Entrust CA Gateway

Prerequisites

  • The base URL of the Entrust CA Gateway, without the /v1 API version. Example: https://cagateway.example.com/cagw

  • The identifier of the CA on the Entrust CA Gateway.

  • The identifier of the CA Gateway profile used to enroll certificates.

  • A client certificate and its private key, authorized on the Entrust CA Gateway. The connector authenticates using mutual TLS.

Limitations

  • The subject DN is sent as subject variables, driven by the subject variable requirements of the CA Gateway profile. DN elements that the profile does not require are not sent to Entrust CA Gateway.

  • Only the following SAN types are sent to Entrust CA Gateway: DNS names, IP addresses, emails (RFC822), URIs and registered IDs.

  • CA specific operations (reissue, renew) are not supported.

Create the PKI connector

1. Log in to Horizon Administration Interface.

2. Access PKI from the drawer or card: PKI  PKI Connectors.

3. Click on Add icon.

4. Select the correct PKI type.

5. Click on the next button

General tab

6. Fill in the common mandatory fields:

  • Connector Name* (string input):
    Choose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.

  • Proxy (string select):
    If the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.

  • PKI Queue (string select):
    The PKI Queue used to manage the PKI Requests (enrollment, revocation).

  • Timeout (finite duration):
    Represents a predefined interval of time without a PKI response, when the time has passed "Horizon" will cease trying to establish the communication. Must be a valid finite duration.

7. Click on the next button

Details tab

8. Fill in all mandatory fields:

  • Endpoint* (string input):
    Base URL of the Entrust CA Gateway, without the /v1 API version. Example: https://cagateway.example.com/cagw

  • CA ID* (string input):
    Identifier of the CA on the Entrust CA Gateway.

  • Profile ID* (string input):
    Identifier of the CA Gateway profile used to enroll certificates.

  • Validity period (string input):
    Overrides the validity of the certificates issued through this connector, as an ISO 8601 interval or duration accepted by the Entrust CA Gateway. When not set, the validity defined by the CA Gateway profile is used. The profile must allow the validity to be overridden. Accepted forms:

    • a duration only, starting when the certificate is issued: P1Y3M10DT0H0M

    • a start date and an expiry date: 2018-07-06T13:00Z/2019-07-06T13:00:00Z

    • a start date and a duration: 2018-07-06T13:00Z/P1Y3M0DT0H0M

    • a duration and an expiry date, the start date being computed from them: P0Y3M0DT0H0M/2018-12-31T00:00Z

9. Click on the next button.

Custom tab

10. Click on Add HTTP Proxy if custom data mapping is needed. Each mapped label is sent as a property of the enrollment request.

11. Fill in the PKI-custom data mapping:

  • Custom data field* (string input):
    Name of the property sent to Entrust CA Gateway.

  • Label field* (select):
    Any existing Horizon Label

12. Click on the next button.

Authentication tab

13. Fill in the PKI-authentication fields:

  • Authentication credentials* (select):
    Select Certificate credentials containing the authentication certificate used to connect to the Entrust CA Gateway.

14. Click on the save button.

You can edit Edit PKI, duplicate Duplicate PKI or delete Delete PKI the Entrust CA Gateway connector.