Enroll a private user certificate using Browser PKCS12 with an enrollment code
This guide walks you through the complete process of issuing a private user certificate from the DigiCert Private CA service using a web-based enrollment flow through DigiCert® Trust Lifecycle Manager. Along the way, you'll learn key Trust Lifecycle Manager concepts and perform common configuration and management tasks.
Note
The same general workflow can be used with other supported certificate authorities and user certificate templates that support the Browser PKCS12 enrollment method with Enrollment Code authentication. Configure the appropriate CA integration and use a base template supported by that CA service.
Objectives
Create a certificate profile that uses the
Browser PKCS12enrollment method andEnrollment Codeauthentication method.Create and enroll a seat against the certificate profile to generate an enrollment code and send the enrollment URL to the user.
Use the enrollment URL and enrollment code to request a private user certificate, and verify the issued certificate in Trust Lifecycle Manager.
Before you begin
Make sure these prerequisites are satisfied before working through the steps in this guide:
Your account is set up to issue certificates from the DigiCert-hosted (cloud) version of DigiCert® Private CA.
Your Trust Lifecycle Manager account has a certificate authority (CA) configured for issuing certificates.
At least one seat license is available in the business unit where you will issue the certificate in your Trust Lifecycle Manager account.
You need one of the following user role configurations for Trust Lifecycle Manager:
Notice
For help verifying or enabling these prerequisites, contact your DigiCert account representative.
Workflow
To complete this guide, you’ll create a certificate profile, create and enroll a seat to generate an enrollment code, request the certificate through the web-based enrollment form, and verify the issued certificate in inventory.
Before enrolling certificates in Trust Lifecycle Manager, you need a certificate profile to enroll from. The certificate profile defines the general properties of the certificate type to issue, along with the enrollment and authentication methods used when requesting certificates from the profile.
For this guide, our profile configuration will include:
Profile setting | Description |
|---|---|
Issuing CA | Certificates are issued from a certificate authority in DigiCert Private CA. |
Enrollment method | The |
Authentication method | The |
Certificate options | Configure the certificate profile to include the desired Subject DN and Subject Alternative Name (SAN) fields. |
To create the certificate profile:
In the Trust Lifecycle Manager menu, go to Policies > Base templates.
Select one of the following base templates as the starting point, based on the type of certificate you want to issue:
Generic Private Server CertificateGeneric User Certificate
After you select the base template, the profile configuration wizard opens. Use the wizard to configure the certificate profile settings.
Notice
In the following steps, work through the profile wizard and configure the settings noted in the preceding table.
Any settings not mentioned can be skipped or left at their default values.
After completing a wizard screen, select Next to continue. To return to a previous screen and review its settings, select Back.
On the Primary options screen, configure the following:
Profile name: Enter a friendly name to identify the profile in Trust Lifecycle Manager.
Profile description (optional): Enter an optional description for the profile.
Business unit: Select the business unit to assign for certificates issued from this profile.
CA service: Leave this set to
DigiCert One CA Managerto issue certificates from the DigiCert-hosted (cloud) version of DigiCert Private CA.Issuing CA: Select the CA to use for issuing certificates from the DigiCert Private CA service.
Enrollment method: Select
Browser PKCS12to request certificates through a web-based enrollment form and download them in PKCS#12 format.Authentication method: Select
Enrollment Code. For a single seat enrollment, Trust Lifecycle Manager automatically assigns an enrollment code when you enroll the seat in Step 2.Note
Browser PKCS12supports multiple authentication methods:Enrollment Code: Requires users to enter an enrollment code to authenticate their certificate requests. Trust Lifecycle Manager generates the code when an administrator enrolls a seat against the certificate profile. The administrator then shares the code securely with the userManual Approval: Requires a Trust Lifecycle Manager administrator to approve certificate requests before issuance. You can also enable dual administrator approval.SAML IdP: Authenticates users through a SAML identity provider.DigiCert ONE Login (OIDC/SAML): Authenticates users through the configured OIDC or SAML identity provider.
On the Certificate options screen, in the Certificate fields section, note the Key type and Key sizes configured for the profile. You can select multiple supported key sizes. The key generated during enrollment must use the configured key type and one of the supported key sizes. Leave the settings at their default values unless you have a specific reason to change them.
Scroll down to the Subject DN and SAN fields to configure the certificate properties. For every field being configured, select the Source for the field's value to specify where the value comes from.
Available sources depend on the certificate field and profile configuration. For this flow, select one of the following options:
Entered by User: Input the value into the web-based form when requesting a certificate.Fixed value: The same configured value is used for all certificates issued from the profile.Entered/uploaded by Admin: The administrator provides the value when enrolling the seat.
By default, the profile includes a Subject DN: Common name field with
Entered by Useras the source for its value. Select the appropriate source for the field's value based on how you want to provide the Common name.To add more certificate fields:
In the dropdown above the certificate properties table, select any additional fields to include in the Subject DN or Subject Alternative Name (SAN) of issued certificates.
Select the Add button next to the dropdown to add the selected fields to the profile configuration.
For each field you add, select the Source for the field's value and configure any additional options. The available options vary depending on the selected source. For example:
Required: Specify whether a value must be provided when enrolling a certificate. This option is available for the
Entered by UserandEntered/uploaded by Adminsources.Hide this field from the public-facing enrollment pages: Available when you select Fixed value. Select this option to prevent the field from appearing on public-facing enrollment pages.
