Skip to main content

Use a one-time passcode for enrollment

Use a one-time passcode (OTP) to authenticate a client's initial certificate enrollment through a SCEP, EST, or CMP profile configured for OTP authentication.

Each OTP is unique, valid only for the period configured in the profile, and can be used only once. After the client receives a certificate, supported subsequent operations use the existing certificate for authentication instead of another OTP.

Before you begin

Make sure you have:

  1. An active SCEP, EST, or CMP profile configured to use One-Time Passcode (OTP) authentication.

  2. The permissions and credentials required to generate an OTP for the profile.

  3. A secure method to provide the OTP to the client.

Generate a one-time passcode

To generate a one-time passcode:

  1. Get the OTP generation URL for your profile.

    The URL has the following structure:

    https://<your-ca-domain>/certificate-authority/api/v1/issuance/profile/<ProfileID>/dynamic-code

  2. Send an authenticated request to the OTP generation URL.

  3. Copy the OTP and the information returned with it.

    The response includes:

    Value

    Description

    otp

    The one-time passcode used to authenticate the initial enrollment request.

    id

    The unique identifier for the OTP. For CMP, this identifier is included in the generated enrollment URL.

    valid_from

    The time from which the OTP can be used.

    valid_to

    The time after which the OTP can no longer be used.

    url

    For CMP profiles, the enrollment URL generated for this OTP.

For SCEP and EST, the response contains the OTP information. For CMP, it also contains a unique enrollment URL that includes the OTP ID.

Use the passcode

Provide the OTP and other required enrollment information to the client through a secure out-of-band method.

How the client uses the OTP depends on the protocol:

Protocol

How the OTP is used

SCEP

Include the OTP as the challenge password in the certificate signing request (CSR).

EST

Use the OTP as the password for authenticating the initial enrollment request.

CMP

Use the OTP as the shared secret and use the unique CMP enrollment URL returned when the OTP was generated.

Complete the enrollment before the OTP expires. After a successful enrollment, the OTP cannot be reused. Generate a new OTP for another initial enrollment or if the previous OTP expires before it is used.

In this section: