22.214.171.124. Certificate Token¶
Starting with version 2.3 privacyIDEA supports certificates. A user can
submit a certificate signing request (including an attestation certificate),
upload a certificate or
generate a certificate signing request within privacyIDEA.
privacyIDEA does not sign certificate signing requests itself but connects to existing certificate authorities. To do so, you need to define CA Connectors.
Certificates are attached to the user just like normal tokens. One token of type certificate always contains only one certificate.
If you have defined a CA connector you can upload a certificate signing request (CSR) via the Token Enroll Dialog in the WebUI.
You need to choose the CA connector. The certificate will be signed by the CA accordingly. Just like all other tokens the certificate token can be attached to a user.
126.96.36.199.1. Generating Signing Requests¶
You can also generate the signing request. The key pair and the request is generated on the server.
When generating the certificate signing request this way the RSA key pair is generated on the server and the private key is available on the server side. The user can later download a PKCS12/PFX file from the server.
The certificate is signed by the CA connected by the chosen CA connector.
Afterwards the user can install the certificate into the browser.
By requiring OTP authentication for the users to login to the WebUI (see login_mode) you can have two factor authentication required for the user to be allowed to enroll a certificate.
188.8.131.52.2. Pending certificate requests¶
When sending certificate requests the issuing of the certificate can be pending. This can happen with e.g. the Microsoft CA, when a CA manage approval is required. In this case the certificate token in privacyIDEA is marked in the rollout_state “pending”.
Using the Event Handler a user can be notified if a certificate request is pending. E.g. privacyIDEA can automatically send an email to the user.
184.108.40.206.2.1. Example event handler¶
To configure this, create a new post event handler on the event token_init with the User Notification Handler Module.
In the conditions set the rollout_state=pending and in the actions choose to send an email to the tokenowner. This way, after the token is enrolled and in the state pending, privacyIDEA will send the notification email.