Creating Issuance Protection Certificate

Overview

This page describes the process to create an issuance protection certificate for CMC Shared Token authentication in CA.

Generating Issuance Protection Certificate Request

First, generate a certificate request in the CA’s NSS database:

$ pki \
    -d /etc/pki/pki-tomcat/alias \
    -f /etc/pki/pki-tomcat/password.conf \
    nss-cert-request \
    --subject "CN=CA Issuance Protection" \
    --csr ca_issuance_protection.csr

Then generate a CMC request with the above certificate request:

$ CMCRequest \
    /usr/share/pki/server/examples/cmc/ca_issuance_protection-cmc-request.cfg

Issuing Issuance Protection Certificate

Submit the CMC request to the server:

$ HttpClient \
    /usr/share/pki/server/examples/cmc/ca_issuance_protection-cmc-submit.cfg

Processed the response with the following command:

$ CMCResponse \
    -d /etc/pki/pki-tomcat/alias \
    -i ca_issuance_protection.cmc-response \
    -o ca_issuance_protection.p7b

The issuance protection certificate chain will be stored in ca_issuance_protection.p7b.

Importing Issuance Protection Certificate

To import the certificate into the CA’s NSS database:

$ pki \
    -d /etc/pki/pki-tomcat/alias \
    -f /etc/pki/pki-tomcat/password.conf \
    pkcs7-import \
    --pkcs7 ca_issuance_protection.p7b \
    ca_issuance_protection

Configuring Issuance Protection

To configure the certificate nickname:

$ pki-server ca-config-set ca.cert.issuance_protection.nickname ca_issuance_protection

Restarting CA Subsystem

$ pki-server ca-undeploy --wait
$ pki-server ca-deploy --wait

See Also

• PKI 10.5 CMC Shared Token