Creating Issuance Protection Certificate

Overview

This page describes the process to create an issuance protection certificate for CMC Shared Token authentication in CA.

Generating Issuance Protection Certificate Request

First, generate a certificate request in the CA’s NSS database:

$ pki \
    -d /etc/pki/pki-tomcat/alias \
    -f /etc/pki/pki-tomcat/password.conf \
    nss-cert-request \
    --subject "CN=Issuance Protection" \
    --csr issuance_protection.csr

Then generate a CMC request with the above certificate request:

$ CMCRequest \
    /usr/share/pki/server/examples/cmc/issuance_protection-cmc-request.cfg

Issuing Issuance Protection Certificate

Submit the CMC request to the server:

$ HttpClient \
    /usr/share/pki/server/examples/cmc/issuance_protection-cmc-submit.cfg

Processed the response with the following command:

$ CMCResponse \
    -d /etc/pki/pki-tomcat/alias \
    -i issuance_protection.cmc-response \
    -o issuance_protection.p7b

The issuance protection certificate chain will be stored in issuance_protection.p7b.

Importing Issuance Protection Certificate

To import the certificate into the CA’s NSS database:

$ pki \
    -d /etc/pki/pki-tomcat/alias \
    -f /etc/pki/pki-tomcat/password.conf \
    pkcs7-import \
    --pkcs7 issuance_protection.p7b \
    issuance_protection

Configuring Issuance Protection

To register the certificate as a system certificate:

$ pki-server ca-config-set ca.cert.issuance_protection.nickname issuance_protection

Restarting PKI Server

$ pki-server restart --wait