Part 2: Configure Device Trust Manager

To perform this action, you must have a user role that contains the Solution administrator permission.

Now that the initial access is set up, the next step is to configure DigiCert® Device Trust Manager for secure device management. This section helps you create divisions, define authentication policies, and set up certificate profiles.

Objectives

Set up authentication policies to manage device access.
Add certificate templates, configure certificate profiles, and create certificate management policies for certificate issuance.

Before you begin

Your Account Administrator completed all steps in Part 1: Initial access and setup
Reviewed the following concepts: Authentication policy, Certificate profiles, and Certificate management policy
Add an Issuing CA to your account

To start initial configuration of Device Trust Manager, complete the following steps:

Step 1: Create a division

In the Device Trust Manager menu, go to Divisions.
Select Create division.
Enter a Name for the division and, optionally, a description.
Select a Primary zone from the dropdown under the Rendezvous zones section.
(Optional) Select a Secondary zone from the dropdown under the Rendezvous zones section as a backup.
Click Create new division.

Step 2: Create an authentication policy

Authentication policies support multiple credentials, including passcodes, authentication certificates, and authentication CAs.

Tip

A single authentication policy can be assigned to multiple device groups and certificate management policies.

In the Device Trust Manager menu, go to Authentication management > Authentication policies.
Click Create authentication policy.
Select Create new authentication policy to save.

Step 3: Add a passcode to your authentication policy

Passcodes are one of the methods that can be used for device authentication and certificate requests using protocols such as SCEP, EST, and CMPv2.

In the Device Trust Manager menu, go to Authentication management > Passcodes.
Select Create passcode.
Enter a Name and, optionally, a description.
Under Assign or create an authentication policy, choose the policy created in Step 2: Create an authentication policy.
If necessary, configure additional passcode settings for authentication, usage restrictions, and so on.
Select Create passcode to save.
Alternatively, you can also select your authentication policy from the Authentication policies list and add a passcode.

Important

When using a passcode for API authentication, make sure to set the header to x-passcode instead of x-api-key.

Step 4: Create a certificate management policy

Creating a certificate management policy involves adding a Certificate template, creating a Certificate profile, and proceeding to create a Certificate management policy through the Certificat settings wizard.

Note

As part of this topic, we will be creating a bootstrap as well as an operational certificate policy. It is recommended to perform the same settings that have been provided in the following steps.

Create a certificate management policy for bootstrap certificates

In the Device Trust Manager menu, go to Certificate management > Certificate settings > Certificate templates.
Select Create.
Select the existing Basic TLS Certificate Template.
Tip
As you’re setting up the Device Trust Manager for the first time, this topic helps you get started quickly. To keep things simple, we recommend choosing the Basic TLS Certificate Template , which has been created and customized for you.
Notice
Certificate templates are created and customized for your organization by DigiCert®. If no certificate templates appear on the Certificate templates page, or if you require modifications or a new template, contact you DigiCert® account representative.
When done, proceed to select Create certificate profile to create a certificate profile.
Under Configure certificate profile section, enter a Name for the certificate profile.
Select if All divisions can use this certificate profile or only Specific divisions.
Under the Certificate management model, select Policy will be used for secure device lifecycle management. Requires an Advanced license.
Under the Certificate management methods,, select Single certificate request through portal and REST API and register a single device.
Tip
As you’re setting up the Device Trust Manager for the first time, this topic helps you get started quickly. To keep things simple, we recommend choosing the above two parameters.
When done, select Next.
Verify the summary of the certificate management policy settings you selected.
Select an Issuing CA.
Under the Keypair generation settings, select Server-side keypair generation.
DigiCert® generates keypair for certificate issuance. When selecting this option, specify the default key type and size, such as RSA 2048 or P-256.
When done, select Next.
Select Create certificate management policy to create a bootstrap certificate management policy.

Create a certificate management policy for operational certificates

In the Device Trust Manager menu, go to Certificate management > Certificate settings > Certificate templates.
Select Create.
Select the existing Basic TLS Certificate Template.
Select the existing Certificte profile and proceed to the Certificate management policy creation section to create an operational certificate management policy.
On the General settings section, enter a Name for the operational certificate policy.
Select a Division.
Under the Certificate management model, select Policy will be used for secure device lifecycle management. Requires an Advanced license.
Under Certificate management methods, select DigiCert TrustEdge agent.
When done, select Next.
Verify the summary of the certificate management policy settings you selected.
Select an Issuing CA.
Under the Keypair generation settings, select Local keypair generation.
Tip
The requestor generates the keypair locally and includes the public key in their Certificate Signing Request (CSR). This is recommended for TrustEdge management-based operational certificates.
When done, select Next.
Under the Certificate management method settings page, expand the Manage certificates using the DigiCert TrustEdge Agent section:
1. Select the required Certificate request format from the dropdown menu.
2. Under Define how the agent will generate certificate values, expand the Add optional certificate attribute fields > select any of the certificate attribute fields. For example, Common name.
3. Select Use an expresssion evaluated by the TrustEdge agent to provide a certificate value and provide the required value.
  For example, for MAC Address, provide this value ##mac_address##
Under Private key generation, select Client-side software.
When done, select Create certificate management policy to create an operational certificate management policy.

Review your progress

At this stage, Device Trust Manager is configured with divisions, authentication policies, and certificate management policies (bootstrap and operational certificates). You should now have:

A division created to organize devices and other entities
Authentication policies and passcodes are set up for secure access
Certificate profiles and management policies are defined for controlled certificate issuance

What’s next?

Continue to Part 3: Set up device management to configure your device management structure.

In this section: