Entrust PKI as a Service
Download PDF
Role permissions
The sections below list all user roles and the permissions granted by each one.
Owners
CA Administrators
Certificate Administrators
CA Auditors
Enrollment Workflow Administrators
Enrollment Workflow Auditors
Prev - Managing roles
Next - Owners
Home
About this guide
+
Revision information
Other documents
Documentation feedback
Acronyms
Introduction
+
Capabilities
+
Certificate authority instantiation
Certificate issuance
Certificate management
Certificate status checking
Operation
Governance
+
Entrust responsibilities
Customer responsibilities
Quotas
Compliance
Definitions
Certification Practice Statement
Whitelisting IP addresses
Adding an external IdP
Checking your subscriptions
Creating instances
Accessing your instances
Managing users
-
Inviting users
Managing roles
Role permissions
+
Owners
CA Administrators
Certificate Administrators
CA Auditors
Enrollment Workflow Administrators
Enrollment Workflow Auditors
Managing certificate profiles
+
Browsing certificate profiles
+
Authority certificate profiles
+
rootcert
+
root-ca
intermediate
+
intermediate-ca-subord
issuing
+
basic-ca-subord
external
+
azure-firewall-ca-subord
tlsproxy-ca-subord
ocsp
+
ocsp-digital-signature
Subscriber certificate profiles
+
cmp
+
cmp-digital-signature
cmp-digital-signature-key-encipherment
cmp-key-encipherment
cmp-non-repudiation
codesigning
+
codesigning-digital-signature
esim
+
esim-delivery-auth
esim-delivery-binding
esim-delivery-tls-server
esim-discovery-auth
esim-discovery-tls-server
est
+
est-digital-signature
est-digital-signature-key-encipherment
est-key-encipherment
est-non-repudiation
intune
+
intune-digital-signature
intune-digital-signature-key-encipherment
intune-digital-signature-key-encipherment-clientauth
intune-emailprotection-clientauth
intune-key-encipherment
intune-non-repudiation
mdmws
+
mdmws-digital-signature
mdmws-digital-signature-key-encipherment
mdmws-digital-signature-key-encipherment-clientauth
mdmws-key-encipherment
mdmws-non-repudiation
mdmws-p12-digital-signature
mdmws-p12-digital-signature-key-encipherment
mdmws-p12-digital-signature-key-encipherment-clientauth
mdmws-p12-key-encipherment
mdmws-p12-non-repudiation
mobile
+
mobile-device-p12-digital-signature-client-authentication
multiuse
+
multiuse-p12-client
multiuse-p12-client-server
multiuse-p12-custom
multiuse-p12-key-data-encipherment-non-repudiation-client
multiuse-p12-key-data-encipherment-non-repudiation-client-server
multiuse-p12-key-encipherment-client
multiuse-p12-key-encipherment-client-server
multiuse-p12-key-encipherment-custom
multiuse-p12-key-encipherment-non-repudiation-client
multiuse-p12-key-encipherment-non-repudiation-client-server
multiuse-p12-key-encipherment-non-repudiation-custom
multiuse-p12-key-encipherment-non-repudiation-server
multiuse-p12-key-encipherment-server
multiuse-p12-non-repudiation-client
multiuse-p12-non-repudiation-client-server
multiuse-p12-non-repudiation-custom
multiuse-p12-non-repudiation-server
multiuse-p12-server
privatessl
+
privatessl-tls-client
privatessl-tls-client-server
privatessl-tls-client-server-data-encipherment
privatessl-tls-client-server-supply-san
privatessl-tls-server
privatessl-tls-server-supply-san
scep
+
scep-digital-signature
scep-digital-signature-key-encipherment
scep-key-encipherment
scep-non-repudiation
smartcard
+
smartcard-card-authentication
smartcard-digital-signature
smartcard-domain-controller
smartcard-key-management
smartcard-piv-authentication
smartcard-piv-content-signing
smime
+
smime-digital-signature-key-encipherment
smime-key-encipherment
smime-non-repudiation
v2g
+
v2g-supply-equipment
v2g-user-identity
wstep
+
wstep-digital-signature
wstep-digital-signature-key-encipherment
wstep-key-encipherment
wstep-non-repudiation
wstep-non-repudiation-key-encipherment
Certificate profile fields
Customizing certificate profiles
Managing SAN lists
+
Adding an allowed SANs list
Modifying an allowed SANs list
Deleting an allowed SANs list