On the Extensions screen, you can leave everything set to its default value. Select Next to proceed.
On the Additional options screen, you can configure certificate metadata to help organize and manage certificates issued from this profile, including tags, owners, and custom attributes. Select Next to proceed.
On the Advanced settings screen, you can enable the self-service portal for this profile, which allows users to request, view, and manage their own certificates from a web-based portal.
Select Create to create the new certificate profile with all the settings you configured.
The Certificate profile created popup window launches. On the Profile details screen, take a moment to review the details of the profile you just created.
Next, create a seat for the user who will receive the certificate. A seat identifies the entity associated with the certificate. When you enroll the seat against the certificate profile, Trust Lifecycle Manager assigns an enrollment code and sends the enrollment URL to the email address in the seat record.
In the Trust Lifecycle Manager menu, go to Account > Seats.
Select Create.
Select Seat type.
Note
If your Trust Lifecycle Manager account uses the legacy licensing model (with different seat types), you also need to select a Seat type when creating seats individually or in bulk. To learn more, see Legacy seat types.
Provide values for the following fields:
Business unit: Select the business unit to create the seat in.
Seat ID: Enter a unique identifier for the seat. For this flow, you can use the user’s email address.
Seat name: Enter a name to identify the seat. For example, enter the user’s name.
Email (optional): If the Seat ID is not an email address, enter the email address to use for notifications.
Phone (optional): Enter the user's phone number, if needed.
Select Create seat.
In the Profiles found dialog, select Enroll. The Enroll seat page opens.
From the Profile dropdown on the Enroll seat page, select the certificate profile you created in Step 1.
Review the certificate properties displayed for the selected profile and then, select Enroll.
The Enrollment code created - email sent dialog displays the enrollment code.
Select the copy icon to copy the enrollment code, then save the code for later use.
Select Close.
When you enroll a single seat, Trust Lifecycle Manager automatically generates an enrollment code and sends a Certificate enrollment confirmation email containing the enrollment link to the user.
Next, use the enrollment link and enrollment code from Step 2 to request the certificate. The enrollment code authenticates the certificate request.
Open the Certificate enrollment confirmation email and select the enrollment link.
The Verify and update enrollment details page opens.
In Enrollment code, enter the enrollment code provided in Step 2.
Important
The number of attempts allowed for entering the enrollment code is configured in the certificate profile. The enrollment page displays the maximum number of attempts.
Enter values for any additional certificate fields displayed on the enrollment page. The fields that appear depend on how the certificate profile is configured. For example, if Common name is configured with
Entered by Useras its source, enter the common name.Select Next. A confirmation message indicates that the enrollment was updated successfully.
On the Verify certificate information page, review the certificate details and make sure they are correct.
Select Next to continue.
On the Install certificate page, select the copy icon to copy the generated password and store it securely. The password is required to install the certificate and is not displayed again.
After you copy the password, the Download button becomes available.
Under Password Based Encryption Algorithms, select the encryption algorithm. AES-256 is selected by default. You can also select 3DES (Legacy).
Select Download and save the certificate to your computer. Save it immediately after downloading to avoid losing it.
After you complete the installation, you can close the browser.
You can optionally install the downloaded PKCS#12 certificate on your device using the Certificate Import Wizard. The following steps show how to install the certificate.
Open the downloaded
.p12certificate file. The Certificate Import Wizard opens.Under Store Location, select Current User, and then select Next.
On the File to Import screen, verify that the downloaded
.p12certificate file is selected, and then select Next.On the Private key protection screen, enter the password you copied when you downloaded the certificate in Step 3.
Configure the private key import options as needed, and then select Next.
For this flow, you can leave the default Include all extended properties option selected.
On the Certificate Store screen, leave Automatically select the certificate store based on the type of certificate option selected, and then select Next.
If you want to specify a certificate store, select Place all certificates in the following store, select Browse, choose the certificate store, and then select Next.
On the Completing the Certificate Import Wizard screen, review the import settings and select Finish.
A Security Warning message appears, review the certificate authority information and confirm that you trust the CA before installing the certificate. To continue, select Yes.
A confirmation message indicates that the certificate was imported successfully. Select OK.
The certificate is now installed on your Windows device. Next, we'll verify the issued certificate in the Trust Lifecycle Manager certificate inventory.
Finally, you can verify that the issued certificate appears in the certificate inventory and that its details match the information submitted during enrollment.
To view the issued certificate, perform the following steps.
In the Trust Lifecycle Manager menu, go to Inventory > Certificates.
If necessary, select Filter, create a filter rule using the certificate Common name, and then apply the filter to locate the certificate. You can also filter by certificate profile, enrollment method, or other relevant fields.
Under Subject DN, verify that the certificate fields match the values submitted during enrollment.
If you provided Subject Alternative Name (SAN) values during enrollment, verify that they appear in the SANs section of the certificate details.
What's next
To manage existing certificates in Trust Lifecycle Manager, go to Inventory > Certificates. For more information, see Manage certificates.
To modify the certificate settings used for future enrollment requests, edit the certificate profile.
To customize the appearance of public-facing enrollment pages and email notifications with your organization's branding, see Branding.