Part 2: Establish divisions, authentication, and certificate policies
To perform this action, you must have a user role that contains the Solution administrator permission.
初期アクセスを設定したので、次のステップでは、セキュアなデバイス管理のために DigiCert® Device Trust Manager を設定します。このセクションでは、ディビジョンの作成、認証ポリシーの定義、および証明書プロファイルの設定について説明します。
Objectives
Set up divisions and authentication policies to manage device access.
Add certificate templates, configure certificate profiles, and create certificate management policies for certificate issuance.
Before you begin
To complete the steps in this section, ensure:
Your Account Administrator completed all steps in パート 1: 初期アクセスとセットアップ
Added an Issuing CA to your account
You have reviewed these key concepts: Authentication policy, Certificate profiles, and 証明書管理ポリシー
注記
As you’re setting up Device Trust Manager for the first time, the following sections focus only on the minimum required configurations and parameters to help you get started quickly. You can configure additional settings and advanced customization options later as your deployment grows.
Divisions typically represent subtenants, such as business units, product lines, or customer segments. Each division functions within a separate, confined environment.
In the Device Trust Manager menu, go to Divisions.
Select Create division.
Enter a Name for the division and, optionally, a description.
Select a Primary zone from the dropdown under the Rendezvous zones section.
(Optional) Select a Secondary zone from the dropdown under the Rendezvous zones section as a backup.
Click Create division.
認証ポリシーは、パスコード、認証証明書、認証 CA など、複数のクレデンシャルをサポートします。
A single authentication policy can be assigned to multiple device groups and certificate management policies.
In the Device Trust Manager menu, go to Authentication management > Authentication policies.
Click Create authentication policy.
［新しい認証ポリシーの作成］を選択して保存します。
パスコードは、SCEP、EST、CMPv2 などのプロトコルを使用したデバイス認証および証明書リクエストに使用できる方法のひとつです。
In the Device Trust Manager menu, go to Authentication management > Passcodes.
Select Create passcode.
［名前］と、オプションで説明を入力します。
「認証ポリシーの割り当てまたは作成」で、??? で作成したポリシーを選択します。
必要に応じて、使用制限など追加のパスコード設定を行います。
［パスコードの作成］を選択して保存します。
Creating a certificate management policy involves adding a Certificate template, creating a Certificate profile, and proceeding to create a Certificate management policy through the Certificate settings wizard.
ヒント
You will be creating a bootstrap as well as an operational certificate policy that your devices need to onboard and operate. It is recommended to perform the same settings that have been provided in the following steps.
Create a policy for bootstrap certificates
In the Device Trust Manager menu, go to Certificate management > Certificate settings > Certificate templates.
Select Create.
Select the existing Basic TLS Certificate Template.
ヒント
As you’re setting up the Device Trust Manager for the first time, this topic helps you get started quickly. To keep things simple, we recommend choosing the
Basic TLS Certificate Template, which has been created and customized for you.注記
Certificate templates are created and customized for your organization by DigiCert®. If no certificate templates appear on the Certificate templates page, or if you require modifications or a new template, contact you DigiCert® account representative.
When done, proceed to select Create certificate profile to create a certificate profile.
Under Configure certificate profile section, enter a Name for the certificate profile.
Select if All divisions can use this certificate profile or only Specific divisions.
Select Next to proceed to Advanced certificate profile settings.
Under the Subject and SAN fields, configure fields as needed.
For example, you could enable the Common Name, set it as Required, and specify a default value.
When done, select Next to proceed to the Review and confirm section.
Verify the summary of the certificate profile settings you have selected.
When done, chose Create and select to create the certificate profile and proceed to the Certificate management policy creation section.
Enter a Name for the certificate management policy.
Choose the Division you created in Step 1 to assign this certificate management policy.
Under the Certificate management model, select Policy will be used for secure device lifecycle management. Requires an Advanced license.
Under the Certificate management methods,, select Single certificate request through portal and REST API and register a single device.
ヒント
As you’re setting up the Device Trust Manager for the first time, this topic helps you get started quickly. To keep things simple, we recommend choosing the above two parameters.
When done, select Next.
Verify the summary of the certificate management policy settings you selected.
Select an Issuing CA.
Under the Keypair generation settings, select Server-side keypair generation.
DigiCert® generates keypair for certificate issuance. When selecting this option, specify the default key type and size, such as
RSA 2048orP-256.When done, select Next.
Select Create certificate management policy to create a bootstrap certificate management policy.
Create a policy for operational certificates
In the Device Trust Manager menu, go to Certificate management > Certificate settings > Certificate templates.
Select Create.
Select the existing Basic TLS Certificate Template.
Select the Certificate profile you created in Step 4, and proceed to the Certificate management policy creation section to create an operational certificate management policy.
On the General settings section, enter a Name for the operational certificate policy.
Choose the Division you created in Step 1: Create a division to assign this certificate management policy.
Under the Certificate management model, select Policy will be used for secure device lifecycle management. Requires an Advanced license.
Under Certificate management methods, select DigiCert TrustEdge agent.
When done, select Next.
Verify the summary of the certificate management policy settings you selected.
Select an Issuing CA.
Under the Keypair generation settings, select Local keypair generation.
ヒント
The requestor generates the keypair locally and includes the public key in their Certificate Signing Request (CSR). This is recommended for TrustEdge management-based operational certificates.
When done, select Next.
Under the Certificate management method settings page, expand the Manage certificates using the DigiCert TrustEdge Agent section:
Select the required Certificate request format from the dropdown menu.
Under Define how the agent will generate certificate values, expand the Add optional certificate attribute fields > select any of the certificate attribute fields. For example, Common name.
Select Use an expresssion evaluated by the TrustEdge agent to provide a certificate value and provide the required value.
For example, for MAC Address, provide this value
##mac_address##
Under Private key generation, select Client-side software.
When done, select Create certificate management policy to create an operational certificate management policy.
進行状況の確認
この段階で、Device Trust Manager は、ディビジョン、認証ポリシー、および証明書管理ポリシーで構成されます。以下が完了しているはずです。
デバイスその他のエンティティを組織するために設けられているディビジョン。
セキュアなアクセスに必要な認証ポリシーとパスコードの設定
証明書発行管理のために定義された証明書プロファイルおよび管理ポリシー
What’s next?
Continue to Part 3: Set up device management to create a device group and register your first device so you can begin managing devices in Device Trust Manager.