Version: Axidian CertiFlow 7.3

Dogtag CA

Configure Dogtag CA integration with Axidian CertiFlow:

Create a service account.
Issue a CA Agent certificate and install it in the Personal Certificate Store on the Axidian CertiFlow server.
Install the Dogtag CA root certificate in the Trusted Root Certification Authorities Store on the Axidian CertiFlow server.
Create user certificate templates.
Configure the connection to Dogtag CA in the Axidian CertiFlow Management Console.

Create a service account

Create a service account (a PKI User for CA Agent) to submit certificate requests to Dogtag CA on behalf of Axidian CertiFlow users. You can use either the CA command-line tool or the REST API:

CA
REST API

Create a user on behalf of the Dogtag CA administrator.

pki -u <administrator name> -w <administrator password> ca-user-add <user name> --fullName "<user display name>"

Add the user to the Certificate Manager Agents group so that the user can manage certificate requests.

pki -u <administrator name> -w <administrator password> ca-group-member-add "Certificate Manager Agents" <user name>

Log in to Dogtag CA. Authenticate using the administrator certificate located on the Dogtag CA server at /root/ca-agent.p12.
```
GET /ca/v2/account/login
```

Create a user.

POST /ca/v2/admin/users

{
    "id": "<user name>",
    "UserID": "<user name>",
    "FullName": "<user display name>"
}

Add the user to the Certificate Manager Agents group so that the user can manage certificate requests.

POST /ca/v2/admin/groups/Certificate Manager Agents/members

{
    "id": "<user name>",
    "groupID": "Certificate Manager Agents"
}

Issue the CA Agent certificate

Issue the CA Agent certificate for the service account. You can use either the CA command-line tool or the REST API:

CA
REST API

Initialize the PKI client certificate store on the Dogtag CA server.
```
pki client-init
```
Generate a key pair and submit a certificate request. This creates a request with the pending status. Save the requestID value from the command output.
```
pki client-cert-request uid=<user name>
```
Approve the certificate request on behalf of the Dogtag CA administrator. Save the certID value from the command output.
```
pki -u <administrator name> -w <administrator password> ca-cert-request-approve <requestID>
```

Assign the issued certificate to the service account.

pki -u <administrator name> -w <administrator password> ca-user-cert-add <user name> --serial <certID>

Import the certificate to the local certificate store.

pki client-cert-import <user name> --serial <certID>

Export the certificate along with the private key in PKCS#12 format.

pki -u <administrator name> -w <administrator password> pkcs12-export --pkcs12-file <P12 file path> --pkcs12-password <P12 file password> "<user name>"

Copy the P12 file to the Axidian CertiFlow server.

Certificate requirements:

The Subject field of the certificate must contain the uid attribute with the service account name.
The Enhanced Key Usage field of the certificate must contain the Client Authentication value (1.3.6.1.5.5.7.3.2).

Create an openssl.conf configuration file with settings for generating a certificate signing request (CSR).

nano openssl.conf

Configuration file example

[req]
default_bits = 2048
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn
[dn]
CN = <user name>
[req_ext]
subjectAltName = @alt_names
[alt_names]
email.1 = <user email>
otherName.1 = 1.3.6.1.4.1.311.20.2.3;UTF8:<user UPN>

Generate a private key and a CSR using the OpenSSL command-line tool.

openssl req -new -nodes -out csr.pem -newkey rsa:2048 -keyout key.pem -config openssl.conf

Log in to Dogtag CA. Authenticate using the administrator certificate located on the Dogtag CA server at /root/ca-agent.p12.
```
GET /ca/v2/account/login
```

Submit a certificate request:

In the cert_request field, provide the CSR content from step 2.
In the sn_uid field, specify the service account name.

POST /ca/v2/certrequests

Request parameters example

{
    "ProfileID": "caUserCert",
    "Renewal": false,
    "Input": [
        {
            "id": "i1",
            "ClassID": "keyGenInputImpl",
            "Name": "Key Generation",
            "Attribute": [
                {
                    "name": "cert_request_type",
                    "Value": "pkcs10"
                },
                {
                    "name": "cert_request",
                    "Value": "<CSR content>"
                }
            ]
        },
        {
            "id": "i2",
            "ClassID": "subjectNameInputImpl",
            "Name": "Subject Name",
            "Attribute": [
                { "name": "sn_uid", "Value": "<user name>" },
                { "name": "sn_cn", "Value": "" },
                { "name": "sn_o", "Value": "" },
                { "name": "sn_c", "Value": "" }
            ]
        },
        {
            "id": "i3",
            "ClassID": "submitterInfoInputImpl",
            "Name": "Requestor Information",
            "Attribute": [
                { "name": "requestor_name", "Value": "<requestor name>" },
                { "name": "requestor_email", "Value": "" }
            ]
        }
    ],
    "Output": [],
    "Attributes": {
        "Attribute": []
    }
}

Save the requestID value from the response output.

