Authentication policy management

An authentication policy in DigiCert® Device Trust Manager defines the credentials and methods that devices can use when requesting certificates through different protocols, such as SCEP, EST, and REST. Authentication policies can be applied to both device groups and certificate management policies.

작은 정보

Migrating from enrollment profiles? DigiCert® IoT Trust Manager uses enrollment profiles to manage both credentials and certificate issuance. Device Trust Manager separates these functions into an authentication policy, which handles device authentication, and a certificate management policy, which controls certificate handling. This change allows the same credentials to be applied across multiple certificate management policies, offering greater flexibility and control.

Authentication policies in Device Trust Manager specify the credentials devices must use when requesting certificates. These policies can be applied to both device groups and certificate management policies to ensure that the correct credentials are applied to the right devices and protocols. These policies allow administrators to manage authentication at scale while maintaining security and flexibility across different certificate issuance protocols.

Supported credential types

Authentication policies can be used to specify a variety of credential types to define how devices authenticate for certificate requests.

표 1. Authentication policy supported credential types

Credential type	Description
Passcode	A temporary code that can be used for limited or one-time authentication. Passcodes can be restricted by usage limits and validity periods.
Authentication certificate	Certificates issued to devices for secure, certificate-based authentication. These can also include usage limits and date constraints.
Authentication CA	Certificates issued by a Certificate Authority (CA). Devices can either share the same certificate or use unique ones issued by the CA. No usage limits apply to this method.
ACME credentials	ACME-based credentials used specifically for certificate management via the ACME protocol.

중요

Authentication policies and associated credentials define how devices authenticate when requesting certificates via SCEP, EST, REST, or ACME. These policies apply only to devices and do not govern user authentication or API access. For details on user management, API access, and service users, see DigiCert® Account Manager documentation.

Credential properties

Both passcodes and authentication certificates support configuring additional properties to control how and when the credentials are used. These properties ensure that authentication can be fine-tuned for different requirements.

Usage limits: Specifies the number of times a credential can be used.
Valid from/Valid to: Defines the period during which the credential is valid.
Registered values: Defines specific certificate subject information that must match when the credential is used.

Applying authentication policies

Authentication policies can be applied to both device groups and certificate management policies.

Device group: When an authentication policy is applied to a device group, it governs which credentials devices within that group must use to authenticate when requesting certificates. This setup allows administrators to assign specific authentication methods—such as passcodes or authentication certificates—to distinct sets of devices.
Certificate management policy: When an authentication policy is applied to a certificate management policy, it defines the types of credentials devices must use when requesting certificates through protocols such as SCEP, EST, or REST. This connection ensures that the appropriate security measures are applied based on the certificate issuance process.

Certificate management policy versus device group

When a device requests a certificate, it uses an authentication policy. Which policy gets used depends on how the certificate policy is set up for the device group.

If you assign a certificate management policy to a device group, the authentication rules defined in that certificate management policy is used.
If you do not assign a certificate management policy to a device group (for example, if you’re using a Essentials plan), the authentication rules defined when you created the certificate management policy are used.
When a policy is tied to a device group, the authentication policy chosen during policy creation for that device group is applied.
For example, your EST enrollment endpoint URL may resemble:
```
https://clientauth.demo.one.digicert.com/.well-known/est/devicetrustmanager/IOT_<device-group-id>/device-group/<group-id>/simpleenroll
```
Device in a group, includes /device-group/<group-id>/
When a policy is not tied to a device group, the authentication policy chosen when the certificate management policy was created is applied.
For example, your EST enrollment endpoint URL may resemble:
```
https://clientauth.demo.one.digicert.com/.well-known/est/devicetrustmanager/IOT_<device-id>/simpleenroll
```
Device not in a group, includes only the specific /IOT_<device-id>/

Mark authentication certificates as Disallowed

You can control device authentication by marking specific authentication certificates as Disallowed. This option is primarily used to immediately block compromised, retired, or unauthorized certificates from authenticating. You don't need to delete the certificate record or change the Authentication CA configuration.

Example scenario

A trusted CA might issue certificates to many devices. If one certificate should no longer be used, you can mark only that certificate as Disallowed while allowing other valid certificates from the same CA to continue authenticating.

How it works

Change a certificate's status: You can change a certificate's status between Allowed and Disallowed at any time
Status is checked first: During authentication through SCEP, EST, REST, or ACME, DigiCert® Device Trust Managerchecks the certificate status before performing other validation steps. If the certificate is marked Disallowed, the authentication request is rejected immediately
Disallowed certificates take priority: If a matching certificate is marked Disallowed, Device Trust Manager rejects the request and doesn't perform serial number or Authentication CA fallback lookups

중요

Marking a certificate as Disallowed immediately blocks device enrollment and authentication requests that use that certificate. This action doesn't revoke the certificate at the CA level. It only prevents Device Trust Manager from accepting the certificate for authentication.

Benefits

Block individual certificates without affecting the issuing CA
Respond quickly when a certificate is compromised or unauthorized
Avoid broader CA configuration changes
Improve access control enforcement

What to expect after marking a certificate as Disallowed

표 2. Disallowed certificate

Scenario	Outcome
A device attempts to authenticate using a `Disallowed` certificate	Authentication is rejected immediately, before any other policy or constraint checks are evaluated
A device attempts to authenticate using an `Allowed` certificate	Authentication proceeds through the standard policy, validity, and constraint checks
No matching certificate record is found during the initial lookup	Device Trust Managerperforms a fallback lookup using the certificate serial number together with the applicable authentication policy and Authentication CA context
A Disallowed certificate status is found during any stage of lookup	The Disallowed result takes precedence and authentication is rejected, regardless of any subsequent lookup results

What’s next?

Create an authentication policy

이 섹션의 내용: