Part 2: Establish divisions, authentication, and certificate policies
To perform this action, you must have a user role that contains the Solution administrator permission.
Now that the initial access is set up, the next step is to configure DigiCert® Device Trust Manager for secure device management. This section helps you create divisions, define authentication policies, and set up certificate policies.
Objectives
Set up divisions and authentication policies to manage device access.
Add certificate templates, configure certificate profiles, and create certificate management policies for certificate issuance.
Before you begin
To complete the steps in this section, ensure:
Your Account Administrator completed all steps in Part 1: Initial access and setup
Added an Issuing CA to your account
You have reviewed these key concepts: Authentication policy, Certificate profiles, and Certificate management policies
Nota
As you’re setting up Device Trust Manager for the first time, the following sections focus only on the minimum required configurations and parameters to help you get started quickly. You can configure additional settings and advanced customization options later as your deployment grows.
Divisions typically represent subtenants, such as business units, product lines, or customer segments. Each division functions within a separate, confined environment.
In the Device Trust Manager menu, go to Divisions.
Select Create division.
Enter a Name for the division and, optionally, a description.
Select a Primary zone from the dropdown under the Rendezvous zones section.
(Optional) Select a Secondary zone from the dropdown under the Rendezvous zones section as a backup.
Click Create division.
Authentication policies support multiple credentials, including passcodes, authentication certificates, and authentication CAs.
A single authentication policy can be assigned to multiple device groups and certificate management policies.
In the Device Trust Manager menu, go to Authentication management > Authentication policies.
Click Create authentication policy.
Select Create new authentication policy to save.
Passcodes are one of the methods that can be used for device authentication and certificate requests using protocols such as SCEP, EST, and CMPv2.
In the Device Trust Manager menu, go to Authentication management > Passcodes.
Select Create passcode.
Enter a Name and, optionally, a description.
Under Assign or create an authentication policy, choose the policy created in Step 2: Create an authentication policy.
If necessary, configure additional passcode settings for authentication, usage restrictions, and so on.
Select Create passcode to save.
Creating a certificate management policy involves adding a Certificate template, creating a Certificate profile, and proceeding to create a Certificate management policy through the Certificate settings wizard.
Dica
You will be creating a bootstrap as well as an operational certificate policy that your devices need to onboard and operate. It is recommended to perform the same settings that have been provided in the following steps.
Create a policy for bootstrap certificates
In the Device Trust Manager menu, go to Certificate management > Certificate settings > Certificate templates.
Select Create.
Select the existing Basic TLS Certificate Template.
Dica
As you’re setting up the Device Trust Manager for the first time, this topic helps you get started quickly. To keep things simple, we recommend choosing the
Basic TLS Certificate Template, which has been created and customized for you.Aviso
Certificate templates are created and customized for your organization by DigiCert®. If no certificate templates appear on the Certificate templates page, or if you require modifications or a new template, contact you DigiCert® account representative.
When done, proceed to select Create certificate profile to create a certificate profile.
Under Configure certificate profile section, enter a Name for the certificate profile.
Select if All divisions can use this certificate profile or only Specific divisions.
Select Next to proceed to Advanced certificate profile settings.
Under the Subject and SAN fields, configure fields as needed.
For example, you could enable the Common Name, set it as Required, and specify a default value.
When done, select Next to proceed to the Review and confirm section.
Verify the summary of the certificate profile settings you have selected.
When done, chose Create and select to create the certificate profile and proceed to the Certificate management policy creation section.
Enter a Name for the certificate management policy.
Choose the Division you created in Step 1 to assign this certificate management policy.
Under the Certificate management model, select Policy will be used for secure device lifecycle management. Requires an Advanced license.
Under the Certificate management methods,, select Single certificate request through portal and REST API and register a single device.
Dica
As you’re setting up the Device Trust Manager for the first time, this topic helps you get started quickly. To keep things simple, we recommend choosing the above two parameters.
When done, select Next.
Verify the summary of the certificate management policy settings you selected.
Select an Issuing CA.
Under the Keypair generation settings, select Server-side keypair generation.
DigiCert® generates keypair for certificate issuance. When selecting this option, specify the default key type and size, such as
RSA 2048orP-256.When done, select Next.
Select Create certificate management policy to create a bootstrap certificate management policy.
Create a policy for operational certificates
In the Device Trust Manager menu, go to Certificate management > Certificate settings > Certificate templates.
Select Create.
Select the existing Basic TLS Certificate Template.
Select the Certificate profile you created in Step 4, and proceed to the Certificate management policy creation section to create an operational certificate management policy.
On the General settings section, enter a Name for the operational certificate policy.
Choose the Division you created in Step 1: Create a division to assign this certificate management policy.
Under the Certificate management model, select Policy will be used for secure device lifecycle management. Requires an Advanced license.
Under Certificate management methods, select DigiCert TrustEdge agent.
When done, select Next.
Verify the summary of the certificate management policy settings you selected.
Select an Issuing CA.
Under the Keypair generation settings, select Local keypair generation.
Dica
The requestor generates the keypair locally and includes the public key in their Certificate Signing Request (CSR). This is recommended for TrustEdge management-based operational certificates.
When done, select Next.
Under the Certificate management method settings page, expand the Manage certificates using the DigiCert TrustEdge Agent section:
Select the required Certificate request format from the dropdown menu.
Under Define how the agent will generate certificate values, expand the Add optional certificate attribute fields > select any of the certificate attribute fields. For example, Common name.
Select Use an expresssion evaluated by the TrustEdge agent to provide a certificate value and provide the required value.
For example, for MAC Address, provide this value
##mac_address##
Under Private key generation, select Client-side software.
When done, select Create certificate management policy to create an operational certificate management policy.
Review your progress
At this stage, Device Trust Manager is configured with divisions, authentication policies, and certificate management policies (bootstrap and operational certificates). You should now have:
A division created to organize devices and other entities
Authentication policies and passcodes are set up for secure access
Certificate profiles and management policies are defined for controlled certificate issuance
What’s next?
Continue to Part 3: Set up device management to create a device group and register your first device so you can begin managing devices in Device Trust Manager.