Entrust PKI as a Service
Role permissions
See below for the list of user roles and the permissions granted by each one.
Owners
CA Administrators
Certificate Administrators
CA Auditors
Protocol Operators
Protocol Auditors
Prev - Managing roles
Next - Owners
Home
About this guide
+
Revision information
Other documents
Documentation feedback
Acronyms
Introduction
+
Capabilities
+
Certificate authority instantiation
Certificate issuance
Certificate management
Certificate status checking
Operation
Governance
+
Entrust responsibilities
Customer responsibilities
Quotas
Compliance
Definitions
Checking your subscriptions
Assigning subscriptions to partitions
Accessing your partitions
Managing users
-
Inviting users
Managing roles
Role permissions
+
Owners
CA Administrators
Certificate Administrators
CA Auditors
Protocol Operators
Protocol Auditors
Managing certificate profiles
+
Browsing certificate profiles
+
Authority certificate profiles
+
basic
external
intermediate
issuing
Subscriber certificate profiles
+
cmp
codesigning
esim
est
intune
mdmws
mobile
multiuse
privatessl
scep
smartcard
smime
v2g
wstep
Certificate profile fields
Customizing subscriber profiles
Managing certificate authorities
+
Browsing CAs
Creating a root CA
Importing an external root CA
Creating an intermediate subordinate CA
Creating an issuing subordinate CA
Certifying a CA with an external root CA
Selecting CA profiles
Downloading a CA certificate
Deleting a CA
Managing certificates
+
Browsing certificates
Issuing a certificate from CSR
Issuing a certificate in a PKCS #12
Changing the certificate status
Downloading certificates
Automating ACME enrollment
+
ACME requirements
Configuring ACME in PKIaaS
ACME enrollment with Certbot
+
Installing Certbot
Setting REQUESTS_CA_BUNDLE
Running Certbot
Automating MDM Intune enrollment
+
Intune requirements
Creating an Intune application in Azure
Configuring Intune in PKIaaS
Downloading the Intune certification chain
Configuring Intune profiles in Azure
+
Creating Intune profiles for Windows in Azure
Creating Intune profiles for Android in Azure
Creating Intune profiles for macOS in Azure
Creating Intune profiles for iOS and iPadOS in Azure
Enrolling user devices with the Intune Company Portal
+
Enrolling Windows devices with the Intune Company Portal
Enrolling Android devices with the Intune Company Portal
Enrolling iOS devices with the Intune Company Portal
Enrolling macOS devices with the Intune Company Portal
Renewing enrolled certificates
Revoking and removing certificates
Automating MDM Jamf enrollment
+
Jamf requirements
Configuring Jamf in PKIaaS
Jamf RDN Format
Configuring MDM automation in Jamf
+
Options
+
General
Certificate
SCEP
+
URL
Name
Redistribute Profile
Subject
Subject Alternative Name Type
Retries
Retry delay
Challenge type
Entrust Web Service URL
Administrator Username
Administrator Password
Verify Password
Digital ID Configuration Name
Group Name
RDN Variables
Key Size
Use as digital signature
Use for key encipherment
Fingerprint
Scope
Automating MDM Workspace ONE enrollment
+
Workspace ONE requirements
Configuring Workspace ONE in PKIaaS
Configuring MDM automation in Workspace ONE
+
Supported protocols for MDM automation in VMware Workspace ONE
Adding a CA and a Request Template for MDM automation in VMware Workspace ONE
+
Certificate Authorities
Requests Templates
Adding a profile for trusted certificates in VMware Workspace ONE
Adding a PKI profile for MDM automation in VMware Workspace ONE
Adding an SCEP profile for MDM automation in VMware Workspace ONE
Testing MDM automation in VMware Workspace ONE
Automating MDM Ivanti enrollment
+
Ivanti requirements
Configuring Ivanti in PKIaaS
Configuring MDM automation in Ivanti Neurons MDM
+
