Page History

Indeed Certificate Manager can interact Axidian CertiFlow can work with Microsoft CA CAs that are beyond the boundaries located outside of the domain of Indeed CM server. Say, in a configuration, when an organization hosting the CertiFlow server.
This could be a scenario where a company has several independent domains with an independent CA separate CAs in each of them, and Indeed CM is deployed at only one of the domains. Meanwhile, the user accounts are the same in the domains.domain, with Axidian CertiFlow deployed only in one of those domains. 

When issuing a smart card, Axidian CertiFlow The IndeedCM.MSCA.Proxy component allows to request and write certificates to devices using Indeed CM from all CA that reside beyond the domain where Indeed CM is deployed. In this case, the MSCA Proxy address is added to the usage policy of Indeed CM devices. The said proxy is deployed in an external domain with user directory and certification authority. When issuing a device, the Indeed CM addresses the MSCA Proxy, and the latter Proxy sends the corresponding a request to the target certification authority CA using the Enrollment Agent certificate (which resides in the storage of a workstation with IndeedCM.MSCA.Proxy component installed). To . 

Follow these steps to install and configure the MSCA Proxy application, proceed as follows:

1. Create a service account to use with for Microsoft CA in an external domain (see Creating a service account for working with Microsoft CA).

2. Configure the Enrollment Agent certificate template for the

   account created in the previous step (see Settings of certificate templates to use with Indeed CM) and issue a certificate for the account using this template (see Issuing the Enrollment Agent certificate)

   service account and issue the certificate.

   Warning
   The Enrollment Agent certificate

1. must reside in the certificate storage of a workstation (

1. local computer) with

1. CertiFlow.MSCA.Proxy component installed.

1. 
   

2. Install the

1. CertiFlow.MSCA.Proxy.msi component

1. on a workstation running in

1. one domain with an external CA.

   Note
   System requirements for

1. Proxy installation are the same as

1. for Axidian CertiFlow server components.

1. 
   

2. Switch to C:\inetpub\wwwroot\mscaproxy folder and open Web.config file in Notepad as administrator.

1. Specify the

1. following settings in caProxySettings section:
   • CA name in the

1. • ca parameter

1. • .
   • Credentials of the account with Enrollment Agent certificate (userName and password)

1. • .

   • Thumbprint of the Enrollment Agent certificate in enrollmentAgentCertificateThumbprint parameter.

1. • Code Block
     language xml title Example

1. • <caProxySettings ca="

1. • servercm.external.com\EXTERNAL-CA"

1. • userName="EXTERNAL\extserviceca" password="p@ssw0rd" enrollmentAgentCertificateThumbprint="

1. • dbd1859d27395860843643ebe17e2ee3fc463aba"/>

1. • 
     

2. Specify the service account

1. for the CA in the allow users parameter of authorization section.

   Code Block
   language xml title Example

1. <authorization> <deny users="?" /> <allow users="EXTERNAL\extserviceca" /> <deny users="*" /> </authorization>

1. 
   

2. Save

1. your settings.