Enroll a private certificate from CSR using a web-based flow with manual approval
This guide walks you through the complete process of issuing a private device, server, or user certificate from the DigiCert Private CA service using a web-based enrollment flow through DigiCert® Trust Lifecycle Manager. Along the way, you'll learn key Trust Lifecycle Manager concepts and perform common configuration and management tasks.
Note
The same workflow can be used to request certificates from other supported public and private CAs. For CAs other than DigiCert Private CA, configure the appropriate CA connector and create the certificate profile from a base template supported by that CA service.
Objectives
Create a certificate profile to define the type of certificate to issue and configure the enrollment and authentication methods for requesting it.
Generate a private key and certificate signing request (CSR), and use the CSR to request a new certificate using the web-based enrollment URL for the profile you created.
Complete the enrollment process by approving the certificate request in Trust Lifecycle Manager, downloading the issued certificate, and verifying it in the certificate inventory.
Before you begin
Make sure these prerequisites are satisfied before working through the steps in this guide:
Your account is set up to issue certificates from the DigiCert-hosted (cloud) version of DigiCert® Private CA.
Your Trust Lifecycle Manager account has a certificate authority (CA) configured for issuing certificates.
At least one seat license is available in the business unit where you will issue the certificate in your Trust Lifecycle Manager account.
You need one of the following user role configurations for Trust Lifecycle Manager:
Notice
For help verifying or enabling these prerequisites, contact your DigiCert account representative.
Workflow
To complete this guide, you'll create a certificate profile, generate a certificate signing request (CSR), enroll a new certificate using a web-based enrollment form, and approve the enrollment request.
Before enrolling certificates in Trust Lifecycle Manager, you need a certificate profile to enroll from. The certificate profile defines the general properties of the certificate type to issue, along with the enrollment and authentication methods used when requesting certificates from the profile.
For this guide, our profile configuration will include:
Profile setting | Description |
|---|---|
Issuing CA | Certificates are issued from a certificate authority in DigiCert Private CA. |
Enrollment method | The |
Authentication method | The CSR enrollment method supports multiple authentication methods. For this flow, we'll use |
Certificate options | Configure the certificate profile to include the desired Subject DN and Subject Alternative Name (SAN) fields. |
To create the certificate profile:
In the Trust Lifecycle Manager menu, go to Policies > Base templates.
Select one of the following base templates as the starting point, based on the type of certificate you want to issue:
Generic Device CertificateGeneric Private Server CertificateGeneric User Certificate
After you select the base template, the profile configuration wizard opens. Use the wizard to configure the certificate profile settings.
Notice
In the following steps, work through the profile wizard and configure the settings noted in the preceding table.
Any settings not mentioned can be skipped or left at their default values.
After completing a wizard screen, select Next to continue. To return to a previous screen and review its settings, select Back.
On the Primary options screen, configure the following:
Profile name: Enter a friendly name to identify the profile in Trust Lifecycle Manager.
Profile description (optional): Enter an optional description for the profile.
Business unit: Select the business unit to assign for certificates issued from this profile.
CA service: Leave this set to
DigiCert One CA Managerto issue certificates from the DigiCert-hosted (cloud) version of DigiCert Private CA.Issuing CA: Select the CA to use for issuing certificates from the DigiCert Private CA service.
Enrollment method: Select
CSRto enroll certificates by uploading a CSR into a web-based form.Authentication method: Select
Manual Approvalto approve enrollment requests from the Inventory > Enrollments page in Trust Lifecycle Manager.
On the Certificate options screen, in the Certificate fields section, note the Key type and Key sizes configured for the profile. You can select multiple supported key sizes. Any CSR used to request a certificate from this profile must match the key type and one of the supported key sizes. Leave the settings at their default values unless you have a specific reason to change them.
Scroll down to the Subject DN and SAN fields to configure the certificate properties. For every field being configured, select the Source for the field's value to specify where the value comes from.
Available sources depend on the certificate field and profile configuration. For this flow, select one of the following options:
Entered by User: Input the value into the web-based form when requesting a certificate.From CSR: Read the value from the CSR that you upload when requesting a certificate.Fixed value: The same configured value is used for all certificates issued from the profile.
By default, the profile includes a Subject DN: Common name field with
Entered by Useras the source for its value. You can change the source toFrom CSRto read the value from the CSR, orFixed valueto use the same configured value for all certificates issued from the profile.To add more certificate fields:
In the dropdown above the certificate properties table, select any additional fields to include in the Subject DN or Subject Alternative Name (SAN) of issued certificates.
Select the Add button next to the dropdown to add the selected fields to the profile configuration.
For each field you added, set the Source for the field's value to indicate whether the value should be read from the CSR or entered by the user in the web-based enrollment form. Some certificate fields have additional settings you can configure. For example:
Required: Specify whether a value must be provided when enrolling a certificate.