Managing custom fields
+
Adding a custom field
Modifying a custom field
Deleting a custom field
Managing certificate authorities
+
Browsing CAs
Creating a root authority
Importing an external root authority
Creating an intermediate subordinate authority
Creating an issuing subordinate authority
Creating a third-party Sectigo authority
Certifying a CA with an external root CA
Updating the profile list
Selecting allowed SAN lists
Downloading a CA certificate
Deleting a CA
Managing certificates
+
Browsing certificates
Issuing certificates from a CSR
Issuing certificates in PKCS #12
Issuing certificates with Sectigo
Changing the certificate status
Downloading certificates
Automating ACME enrollment
+
ACME requirements
Configuring ACME in PKIaaS
+
Creating an ACME enrollment workflow
Creating EAB keys
ACME enrollment with Certbot
+
Installing Certbot
Setting REQUESTS_CA_BUNDLE
Running Certbot
Auditing ACME enrollment
Automating Microsoft Intune MDM enrollment
+
Intune requirements
Creating an Intune application in Azure
Configuring Intune in PKIaaS
Downloading the Intune certification chain
Configuring Intune profiles in Azure
+
Creating Intune profiles for Windows in Azure
Creating Intune profiles for Android in Azure
Creating Intune profiles for macOS in Azure
Creating Intune profiles for iOS and iPadOS in Azure
Enrolling user devices with the Intune Company Portal
+
Enrolling Windows devices with the Intune Company Portal
Enrolling Android devices with the Intune Company Portal
Enrolling iOS devices with the Intune Company Portal
Enrolling macOS devices with the Intune Company Portal
Auditing MDM Intune enrollment
Renewing enrolled certificates
Revoking and removing certificates
Automating MDM Jamf enrollment
+
Jamf requirements
Configuring Jamf in PKIaaS
+
Creating a Jamf enrollment workflow
Creating digital identifiers
+
Digital ID
Parent DN
RDN Format
CA Identifier
CA Identifier
Creating credentials
Configuring MDM automation in Jamf
+
Options
+
General
Certificate
SCEP
+
URL
Name
Redistribute Profile
Subject
Subject Alternative Name Type
Retries
Retry delay
Challenge type
Entrust Web Service URL
Administrator Username
Administrator Password
Verify Password
Digital ID Configuration Name
Group Name
RDN Variables
Key Size
Use as digital signature
Use for key encipherment
Fingerprint
Scope
Auditing MDM Jamf enrollment
Automating MDM Workspace ONE enrollment
+
Workspace ONE requirements
Configuring Workspace ONE in PKIaaS
+
Creating a Workspace ONE workflow
Creating digital identifiers
+
Digital ID
Parent DN
RDN Format
CA Identifier
CA Identifier
Creating credentials
Configuring MDM automation in Workspace ONE
+
Supported protocols for MDM automation in VMware Workspace ONE
Adding a CA and a Request Template for MDM automation in VMware Workspace ONE
+
Certificate Authorities
Requests Templates
Adding a profile for trusted certificates in VMware Workspace ONE
Adding a PKI profile for MDM automation in VMware Workspace ONE
Adding an SCEP profile for MDM automation in VMware Workspace ONE
Testing MDM automation in VMware Workspace ONE
Auditing Workspace ONE enrollment
Automating MDM Ivanti enrollment
+
Ivanti requirements
Configuring Ivanti in PKIaaS
+
Creating an Ivanti enrollment workflow
Creating digital identifiers
+
Digital ID
Parent DN
RDN Format
CA Identifier
Profile ID
Creating credentials
Configuring MDM automation in Ivanti Neurons MDM
+
Supported protocols for MDM automation with Ivanti Neurons
Adding a PKIaaS issuing CA to Ivanti Neurons MDM
Adding the PKIaaS issuing and root CA certificates in Ivanti Neurons MDM
Adding an identity certificate in Ivanti Neurons MDM
Auditing Ivanti enrollment
Automating MDM IBM MaaS360 enrollment
+
MDM IBM MaaS360 requirements
Configuring MDM IBM MaaS360 in PKIaaS
+
Creating an MDM IBM MaaS360 enrollment workflow
Creating digital identifiers
+
Digital ID
Parent DN
RDN Format
CA Identifier
Profile ID
Creating credentials
Configuring MDM automation in IBM Cloud
+
Requirements for MDM automation in IBM Cloud
