers required to approve the request. The total number of log servers may be equal to or greater than this number. This number cannot be zero as at least one log server is required. 

In case the number is 2 or greater, then at least two log servers must provide the SCTs.

Use another CA for Pre-certificate Signing

By enabling this option, a pre-signing certificate can be selected from the drop down menu. The drop-down menu will only show the certificates within the ADSS Key Manager that have certificate transparency in the certificate EKU (Extended key usage extension). 

The pre-certificate is constructed from the certificate to be issued by adding a special poison extension. The pre-certificate are submitted to the log servers to get SCTs embedded in the real certificate. 

Delegate the Pre-certificate logging process to other entities

By enabling this option, ADSS CA Server delegates a client application to interact with log server instead of interacting with the log server directly. Upon receiving a TLS Server Certification request from client application, ADSS CA Server creates a pre-certificate and returns this pre-certificate and its chain along with log server information to the client in order to get the required SCT (Signed Certificate Timestamp) from the log server. The client application will log this chain with the log server to get the SCT and provide it to ADSS Server that will embed it in the original certificate and return this certificate to the client application. 

Note: This option is useful when ADSS CA Server is working in a highly secured environment and have no access to external servers. 

CRL Settings: 

Defines the following: 

CRL Validity Period

Specify the time in minutes to calculate the CRL validity period (Next Update).

Generate and Publish CRL Automatically

Specify the time in minutes after which the CRL will be published. This time must be less than the value specified in the "CRL Validity Period" field. 

Publish Emergency CRLs

Emergency CRLs are published immediately when a revocation/reinstatement event occurs rather than waiting for the next scheduled CRL e.g. when a certificate is revoked, an emergency CRL is published so that latest information is available to the CRL and OCSP responders. The ADSS OCSP Service can automatically pick-up the emergency CRLs and provide real-time certificate status information.

Hashing Algorithm

Select the Hashing Algorithm that will be used as part of the CRL signing.

CRL Publishing File Path

This is the path to the location where published CRLs will be stored. This is a mandatory field if one of the above check boxes are checked as you have to specify the address in the file system where you want to publish the CRL. Otherwise the field is optional.

Keep expired revoked certificates in the CRL from

If this option is enabled and a time is specified, the CA will keep all the revoked certificates in the CRL that were expired at the exact time (as specified) or after that time.

LDAP Publishing Settings:

Defines the following: 

Note: OpenLDAP and Apache DS v2.0.0.AM25 are tested. 

Publish CRL in LDAP

Enable this if it is required to publish the CRL on LDAP Server.

Publish Issued Certificates in LDAP

Enable this if it is required to publish the Issued certificate on LDAP Server.

CRL Publishing LDAP Server

Set the LDAP Server URL e.g.

• localhost
• 192.168.3.170
• dc1.main.domain.com

Port

Set the port number of the LDAP server - the default port is 10389.

Bind DN/User

Set the username or Distinguished name (DN) that will be used to login to the LDAP server.

Password

Set the password that will be used to authenticate the user to the LDAP server.

[BUTTON]
Publish CRL

This button provides an option to immediately manually publish a CRL to the configured file path. 

​As "Distinguished Name" will be extracted dynamically from the AA certificate, so the user will not provide it. The Identity/Attribute Certificates will be published if this DN structure is present in the LDAP Directory.​

OpenLDAP and Apache DS.

​This screen shows certificates issued by Key Manager, Certification Service and Manual Certification while the Certification Service's Issued Certificate sub module only shows the certificates issued by the Certification Service.

​​​If an issued certificate is required to be deleted and the same certificate alias is required to be used for the new certificate then operator need to restart the ADSS Core, Console and Service instances from Windows NT Services panel or UNIX daemon.

If "_" character is used in the search then it will act as wildcard.

If a certificate deletion request comes through certification service interface, ADSS Server will check ENABLE_VALID_CERTIFICATE_DELETION property first and decide to take actions according to the value of the property.