Multiple: Specify whether the field can support multiple values.
On the Extensions screen, you can leave everything set to its default value. Select Next to proceed.
On the Additional options screen, you can configure certificate metadata to help organize and manage certificates issued from this profile, including tags, owners, and custom attributes. Select Next to proceed.
On the Advanced settings screen, you can enable the self-service portal for this profile, which allows users to request, view, and manage their own certificates from a web-based portal. For this workflow, we'll use the profile's Enrollment URL instead.
Select Create to create the new certificate profile with all the settings you configured.
The Certificate profile created popup window launches, showing the Enrollment URL to use for enrolling certificates from your new profile. Select the clipboard icon to copy the enrollment URL and store it somewhere safe.
When you're ready, select Ok to close the popup window.
On the Profile details screen, take a moment to review the details of the profile you just created. You can always return to the profile details screen later and get the enrollment URL from the header section.
Next, generate a private key and certificate signing request (CSR) to enroll a certificate from the profile you created. The CSR contains the public key and certificate subject information that the CA uses to issue the certificate. Store the private key securely as it is required to use the issued certificate.
The CSR you generate must contain matching fields for the certificate properties you configured in the certificate profile to get their values From CSR. For the fields you configured as Entered by User, you'll supply values in the web-based enrollment form instead.
In addition, the CSR must match the key type and key size settings configured in the certificate profile. The default settings are:
Key type: RSA
Key size: 2048 bits
There are many ways to generate a CSR, including free online generators. One common method is to use OpenSSL, an open-source cryptographic toolkit that provides a simple command-line utility for generating CSRs across different operating systems.
For example, the following OpenSSL command generates a new private key and CSR, storing the private key in a file named my-cert.key and the CSR in a file named my-cert.csr:
openssl req -new -newkey rsa:2048 -nodes -out my-cert.csr -keyout my-cert.key -subj "/C=US/O=Example Corp"
Descriptions of the OpenSSL command-line arguments:
OpenSSL arguments | Description |
|---|---|
| Request creation of a new CSR. |
| Generate a new 2048-bit RSA private key along with the CSR. |
| Do not encrypt the private key with a passphrase ("no DES"). |
| Output the CSR to a file called my-cert.csr. |
| Output the private key to a file called my-cert.key |
| Specify the Subject Distinguished Name (DN) for the certificate, including the country ( |
Important
Make sure that you provide matching values in the CSR for all certificate fields you have configured as From CSR in the certificate profile.
Next, submit your certificate request using the enrollment form. In this step, you will provide the CSR you generated in the previous step along with any additional certificate information.
To submit your certificate request using the enrollment form, perform the following steps.
Open the enrollment URL that you copied when you created the certificate profile.
Fill in the required enrollment information.
Paste the CSR you generated in Step 2: Generate the CSR into the CSR field.
Enter values for any certificate fields that are configured with the
Entered by usersource in the certificate profile.
Next, approve the enrollment request in Trust Lifecycle Manager. In this step, you will locate the pending enrollment request, approve it, and verify that the certificate was issued.
To approve the enrollment request, perform the following steps.
In the Trust Lifecycle Manager menu, go to Inventory > Enrollments.
Select Filter, create a filter rule with Status set to
Pending, and then apply the filter.Note
You can also use the Pending requests widget on the Trust Lifecycle Manager dashboard to quickly access certificate enrollment requests that are pending approval.
Locate the enrollment request you submitted in Step 3: Enroll the certificate from the CSR.
Select the Approve enrollment icon.
A Change enrollment status message confirms that the enrollment status was updated successfully. The enrollment status changes to Approved, and the certificate is issued.
The Approved status indicates that the enrollment request was processed successfully and the certificate was issued. After the certificate is issued, the requester receives a certificate delivery email. You can also download the certificate by selecting the link provided in the email.
Finally, you can verify that the issued certificate appears in the certificate inventory and that its details match the information submitted during enrollment.
To view the issued certificate, perform the following steps.
In the Trust Lifecycle Manager menu, go to Inventory > Certificates.
If necessary, select Filter, create a filter rule using the certificate Common name, and then apply the filter to locate the certificate.
Under Subject DN, verify that the certificate fields match the values submitted during enrollment.
If you provided Subject Alternative Name (SAN) values during enrollment, verify that they appear in the SANs section of the certificate details.
What's next
To manage existing certificates in Trust Lifecycle Manager, go to Inventory > Certificates. For more information, see Manage certificates.
To enroll additional private certificates, use the enrollment URL from the certificate profile to submit new certificate signing requests (CSRs).
To modify the certificate settings used for future enrollment requests, edit the certificate profile.
To customize the appearance of public-facing enrollment pages and email notifications with your organization's branding, see Branding.