Supported protocols for MDM automation with Ivanti Neurons
Adding a PKIaaS issuing CA to Ivanti Neurons MDM
Adding the PKIaaS issuing and root CA certificates in Ivanti Neurons MDM
Adding an identity certificate in Ivanti Neurons MDM
Automating MDM IBM MaaS360 enrollment
+
MDM IBM MaaS360 requirements
Configuring MDM IBM MaaS360 in PKIaaS
Configuring MDM automation in IBM Cloud
+
Requirements for MDM automation in IBM Cloud
Configuring MDM automation with Cloud Extender
Automating WSTEP enrollment
+
WSTEP integration requirements
+
Enrollment protocol requirements
TLS Cipher requirements
Agent requirements
+
Agent network requirements
Agent Azure requirements
Agent VMware requirements
Windows requirements
+
Windows user requirements
Windows network requirements
Active Directory requirements
Planning your WSTEP deployment
Preparing the Active Directory forest for WSTEP
+
Creating a WSTEP service account
Installing the default set of certificate templates
Downloading the certificate chain
Setting up LDAPS on domain controllers
+
Establishing trust of the LDAPS TLS chain
Generating the LDAPS TLS certificates
Installing the LDAPS TLS certificates
Validating the LDAPS configuration
Downloading an agent
Installing an agent
+
Installing on Amazon Web Services
+
Creating an S3 bucket
Configuring an IAM policy
Creating an IAM role
Uploading the OVA file
Creating an AMI import configuration file
Preparing the command-line interface
Importing the AMI
Creating an EC2 instance
Opening a session on AWS
Installing on Azure
+
Creating an Azure storage account
Uploading the VHD image
Creating an Azure image
Creating Azure network rules
Creating the agent on Azure
Opening a session on Azure
Installing on VMware vSphere
Configuring WSTEP automation in PKIaaS
+
Configuring an issuing CA for WSTEP
Registering an agent
Creating an agent configuration
Linking an agent to a configuration
Adding Active Directory nodes
Getting the enrollment URL
Enabling WSTEP for Active Directory nodes
Enabling WSTEP for users and devices
+
Creating a Group Policy Object
Importing the WSTEP certificate chain
Enabling WSTEP for users
Enabling autoenrollment for users
Enabling WSTEP for devices
Enabling autoenrollment for devices
Linking the WSTEP Group Policy Object
Managing certificate templates
+
Creating and configuring certificate templates
+
Compatibility
Cryptography
Extensions
General
Issuance requirements
Key Attestation
Request Handling
Security
Server
Superseded Templates
Selecting CAs for certificate templates
Disabling certificate templates
Managing on-premise Agents
+
Keyboard shortcuts
Browsing logs
Adding an agent for disaster recovery
Troubleshooting WSTEP enrollment issues
+
Troubleshooting agent onboarding issues
Troubleshooting agent configuration issues
+
DNS Server unreachable
Invalid LDAP credentials
LDAP timeout
TLS handshake failed
Unknown LDAP host
Troubleshooting Group Policy Object configuration issues
+
Access denied by remote endpoint
Remote endpoint not reachable
Troubleshooting enrollment and certificate template issues
+
Certificate template not enrolling or autoenrolling
Missing certificate template
Unexpected behavior of certificate enrollment
Managing end-entities
Auditing enrollment events
Migrating an on-prem gateway to PKIaaS
+
Migrating an Intune on-prem gateway to PKIaaS
Migrating an MDM Jamf on-prem gateway to PKIaaS
Migrating a WSTEP on-prem gateway to PKIaaS
Integrating third-party tools with the CA Gateway API
+
Managing CA Gateway credentials
+
Creating CA Gateway credentials
Renewing CA Gateway credentials
Accessing the CA Gateway API
Integrating with Ansible
Integrating with HashiCorp Vault
Integrating with Venafi
Revoking certificates in bulk
Obtaining support