Certificate Autoenrollment on UNIX and Linux
Certificate Autoenrollment Requirements and Setup
Java requirement: Unlimited Strength Jurisdiction Policy Files
Installing Certificate Enrollment Web Services
Configuring Certificate Services Client - Certificate Enrollment Policy
Configuring Certificate Services Client - Auto-Enrollment
Configuring Certificate Templates for Auto-enrollment
Using Certificate Autoenrollment
Configuring Certificate Autoenrollment manually
Trigger machine-based Certificate Autoenrollment
Certificate Autoenrollment is a feature of Authentication Services based on Microsoft Open Specifications. Certificate Autoenrollment allows Mac OS X/macOS®
With Certificate Autoenrollment, a public/private key pair is automatically generated according to certificate template parameters defined in Group Policy. The public key is sent to the Certification Authority (CA), and the CA responds with a new certificate corresponding to the public key, which is installed along with the private key into the appropriate system or user keychain on the Mac
You can use Group Policy to automatically configure which certificate enrollment policy servers to use for Certificate Autoenrollment and to periodically run Certificate Autoenrollment.
By following the instructions presented in this section, a system administrator will be able to configure new or existing systems to download certificate enrollment policy from a certificate enrollment policy server. Additionally, the systems will automatically enroll and renew certificates based on the certificate enrollment policy.
Certificate Autoenrollment is an optional package distributed with One Identity Authentication Services. For instructions on installing this package, see the One Identity Authentication Services Installation Guide.
Most of the Certificate Autoenrollment code is implemented in Java. After this code has successfully requested a certificate from a CA, it invokes platform-specific code to store the private key and certificate in a suitable way for the operating system or for particular applications. This platform-specific code is implemented as a shell script, certstore.sh, in the /var/opt/quest/vascert/script directory.
The certstore.sh script is a platform-agnostic front end that chooses and loads a platform-specific back end script:
The mock implementations also make some platform-specific assumptions (for example, they invoke the mv command with the --backup option), but these are not critical and can be removed.
As a consequence, on UNIX/Linux some important Certificate Autoenrollment commands, such as "vascert pulse" for the superuser will NOT work until the necessary platform-specific functionality has been implemented in certstore-DEV.sh or a similar script.
Prior to installing One Identity Certificate Autoenrollment, ensure your system meets the following minimum hardware and software requirements.
Component | Requirements | ||
---|---|---|---|
Operating system |
Mac OS X®/macOS® 10.12 (or later) Red Hat® Enterprise Linux® 6 (or later) Solaris® 11 (or later) SUSE® Linux Enterprise Server 11 (or later) Ubuntu® 14.04 LTS (or later) | ||
Java unlimited strength policy files | For more information, see Java requirement: Unlimited Strength Jurisdiction Policy Files. | ||
Authentication Services |
One Identity Authentication Services version 4.1.2 (or later). | ||
Additional software |
Certificate Autoenrollment depends on services provided by a Microsoft Enterprise Certificate Authority (CA) in your environment. In addition to Active Directory and an Enterprise CA, you must install the following software in your environment:
In order for Certificate Autoenrollment to function on client computers, you must configure the following policies:
Additionally, you must configure Java 1.6 (or later) as the default JVM for your system.
| ||
Rights |
Enterprise Administrator rights to install software and configure Group Policy and Certificate Template policy (only if Certificate Autoenrollment is not already configured for Windows hosts in your environment.) |
By default, most JRE and JDK implementations enforce limits on cryptographic key strengths that satisfy US export regulations. These limits are often insufficient for Certificate Autoenrollment and may lead to "java.security.InvalidKeyException: Illegal key size" failures. The "Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files" can be installed to remove these limits and enable Certificate Autoenrollment to function properly.
In general the answer is: Yes, these files are needed.
Java 9 and above do not require these files, but Java 6, 7, and 8 rely on these files.
For Java implementations from IBM, the policy files are usually bundled with the JDK but not the JRE, so it may be more convenient to install the JDK rather than just the JRE. Once the JDK is installed its demo/jce/policy-files/unrestricted directory should contain two JAR files:
Use these files to replace the corresponding JAR files in the jre/lib/security directory of the JDK. Alternatively, the "Unrestricted SDK JCE policy files" can be downloaded from ibm.com.
For Java implementations from Sun, Oracle and Apple and for OpenJDK implementations, the policy files must be downloaded from Oracle. Each major Java version requires its own policy files:
Each of these downloads is a zip file that includes a README.txt and two JAR files, local_policy.jar and US_export_policy.jar. Use these JAR files to replace the corresponding files in the JRE or JDK:
© 2021 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy