Client Certificate Profile (TLS Sample)

Introduction

Slide Reference

Creating a Certificate Profile for TLS Client Certificates

1. Open a browser and access your Admin Web Portal

2. Click CA Functions >> Certificate Profiles

3. On ENDUSER click Clone

4. Enter TLSClientCertificateProfile and click Create from template

5. Click Edit on the profile TLSClientCertificateProfile

6. In the Available key algorithms list, select RSA

7. In the Available bit lengths list, select 2048 bits

8. In the Signature Algorithm list, select SHA256WithRSA

9. In the Validity field, enter 2y

10. For Key Usage make sure that only Digital Signature and Key Encipherment are selected

11. For Extended Key Usage select Client Authentication

12. In the Available CAs list, select ManagementCA and Sub CA

13. Click Save

Creating an End Entity Profile for TLS Client Certificates

1. Open a browser and access your Admin Web Portal

2. Click RA Functions >> End Entity Profiles

3. In the Add End Entity Profile field, enter TLSClientEndEntityProfile and click Add Profile

4. Select TLSClientEndEntityProfile and click Edit End Entity Profile

5. For End Entity E-mail deselect the check box

6. In the Subject DN Attributes list, select O, Organization and click Add

7. In the O, Organization field:

   • Enter the text PrimeKey Solutions AB

   • Select Required

   • Deselect Modifiable

8. In the Subject DN Attributes list, select C, Country (ISO 3166) and click Add

9. In the C, Country (ISO 3166) field:

   • Enter the text SE

   • Select Required

   • Deselect Modifiable

10. In the Default Certificate Profile list, select TLSClientCertificateProfile

11. In the Available Certificate Profiles list, select TLSClientCertificateProfile

12. In the Default CA list, select Sub CA

13. In the Available CAs list, select ManagementCA and Sub CA

14. In the Default Token list, select P12 file

15. In the Available Tokens list, select User Generated, P12 file, BCKFS file, JKS file, and PEM file

16. Click Save