Profiles
A profile in DigiCert® Private CA defines the certificate-issuance policy for a specific protocol and includes all parameters that the protocol itself can’t carry. For example:
Protocol and version (SCEP, EST, CMP, ACME)
The issuing CA and certificate template
Certificate validity period and renewal window
Allowed key types and signature algorithms
Authentication methods
Tipp
To create a profile or to see your existing profiles, select Profiles from the main menu in DigiCert Private CA.
Authentication methods
The authentication method used by a client depends on the protocol and whether the request is for initial enrollment or a subsequent certificate operation.
Protocol | Initial enrollment | Renewal and other operations |
|---|---|---|
SCEP | Global Authentication Code or OTP | Existing certificate and private key |
EST | Global Authentication Code or OTP | Existing certificate and private key |
CMP | Global Authentication Code or OTP | Existing certificate and private key |
ACME | External Account Binding (EAB) credentials: Key identifier and HMAC key | Existing ACME account |
SCEP, EST, and CMP profiles support two methods for authenticating an initial certificate request:
Global authentication code - A reusable code configured in the profile. Multiple clients can use the code while it remains valid.
One time passcode (OTP) - A unique, time-limited code generated for an individual enrollment. The code becomes invalid after it is used or expires. To learn more about this method, see Use a one-time passcode for enrollment
Profile setup
To enable protocol-based enrollment, first create a profile for the desired protocol.
At a high level, the process involves:
Defining the issuance settings, such as the protocol, CA, and certificate template.
Specifying how the client authenticates its initial certificate request.
Setting validity, renewal window, and any protocol-specific options (for example, encryption algorithm for SCEP responses).
Save the configuration to generate a unique URL.
The generated URL serves as the endpoint your devices and applications use to connect to your private CA.
How does a profile work
Copy the URL from the profile details and configure your client application or device to use it. The Profile ID embedded in the URL maps each request to the issuing CA, certificate template, authentication settings, and other issuance rules defined in the profile. The URLs have this structure:
EST → /.well-known/est/CA_<ProfileID>/simpleenroll
SCEP → /certificate-authority/api/v1/scep/<ProfileID>/cgi-bin/pkiclient.exe
CMP → /certificate-authority/api/v1/cmp/<ProfileID>
ACME → /certificate-authority/api/v1/acme/directory
For initial enrollment, the client authenticates using the method configured in the profile. Subsequent operations use the authentication mechanism supported by the protocol, such as the client’s existing certificate for SCEP, EST, and CMP, or the existing ACME account for ACME.