WebRA User Guide

In this section, learn about end to end user flow for Virtual ID.

1. Create a Certification Profile
2. Create a Service Plan
3. Create an Enterprise & configure Service Plan to it
4. Create a new role and assign profiles to the role
5. Create a virtual ID account on ADSS Web RA Web Portal
6. Create a Virtual ID certificate

After creating a virtual ID, you can perform a number of actions as listed below:

1. View Certificate 
2. Download Certificate 
3. Provision Certificate 
4. Delete Certificate 
5. History
6. More Actions

Virtual ID 

Virtual ID facilitates to register user ID and provides the capability to manage its certificates' keys. This certificate can be used for Advanced Electronic Signature to allow you to authorise a remote signing request using your registered mobile device(s). Certificate request can be for Issuance/approval, renewal and revocation.

Create a Certification Profile

A certification profile is created in ADSS Web RA to configure ADSS Profiles (Certification and/or CSP) to issue different types of certificates for the ADSS Web RA users. In other words, a certification profile (Certification and/or CSP) is actually created in the ADSS Server, and it is used in the ADSS Web RA Admin for its implication.

Certification profiles entail all complex configurations and business requirements (i.e. CA details, Key Algorithm, Validity, etc.) to issue corresponding certificates for the ADSS Web RA users. 

ADSS Web RA supports the following certificate types:

Server side key generation for remote authorized signing

1. Client must be registered in ADSS Server Client Manager
2. The Client must be configured in the ADSS Web RA connector of ADSS Server 
3. A SAM Profile must be created in the ADSS SAM Server 
4. A RAS Profile must be created in the ADSS RAS Server
5. The ADSS Web RA Certification Profile must be configured in the Service Plan

Create a Certification Profile in ADSS Web RA

An operator will create a certification profile by following the steps mentioned below:

1. From the admin portal, expand External Services > Certification Profiles from the left menu to see the certification profiles listing screen.

2. Click  from the grid header. 
3. A dialog will appear to add the profile details. The certification profile dialog consists of 5 screens, i.e. Basic Information, Profile Settings, Details. Authentications, Advance Settings. 

Basic Information 

At the Basic Information screen, enter the fields, then click >.

Profile Settings

Certification Profile Settings for a Certification Service profile:

Details

Once you have configured the profile settings, click > to move to the Details screen. 

Authentications

An administrator can use any of the available methods (OTP, SAML, Active Directory, Azure Active Directory, or OIDC) for secondary authentications, and can enable authentication for new certificate requests, revocation requests and rekey requests as displayed in the screenshot below:

Advance Settings 

Select a subscriber agreement from the drop down. You can also apply vetting 

Click Create to complete the process of creating a certification profile. 

Create a Service Plan  

The next step is to create a service plan. 

A service plan is a collection of allowed services and certificate types that are assigned to an Enterprise. 

1. A service plan (s) can be assigned to enterprises only. You cannot assign a Service Plan to the users directly.
2. Based on your business requirements you can create multiple service plans to offer different set of certification services to different enterprises.
3. You can configure one service plan in multiple enterprises but it is a good practice to create separate service plans for each enterprise if you are a service provider and there are many enterprises registered in the ADSS Web RA application. 
4. You can also change the service plan for a particular enterprise from the web portal. Click here.

Follow these steps to create a service plan

1. Click Service Plans from the left menu.
2. Click  from the grid header. 

3. A dialog wizard will appear to configure the service plan details. The wizard consists of 5 sequential screens, i.e.: Basic Information, Profile Settings, Enrolments, Notification and Advance Settings. 

Basic Information

Enter fields on the Basic Information tab. Then click >. 

Profile Settings 

Select virtual ID profiles from the drop down on the Profile Settings tab.

Profiles to create certificates for Virtual ID (remote authorisation) - Here, you can select multiple profiles to create virtual ID certificates.

Certificate profile for user registration (Virtual ID) - Here, you can set a default profile which will be used to register a default user and generate certificates

You can select other profiles too, then click >. 

Enrolments

You can select the required profiles for generating certificates on the Enrolments tab and then click > to proceed. 

Notification 

You can configure SMS Gateway and Email Gateway in the Notification tab, and then click >.

Advance Settings 

The Advance Settings screen will display a drop down named as 'Login Authentications', which will require all the primary authentications that are to be configured in the system. Here, the user can select one of the following mechanisms for primary and secondary authentications. 

A user can configure the following authentication mechanisms in a service plan:

• Email / Password Authentication 
• SMS OTP Authentication 
• Email OTP Authentication 
• Email & SMS Authentication
• SAML Authentication 
• Active Directory Authentication 
• Azure Active Directory Authentication
• OIDC

Once you specify the configurations of each screen accordingly, click Next to proceed further. 

Click Create. A new service plan will be saved and displayed in the list. You can also edit and delete a service plan, if required. 

Once you create a service plan, create an enterprise and configure the service plan to it.

