Page History

Indeed Certificate Manager can interact Axidian CertiFlow can work with Microsoft CA CAs that are beyond the boundaries located outside of the domain of Indeed CM server. Say, in a configuration, when an organization hosting the CertiFlow server.
This could be a scenario where a company has several independent domains with an independent CA separate CAs in each of them, and Indeed CM is deployed at only one of the domains. Meanwhile, the user accounts are the same in the domains.domain, with Axidian CertiFlow deployed only in one of those domains. 

When issuing a smart card, Axidian CertiFlow The IndeedCM.MSCA.Proxy component allows to request and write certificates to cards using Indeed CM from all CA that reside beyond the domain where Indeed CM is deployed. In this case, the MSCA Proxy address is added to the usage policy of Indeed CM cards. The said proxy is deployed in an external domain with user directory and certification authority. When issuing a card, the Indeed CM addresses the MSCA Proxy, and the latter Proxy sends the corresponding a request to the target certification authority CA using the Enrollment Agent certificate (which resides in the storage of a workstation with IndeedCM.MSCA.Proxy component installed). To . 

Follow these steps to install and configure the MSCA Proxy application, proceed as follows:

1. Create a service account to use with for Microsoft CA in an external domain (see Creating a service account for working with Microsoft CA).

2. Configure the Enrollment Agent certificate template for the account created in the previous step (see Settings of certificate templates to use with Indeed CM) and issue a certificate for the account using this template (see Issuing the Enrollment Agent certificate)service account and issue the certificate.

   Warning
   The Enrollment Agent certificate has to must reside in the certificate storage of a workstation (Local local computer) with IndeedCM.MSCA.Proxy ProxyCHANGE component installed.

   
   

3. Install the IndeedCM.MSCA.Proxy.msimsiCHANGE component onto on a workstation running in a one domain with an external CA..

   Note
   System requirements for the component Proxy installation are the same as ones for installation of Indeed CM serverfor Axidian CertiFlow server components.

   
   

4. Switch to C:\inetpub\wwwroot\mscaproxy folder and open Web.config file in Notepad as administrator.
5. In Specify the following settings in caProxySettings section:
   • Specify the certification authority CA name in the ca parameter.
   • Specify credentials Credentials of the account with Enrollment Agent certificate (userName and password) with Enrollment Agent certificate.

   • Specify the Thumbprint of the Enrollment Agent certificate in the parameter  enrollmentAgentCertificateThumbprint parameter.

     Code Block
     language xml title Example of the section filled in:
     <caProxySettings ca="servercm.external.com\EXTERNAL-CA" userName="EXTERNAL\extserviceca" password="p@ssw0rd" enrollmentAgentCertificateThumbprint="dbd1859d27395860843643ebe17e2ee3fc463aba"/>

     
     

6. Specify the service account to use with certification authority for the CA in the allow users parameter of authorization section.

   Code Block
   language xml title Example of the section filled in:
   <authorization> <deny users="?" /> <allow users="EXTERNAL\extserviceca" /> <deny users="*" /> </authorization>

   
   

7. Save the changes your settings.