Entrust CA Gateway

Entrust has a gateway that exposes its REST API's to client applications named as Entrust CA Gateway. ADSS Server is supporting Entrust CA Gateway version 2.7.10. In order to configure it as an External CA, select the Entrust CA Gateway option from the CA Type drop down. These options will be shown:

The items are described in this table:

Items

Description

CA Alias

An operator-defined descriptive name to make it easier for ADSS Server operators to manage multiple certificate authorities. The name used must be unique.

CA Type

ADSS Server can be configured to request certificates from the Entrust CA Gateway. All requests received in the corresponding ADSS Certification Service will be forwarded to the defined External CA for processing. The supported request types are:

CREATE
RENEW
REVOKE
Revocation reasons can include:

unSpecified
keyCompromise
affiliationChanged
superseded
cessationOfOperation
certificateHold

REINSTATE

The above operations can also be performed on ADSS Console and all the requests will be routed to Entrust CA Gateway configured as an External CA.

CA Certificate

All the CA certificates configured in Trust Manager with the purpose CA (will be used to verify other certificates and CRLs) are available in this drop down list.

Select the target Entrust CA Gateway certificate.

Note: The complete certificate chain of the Entrust CA must be registered in Trust Manager.

CA Address

Specify the URL from where this CA could listen the certificate request messages.

TLS Client Certificate

Required for communication with the CA if Entrust CA Gateway is communicating over TLS Client Authentication. Select the TLS Client Authentication Certificate which pre-exists in the Key Manager.

Note: It is required to register the Issuer CA of the TLS Client Authentication certificate in Trust Manager with purpose CA for verifying TLS client certificates.

CA ID

Specify the CA ID to be used in order to generate the certificate.

Profile ID

Specify the Profile ID to be used in order to issue certificates from Entrust CA Gateway.

Known Limitations of Entrust CA Gateway

Here are the known limitations of Entrust CA Gateway that the operator must consider:

While revoking or reinstating a certificate, the 'title' attribute shall not be passed in the RDN.
While creating a new certificate, the 'uniqueIdentifier' attribute in RDN is not being supported by Entrust CA Gateway.