Certificate Autoenrollment on Mac OS X/macOS
Most of the Certificate Autoenrollment code is implemented in Java. After this code has successfully requested a certificate from a CA, it invokes platform-specific code to store the private key and certificate in a suitable way for the operating system or for particular applications. This platform-specific code is implemented as a shell script, certstore.sh in the /var/opt/quest/vascert/script directory.
The certstore.sh script is a platform-agnostic front end that chooses and loads a platform-specific back end script. For Mac OS X®/macOS®, the back end script is certstore-mac.sh. This script provides a fully functional implementation that uses the /usr/bin/security tool to integrate with Max OS X/macOS keychains.
Certificate Autoenrollment requirements and setup
Prior to installing One Identity Certificate Autoenrollment, ensure your system meets the following minimum hardware and software requirements:
| Component | Requirements | ||
|---|---|---|---|
| Operating system |
Mac OS X®/macOS® 10.8.3 or higher | ||
| Java unlimited strength policy files | See Java requirement: Unlimited Strength Jurisdiction Policy Files | ||
| Authentication Services |
One Identity Authentication Services version 4.1.2 | ||
| Additional software |
Certificate Autoenrollment depends on services provided by a Microsoft Enterprise Certificate Authority (CA) in your environment. In addition to Active Directory and an Enterprise CA, you must install the following software in your environment:
In order for Certificate Autoenrollment to function on client computers, you must configure the following policies:
Additionally, you must configure Java 1.6 or higher as the default JVM for your system.
| ||
| Rights |
Enterprise Administrator rights to install software and configure Group Policy and Certificate Template policy (only if Certificate Autoenrollment is not already configured for Windows hosts in your environment.) |
Java requirement: Unlimited Strength Jurisdiction Policy Files
By default, most JRE and JDK implementations enforce limits on cryptographic key strengths that satisfy US export regulations. These limits are often insufficient for Certificate Autoenrollment and may lead to "java.security.InvalidKeyException: Illegal key size" failures. The "Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files" can be installed to remove these limits and enable Certificate Autoenrollment to function properly.
Do I need the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files?
In general the answer is: Yes, these files are needed.
Java 9 and above do not require these files, but Java 6, 7 and 8 rely on these files.
In some environments, Certificate Autoenrollment may be able to function correctly without these files. Typically, these are older environments such as Windows Server 2008 R2 with Java 6 on Mac OS X 10.9. However, even if one of these environments works now, it may no longer work in the future when its components are upgraded to newer releases. Therefore, it is prudent to install the policy files even if they are not needed at present.
Obtaining and installing the policy files
For Java implementations from IBM, the policy files are usually bundled with the JDK but not the JRE, so it may be more convenient to install the JDK rather than just the JRE. Once the JDK is installed its demo/jce/policy-files/unrestricted directory should contain two JAR files:
- local_policy.jar
- US_export_policy.jar
Use these files to replace the corresponding JAR files in the jre/lib/security directory of the JDK. Alternatively, the "Unrestricted SDK JCE policy files" can be downloaded from ibm.com.
For Java implementations from Sun, Oracle and Apple and for OpenJDK implementations, the policy files must be downloaded from Oracle. Each major Java version requires its own policy files:
- Java 6: http://www.oracle.com/technetwork/java/javase/downloads/jce-6-download-429243.html
- Java 7: http://www.oracle.com/technetwork/java/javase/downloads/jce-7-download-432124.html
- Java 8: http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html
Each of these downloads is a zip file that includes a README.txt and two JAR files, local_policy.jar and US_export_policy.jar. Use these JAR files to replace the corresponding files in the JRE or JDK:
- JRE: The lib/security directory usually holds these files.
- JDK: The jre/lib/security directory usually holds these files.
Installing certificate enrollment web services
The following procedures walk you through the installation and configuration of the required components. If Certificate Autoenrollment is already configured for Windows hosts in your environment, you can skip to Using Certificate Autoenrollment.
To perform these procedures, you need Enterprise Administrator rights to install software and configure Group Policy and Certificate Template policy.
|
|
Note: Microsoft has documented all of the steps to install and configure certificate enrollment Web services. |
To set up certificate enrollment web services
- Review the requirements as specified by Microsoft at: http://technet.microsoft.com/en-us/library/dd759243.aspx.
- Follow the instructions at: http://technet.microsoft.com/en-us/library/dd759241.aspx to install the Certificate Enrollment Web Service.
- Follow the instructions at: http://technet.microsoft.com/en-us/library/dd759214.aspx to install the Certificate Enrollment Policy Web Service.
- Follow the instructions at: http://technet.microsoft.com/en-us/library/dd759140.aspx to configure server certificates for HTTPS.
Certificate enrollment Web services are now installed. Next, you will configure policy settings to enable Certificate Autoenrollment.