パート 2: Device Trust Manager の設定

To perform this action, you must have a user role that contains the Solution administrator permission.

初期アクセスを設定したので、次のステップでは、セキュアなデバイス管理のために DigiCert® Device Trust Manager を設定します。このセクションでは、ディビジョンの作成、認証ポリシーの定義、および証明書プロファイルの設定について説明します。

目的

認証ポリシーを設定してデバイスアクセスを管理する。
証明書プロファイルと証明書発行管理ポリシーを設定する。

開始する前に

Your Account Administrator completed all steps in Part 1: Initial access and setup
Reviewed the following concepts: Authentication policy, Certificate profiles, and Certificate management policy
Add an Issuing CA to your account

Device Trust Managerの初期設定を開始するには、以下の手順に従います。

Step 1: Create a division

In the Device Trust Manager menu, go to Divisions.
Select Create division.
Enter a Name for the division and, optionally, a description.
Select a Primary zone from the dropdown under the Rendezvous zones section.
(Optional) Select a Secondary zone from the dropdown under the Rendezvous zones section as a backup.
Click Create new division.

ステップ 2: 認証ポリシーの作成

認証ポリシーは、パスコード、認証証明書、認証 CA など、複数のクレデンシャルをサポートします。

ヒント

1 つの認証ポリシーを複数のデバイスグループや証明書管理ポリシーに割り当てることができます。

In the Device Trust Manager menu, go to Authentication management > Authentication policies.
Click Create authentication policy.
［新しい認証ポリシーの作成］を選択して保存します。

ステップ 3: 認証ポリシーへのパスコードの追加

パスコードは、SCEP、EST、CMPv2 などのプロトコルを使用したデバイス認証および証明書リクエストに使用できる方法のひとつです。

In the Device Trust Manager menu, go to Authentication management > Passcodes.
Select Create passcode.
［名前］と、オプションで説明を入力します。
「認証ポリシーの割り当てまたは作成」で、ステップ 2: 認証ポリシーの作成で作成したポリシーを選択します。
必要に応じて、使用制限など追加のパスコード設定を行います。
［パスコードの作成］を選択して保存します。
Alternatively, you can also select your authentication policy from the Authentication policies list and add a passcode.

重要

API 認証にパスコードを使用する場合は、ヘッダーを x-api-key ではなく x-passcode に設定してください。

Step 4: Create a certificate management policy

Creating a certificate management policy involves adding a Certificate template, creating a Certificate profile, and proceeding to create a Certificate management policy through the Certificat settings wizard.

注記

As part of this topic, we will be creating a bootstrap as well as an operational certificate policy. It is recommended to perform the same settings that have been provided in the following steps.

Create a certificate management policy for bootstrap certificates

In the Device Trust Manager menu, go to Certificate management > Certificate settings > Certificate templates.
Select Create.
Select the existing Basic TLS Certificate Template.
ヒント
As you’re setting up the Device Trust Manager for the first time, this topic helps you get started quickly. To keep things simple, we recommend choosing the Basic TLS Certificate Template , which has been created and customized for you.
注記
Certificate templates are created and customized for your organization by DigiCert®. If no certificate templates appear on the Certificate templates page, or if you require modifications or a new template, contact you DigiCert® account representative.
When done, proceed to select Create certificate profile to create a certificate profile.
Under Configure certificate profile section, enter a Name for the certificate profile.
Select if All divisions can use this certificate profile or only Specific divisions.
Under the Certificate management model, select Policy will be used for secure device lifecycle management. Requires an Advanced license.
Under the Certificate management methods,, select Single certificate request through portal and REST API and register a single device.
ヒント
As you’re setting up the Device Trust Manager for the first time, this topic helps you get started quickly. To keep things simple, we recommend choosing the above two parameters.
When done, select Next.
Verify the summary of the certificate management policy settings you selected.
Select an Issuing CA.
Under the Keypair generation settings, select Server-side keypair generation.
DigiCert® generates keypair for certificate issuance. When selecting this option, specify the default key type and size, such as RSA 2048 or P-256.
When done, select Next.
Select Create certificate management policy to create a bootstrap certificate management policy.

Create a certificate management policy for operational certificates

In the Device Trust Manager menu, go to Certificate management > Certificate settings > Certificate templates.
Select Create.
Select the existing Basic TLS Certificate Template.
Select the existing Certificte profile and proceed to the Certificate management policy creation section to create an operational certificate management policy.
On the General settings section, enter a Name for the operational certificate policy.
Select a Division.
Under the Certificate management model, select Policy will be used for secure device lifecycle management. Requires an Advanced license.
Under Certificate management methods, select DigiCert TrustEdge agent.
When done, select Next.
Verify the summary of the certificate management policy settings you selected.
Select an Issuing CA.
Under the Keypair generation settings, select Local keypair generation.
ヒント
The requestor generates the keypair locally and includes the public key in their Certificate Signing Request (CSR). This is recommended for TrustEdge management-based operational certificates.
When done, select Next.
Under the Certificate management method settings page, expand the Manage certificates using the DigiCert TrustEdge Agent section:
1. Select the required Certificate request format from the dropdown menu.
2. Under Define how the agent will generate certificate values, expand the Add optional certificate attribute fields > select any of the certificate attribute fields. For example, Common name.
3. Select Use an expresssion evaluated by the TrustEdge agent to provide a certificate value and provide the required value.
  For example, for MAC Address, provide this value ##mac_address##
Under Private key generation, select Client-side software.
When done, select Create certificate management policy to create an operational certificate management policy.

進行状況の確認

この段階で、Device Trust Manager は、ディビジョン、認証ポリシー、および証明書管理ポリシーで構成されます。以下が完了しているはずです。

デバイスその他のエンティティを組織するために設けられているディビジョン。
セキュアなアクセスに必要な認証ポリシーとパスコードの設定
証明書発行管理のために定義された証明書プロファイルおよび管理ポリシー

次の手順

続いて、「パート 3: デバイス管理の設定」に進んで、デバイス管理構造を構成します。

このセクションの内容: