Skip to main content

Issue Intermediate CA certificates

You may have a scenario where you need to issue Intermediate CAs (ICAs) to devices, such as IoT gateways. These ICAs issue end-entity certificates to other devices.  We refer to this as an Unmanaged CA. You can configure DigiCert® Device Trust Manager to support this.

Before you begin

Work with your DigiCert​​®​​ account representative to make sure you have the following:

  • A DigiCert ONE account: Your organization must have an active DigiCert ONE account.

  • CA hierarchy: In CA Manager > Manage CAs, make sure your hierarchy includes:

    • A private root CA, and optionally,

    • An Intermediate CA.

  • Issuance settings: In CA Manager > Manage CAs, the Issue CA Intermediates setting must be set to Yes for the CA that will issue the ICAs.

    • If you're issuing from the root CA, this setting must be enabled on the root, and the root CA must be an online CA.

    • If you're issuing from an existing Intermediate CA, this setting must be enabled on that Intermediate CA, and it must also be an online CA.

  • Certificate template: In Device Trust Manager > Certificate management > Certificate templates:

    • Select the Basic Intermediate CA Certificate Template.

    • Clone it to make it available in your account.

    • Save the cloned template with a name of your choice.

    • This template enables the required CA = true basic constraint.

  • Licensing: In the Account Manager, make sure your account is assigned a Device Trust Manager Advanced license. The Licensing and plans includes the Unmanaged CA feature.

    Also, your DigiCert ONE account admin should provide you with a user account that has the Solution Administrator role in Device Trust Manager.

Wichtig

If you're missing anything above, contact your DigiCert account representative.

Perform the following steps to issue Intermediate CA certificates:

Sign in as a Solution Administrator

  1. Sign in to DigiCert ONE as a Solution Administrator:

  2. In DigiCert ONE, in the Manager menu (grid at top right), select Device Trust.

Create a certificate profile

Perform the following steps to create a certificate profile:

  1. In the Device Trust Manager menu, select Certificate management > Certificate profiles.

  2. Click Create certificate profile.

  3. Enter a Name for the certificate profile.

  4. Under Template, select Intermediate CA, and choose the Intermediate CA certificate template that was cloned for your account.

  5. Set the Common name field to Enabled.

  6. Configure the Required attribute and Value sources to meet your requirements.

  7. Click Create to create a certificate profile.

Create a certificate management policy

Before you begin, ensure you:

Create a division.

  1. In DigiCert ONE, in the Manager menu (grid at top right), select Device Trust.

  2. In the Device Trust Manager menu, select Certificate management > Certificate management policies.

  3. ClickCreate certificate management policy.

  4. Enter a Name for the certificate management policy.

  5. Choose a Division to assign the policy to.

  6. Under the Select the certificate management model, select Policy will be used for secure device lifecycle management. Requires an Advanced license.

  7. Under the Certificate management methods, select the certificate management methods that this policy will support.

    For example, you may want to use EST to request or receive the Intermediate CA certificates. For detailed information on various certificate management methods available, see Certificate management methods.

  8. Optionally, select an Authentication policy.

    Anmerkung

    An Authentication policy is required when using EST, CMPv2, SCEP or ACME, allowing devices to authenticate using a passcode or an authentication certificate. When selecting a certificate request through pthe ortal and API, an authentication policy is optional if you intend to use an API key or a certificate in Account Manager to authenticate.

  9. Click Next.

  10. On the Certificate settings page, select an Intermediate certificate profile and choose the certificate profile you created earlier.

  11. Select an Issuing CA and choose the root CA or the Intermediate CA that will issue new Intermediate CA certificates.

  12. Set the desired Keypair generation preferences.

    For detailed information on Keypairs, see Keypair generation settings.

  13. Click Next.

  14. Under Certificate management method settings, finish configuring each issuance method to meet your requirements.

  15. Click Finish.

Request an Intermediate CA certificate

You can now request and receive Intermediate CA certificates from Device Trust Manager. How you request and receive depends on which certificate management method you configured in the certificate management policy:

In diesem Abschnitt: