Nexus Certificate Manager PKI

Prerequisites

  • A certificate procedure and a token procedure should be created.

  • An authentication certificate should be issued for Horizon, and it should be given certificate issuance and revocation permissions on the aforementioned token procedure.

  • Nexus Endpoint CA

Limitations

  • Only the following fields are managed: commonName, UID, OU, O, C and subjectAltNames DNS, IPaddress, RFC822Name and msUPN.

  • For multi-valued fields (SAN DNS, RFC822Name and IP address), if more data items are provided than configured in Nexus CM Procedure, the exceeding items will be ignored.

  • All limitations induced by the use of the Nexus CM SDK.

Create the PKI connector

1. Log in to Horizon Administration Interface.

2. Access PKI from the drawer or card: PKI  PKI Connectors.

3. Click on Add icon.

4. Select the correct PKI type.

5. Click on the next button

General tab

6. Fill in the common mandatory fields:

  • Connector Name* (string input):
    Choose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.

  • Proxy (string select):
    If the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.

  • PKI Queue (string select):
    The PKI Queue used to manage the PKI Requests (enrollment, revocation).

  • Timeout (finite duration):
    Represents a predefined interval of time without a PKI response, when the time has passed "Horizon" will cease trying to establish the communication. Must be a valid finite duration.

7. Click on the next button

Details tab

8. Fill all mandatory fields:

  • Nexus CM DNS name* (string input):
    URL to access the Nexus Certificate Manager. Two modes are available:

    • Direct connection, you can specify the IP:PORT

    • Using PGWY, you will need to specify the PGWY url as following https://<pgwy_url>/sdkproxy

  • Nexus endpoint CA* (select):
    Select the endpoint CA.

  • Nexus CM Certificate procedure name* (string input):
    The token procedure name to use.
    Should point to the appropriate certificate procedure, and must be on PKCS#10 format.

9. Click on the next button.

Authentication tab

10. Fill in the PKI-authentication fields:

  • Authentication Credentials* (select):
    Select Certificate credentials containing the authentication certificate used to connect to the PKI.

11. Click on the save button.

You can edit Edit PKI, duplicate Duplicate PKI or delete Delete PKI the Nexus Certificate Manager PKI connector.