Configuring MDM automation with Cloud Extender
Auditing MDM IBM MaaS360 enrollment
Automating WSTEP enrollment
+
WSTEP integration requirements
+
Enrollment protocol requirements
TLS cipher requirements
Agent requirements
+
Agent network requirements
Agent Azure requirements
Agent VMware requirements
Windows requirements
+
Windows user requirements
Windows network requirements
Active Directory requirements
Planning your WSTEP deployment
Preparing the Active Directory forest for WSTEP
+
Creating a WSTEP service account
Checking the Kerberos identity mapping
Installing the default set of certificate templates
Downloading the certificate chain
Setting up LDAPS on domain controllers
+
Establishing trust of the LDAPS TLS chain
Generating the LDAPS TLS certificates
Installing the LDAPS TLS certificates
Checking the LDAPS configuration
Downloading an agent
Installing an agent
+
Installing on Amazon Web Services
+
Creating an S3 bucket
Configuring an IAM policy
Creating an IAM role
Uploading the OVA file
Creating an AMI import configuration file
Preparing the command-line interface
Importing the AMI
Creating an EC2 instance
Opening a session on AWS
Installing on Azure
+
Creating an Azure storage account
Uploading the VHD image
Creating an Azure image
Creating Azure network rules
Creating the agent on Azure
Opening a session on Azure
Installing on VMware vSphere
Configuring WSTEP automation in PKIaaS
+
Configuring an issuing CA for WSTEP
Registering an agent
Creating an agent configuration
Linking an agent to a configuration
Adding Active Directory nodes
Getting the enrollment URL
Enabling WSTEP for Active Directory nodes
Enabling WSTEP for users and devices
+
Creating a Group Policy Object
Importing the WSTEP certificate chain
Enabling WSTEP for users
Enabling autoenrollment for users
Enabling WSTEP for devices
Enabling autoenrollment for devices
Linking the WSTEP Group Policy Object
Managing certificate templates
+
Creating and configuring certificate templates
+
Compatibility
Cryptography
Extensions
General
Issuance requirements
Key Attestation
Request Handling
Security
Server
Superseded Templates
Selecting CAs for certificate templates
Disabling certificate templates
Managing on-premises agents
+
Keyboard shortcuts
Browsing logs
Adding an agent for disaster recovery
Troubleshooting WSTEP enrollment issues
+
Troubleshooting agent onboarding issues
Troubleshooting agent configuration issues
+
DNS server unreachable
Invalid LDAP credentials
LDAP timeout
TLS handshake failed
Unknown LDAP host
Troubleshooting Group Policy Object configuration issues
+
Access denied by remote endpoint
Remote endpoint not reachable
Troubleshooting enrollment and certificate template issues
+
Certificate template not enrolling or autoenrolling
Missing certificate template
Unexpected behavior of certificate enrollment
Manually issuing certificates with eForm
+
eForm requirements
Creating an eForm enrollment workflow
Requesting eForm entities
Approving and managing eForm entities
Downloading eForm entity certificates
Auditing eForm enrollment
Managing end entities
Integrating the MCP server
Integrating CA Gateway API
+
Managing CA Gateway credentials
+
Creating CA Gateway credentials
Renewing CA Gateway credentials
Testing the CA Gateway API with Swagger
Enabling KDC authentication on request
Using third-party API clients
Integrating Compliance Manager
Migrating legacy enrollment protocols
Migrating on-premises enrollment workflows
+
Migrating an Intune on-premises enrollment workflow
Migrating an MDM Jamf on-premises enrollment workflow
Migrating a WSTEP on-premises enrollment workflow
Revoking certificates in bulk
Monitoring and auditing
+
Auditing enrollment events
Understanding alert dates
Reviewing alerts
Checking the operation status
Managing reports
+
Designing reports
Manually generating reports
Downloading reports
Disabling and re-enabling reports
Querying data
+
Running free-text queries
Running logical filters
Obtaining support