Create/Register an Enterprise and assign Service Plan to it

1. Expand Enterprises > Requests from the left menu. 
2. Click  from the grid header as displayed in the screenshot below:

3. A screen will appear with three navigation tabs, i.e. Organisation Information (Assign Service Plan), Account Owner and License. See the table below for fields and their respective description. 

Fill in the Organisation Information fields and the click >.

Fill the mandatory fields and click > to proceed. 

4. Set Certificate Quote and expiry for the certification profiles on the License screen and click Create. 

5. A new enterprise will be saved and displayed in the list. 

Invite a new User

1. Click on the enterprise name, you will be directed to the enterprise management screen. Expand Users > User Invitations. 

Information 

• Name 

Enter name of the user you wish to invite to the enterprise. 

• Email

Enter email of the user you wish to invite to the enterprise. 

• Role

Select a role for the user.

Click Invite User.

 

2. An email will be sent to the user on the above configured email address. (As displayed below) Click Join Now. 

 

3. The user will be redirected to the ADSS Web RA web portal’s account activation screen. Enter the details:

• Email 

Email of the user to register on the Web portal. 

• Mobile Number 

Mobile number of the user. 

• Password 

Set a password for the login email.

• Confirm Password

Confirm password for the login email. 

• Security Question 

Set a security question for password recovery 

• Security Answer
• Set a security answer for password recovery 

Select I agree to the Terms of Service and Privacy Policy.

Click Activate. 

4. The user will now be directed to the Login screen, enter the user email and click Next.

5. Enter the password and click Login Here. 

Add a Request Note

An operator can add customisable request notes to guide users through each step in the certificate creation process. They can choose to add text to any/all steps of creating certificate requests.

To access, request notes expand "Enterprises" > "Registered", against your enterprise click  and then click Manage. From the enterprise menu expand Notifications > Request Notes. 

An operator can add request notes against the following modules:

• Certificate Center 
• Virtual ID
• Desktop Signing 
• Device Enrolment
• Windows Enrolment
• SigningHub Integration

 

An administrator can add request notes to any of the above modules from ADSS Web RA admin portal, that will be visible on the ADSS Web RA web portal. 

1. To access request notes, expand "Enterprises" from left menu. Then click "Registered". 
2. Click on the  button against a specific enterprise to manage its configurations. 
3. A new menu will appear on the left menu pane. Expand "Notifications", then click "Request Notes".

The request notes can be added against the following categories:

1. Welcome Note
2. Create Account
3. Certificate Signing Request (CSR)
4. Subject Distinguished Name (SDN)
5. Subject Alternative Name (SAN)
6. Certificate Validity 
7. Vetting Form 
8. Domain Ownership Verification 
9. Authentication 
10. Challenge Password

Then click Save. 

Create a new role and assign profiles to the role

1. Click Enterprises from left menu, a sub-menu will appear in the drop-down. Navigate to Registered and click it to move to the next screen. 
2. Click on the button against a specific enterprise and click Manage to manage its configurations. Then click Roles.
3. The operator can add a role by clicking on the button. 
4. The operator then needs to enter the name and description, and can also set that role as default by ticking the check box Default. 

 

Once an operator Adds or Edits a role, the module section form will appear with all allowed modules. It is on the discretion on the operator to allow read, add/edit and delete options against the allowed modules. The operator can set the role as Default. 

An operator can add, update and delete enterprise roles. By default, only one role is created when an enterprise is registered. 

   

Click and then the Edit button to find the following sections on this screen:

1. Module 
2. Certificate Management 
3. Enrolments 
4. Certificate Access
5. Login Authentications 

Click the Certificate Management tab.

Then click Save. 

Create Virtual ID account on ADSS Web RA Web Portal 

Click on Virtual ID from the left menu pane, then click Create to setup a new Virtual ID for the very first time.

On the Create Account screen, the User ID and Mobile Number will be auto-filled, click >.

The Subject Distinguished Name (SDN) screen will appear. Enter the Common Name and Email, then click>.

Select the Validity Period on the Certificate Validity screen, and click Create. 

The Account Created message will appear. Click OK. 

The certificate will appear in the Issued Certificates listing. 

Create a Virtual ID certificate

An operator can create different types of certificate using Virtual ID that are allowed in the service plan.

All the certificate requests related to a Virtual ID user will be listed here. 

Once you have created a Virtual ID, follow the steps below to create a certificate request:

1. To create a certificate request, click  icon on top right.

2. The Certificate Type drop down will appear with multiple profiles that are configured in the service plan (admin portal). Select a certification profile from the list and click Create. 

3. A Welcome Note screen will appear, if configured in the Enterprise request notes. 

The welcome note will appear, select the checkbox 'I allow the use of my data for processing certificate application by Enterprise Name' and click next. (This screen will appear if operator has customised request notes in the enterprise the user belongs to.)

4. The Subject Distinguished Name (SDN) screen will be displayed.

5. The Certificate Validity screen will be displayed. The validity period will appear in a disabled form. Click Generate to proceed. 

6. The subscriber agreement confirmation will appear. Click Yes to proceed. 

7. A certificate will be generated and you can find it in your download folder on your computer. 

A user can perform the following actions against virtual ID: 

1. View Certificate 
2. Download Certificate 
3. Provision Certificate 
4. Delete Certificate 
5. History
6. More Actions 

Click Issued Certificates from the sub-menu. The following screen will be displayed:

Click button and you can perform a number of actions as displayed below:

View Certificate 

Click View Certificate against the certificate you want to view. The certificate information will be displayed. Then click Close. 

Download Certificate 

Click Download Certificate and the certificate will be downloaded on your machine. 

Provision Certificate 

Click Provision Certificate and the certificate will be provisioned to your Desktop Signing account. 

Delete Certificate 

1. Expand Requests > Issued Certificates. 
2. Click against the certificate you want to delete and then click Delete Certificate. 

3. A confirmation dialog will appear as displayed below. It will also delete certificate (s) against this request,

This section appears according to the configurations in the Policy section in the Admin portal.

History 

If you have revoked a certificate, or reinstated a revoked certificate, you can also view the history by clicking against a specific certificate. Then click History.

You can see what action was performed on a certificate previously.

More Actions 

Click More Actions to revoke, rekey, reinstate or renew a certificate as per configured in the admin portal. 

Rekeying a certificate generates a new key and certificate with the same name and expiration date as an existing certificate. Rekeying is used if an existing key is lost or compromised. 

This section lists all the rekey certificate requests pertaining to the Virtual ID. 

As a pre-requisite, the rekey certificate option should be enabled in the Policy section from the admin portal.  

To rekey a certificate from the web portal:

1. Expand Virtual ID > Issued Certificates. 
2. Click the button against the certificate that you want to rekey and click on More Actions. 

3. Certificate action screen will be displayed. Select "Rekey Certificate" from the drop down, click the confirmation button and then click View Request. 

4. The certificate request will appear on the screen. The Welcome Note screen will appear. Click next.

The Subject Distinguished Name (SDN) screen will be displayed. 

The Certificate Validity screen will appear. Click next. 

Click Rekey, a certificate rekey confirmation will appear. You can enter an optional message, then click Rekey. 

The certificate generated message will appear. 

The certificate will appear in the Virtual ID Rekey Requests listing. 

ADSS Web RA Server supports certificate renewal before a certificate expires. It is the process by which a user renews a certificate for the same public key used in an expiring certificate.

This section lists all the renewal certificate requests. 

As a pre-requisite, the renew certificate option should be enabled in the Policy section from the admin portal.  

Renew a Certificate 

To renew a certificate from the web portal:

1. Expand Certificate Center and click Issued Certificates. 
2. Click the button against the certificate that you want to renew and click on More Actions.

3. Certificate action screen will be displayed. Select Renew Certificate from the drop down, click the confirmation button and then click Renew. 

4. The certificate generated roaster message will appear. This certificate request will appear in the renewal requests listing. 

Certificate revocation is a process in which a certificate's usage is terminated before the validity period expires.

This section lists all the certificate revocation requests pertaining to a Virtual ID user. 

To revoke a certificate from the web portal:

1. Expand Virtual ID and click Issued Certificates. 
2. Click the button against the certificate that you want to revoke and click on More Actions. 

3. Certificate action screen will be displayed. Select Revoke Certificate from the drop down, select a reason for revocation, tick the confirmation checkbox and then click Revoke. 

The certificate will be revoked and it will appear in the Revocation Requests listing. 

A certificate re-issue is a process in which the a user generates a new private key and CSR for an existing certificate. A user may need to proceed with certificate issuance if he loses or deletes his private key. 

If they want to make a change in any of the certificate's information, or if they want to change the certificate's encryption level. Once re-issuance process is complete, a new digital certificate is produced. 

This section lists all the reissue certificate requests pertaining to the Virtual ID user. 

To reissue a certificate from the web portal:

1. Expand Virtual ID and click Issued Certificates. 
2. Click the button against the revoked certificate that you want to reissue and click on More Actions. 

3. Certificate action screen will be displayed. Select Reissue Certificate from the drop down, click the confirmation and then click View Request. 

4. You will be navigated to the Certificate Reissue screen. You can add an optional message, and then click Reissue.

This certificate request will appear in the Reissue Requests listing under the Virtual ID section. 

An operator can manage the Virtual ID settings from this section.

Expand Virtual ID > Settings. The following screen will be displayed: 

An operator can change the mobile number for OTP authentication and device registration. Once he enters a new mobile number click Save, an OTP will be sent via SMS and the other via Email. Enter both OTPs and click Verify for verification. The new number will be saved upon verification. 

User name is the user that has logged into ADSS Web RA web portal. User ID is the virtual ID user that is registered in the ADSS Web RA. And the mobile number is provided to set up Virtual ID user. 

Remove Virtual ID

1. Expand Virtual ID > Settings from the left menu.
2. Click on the Remove Virtual ID Account link.
3. A confirmation message will appear. Click Yes to remove your configured Virtual ID account.