Retrieve the request details. This information is required to approve the request in the next step.
```
GET /ca/v2/agent/certrequests/<requestID>
```
Approve the certificate request. In the request body, pass the full response from the previous step.
```
POST /ca/v2/agent/certrequests/<requestID>/approve
```
Retrieve the issued certificate ID. In the response output, the certID field contains the certificate identifier.
```
GET /ca/v2/certrequests/<requestID>
```
Retrieve the certificate in Base64 format. In the response output, the Encoded field contains the certificate.
```
GET /ca/v2/agent/certs/<certID>
```

Assign the certificate to the service account. In the Encoded parameter, pass the certificate string from the previous step.

POST /ca/v2/admin/users/<user name>/certs

{
    "Encoded": "-----BEGIN CERTIFICATE-----\n<Base64-encoded certificate content>\r\n-----END CERTIFICATE-----\n"
}

Save the certificate to the cert.pem file. Verify that the certificate contains valid data:
```
openssl x509 -in cert.pem -noout -text
```
Export the certificate and the private key into a PFX file. Copy the PFX file to the Axidian CertiFlow server.
```
openssl pkcs12 -export -out cert.pfx -inkey key.pem -in cert.pem
```

Install certificates on the Axidian CertiFlow server

Install the following certificates on the Axidian CertiFlow server:

The CA Agent certificate in the local computer Personal Certificate Store
The Dogtag CA root certificate in the Trusted Root Certification Authorities Store

To obtain the Dogtag CA root certificate:

On the Dogtag CA server, run the following command:

pki ca-cert-export -o <root certificate file path>

Copy the certificate file to the Axidian CertiFlow server.

Create user certificate templates

Prepare certificate templates for application policies that are used to issue certificates to Axidian CertiFlow end users.

Axidian CertiFlow supports Dogtag CA certificate templates (profiles) of a specific structure. Examples of supported templates: AdminCert, caUserCert, caOtherCert, caServerKeygen_UserCert. To prepare user certificate templates, edit the Dogtag CA templates.

Use the following instruction to configure the Smartсard Logon certificate template based on the caUserCert template.

CA
REST API

Disable the template that you want to edit.

pki -u <administrator name> -w <administrator password> ca-profile-disable caUserCert

Export the template parameters to a file for editing.

pki -u <administrator name> -w <administrator password> ca-profile-show caUserCert --raw --output <file path>

Edit the template parameters file as needed, for example, configure extensions and subject name attributes.
For more information about configuring templates, see the Dogtag CA documentation
info
The Smartcard Logon certificate must contain the UPN (User Principal Name) attribute in the Subject Alternative Name (SAN) extension. The caUserCert template does not include the UPN attribute by default. Make sure to add UPN to the SAN settings.

Upload the edited template parameters file to Dogtag CA.

pki -u <administrator name> -w <administrator password> ca-profile-mod <file path>

Enable the template.

pki -u <administrator name> -w <administrator password> ca-profile-enable caUserCert

Make sure the visible and enable parameters are set to true in the Dogtag CA template settings. Otherwise, the templates do not appear in the Axidian CertiFlow Management Console when you configure the CA in the PKI settings section.

Log in to Dogtag CA. Authenticate using the administrator certificate located on the Dogtag CA server at /root/ca-agent.p12.
```
GET /ca/v2/account/login
```
Disable the template that you want to edit.
```
POST /ca/v2/profiles/caUserCert/disable
```
Retrieve the template parameters in RAW format.
```
GET /ca/v2/profiles/caUserCert/raw
```
Edit the template parameters as needed, for example, configure extensions and subject name attributes.
For more information about configuring templates, see the Dogtag CA documentation
info
The Smartcard Logon certificate must contain the UPN (User Principal Name) attribute in the Subject Alternative Name (SAN) extension. The caUserCert template does not include the UPN attribute by default. Make sure to add UPN to the SAN settings.
Submit the updated parameters.
```
POST /ca/v2/profiles/caUserCert/raw
```
Enable the template.
```
POST /ca/v2/profiles/caUserCert/enable
```

Make sure the profileVisible and profileEnable parameters are set to true in the Dogtag CA template settings. Otherwise, the templates do not appear in the Axidian CertiFlow Management Console when you configure the CA in the PKI settings section.

Create a service account​

Issue the CA Agent certificate​

Install certificates on the Axidian CertiFlow server​

Create user certificate templates​

Create a service account

Issue the CA Agent certificate

Install certificates on the Axidian CertiFlow server

Create user certificate templates