Configuring a CA Policy for Digicert One CA

DigiCert One CA allows creation of certificate profiles using certain generic template ids which are eventually used during enrollment.

  1. Go to (Menu) > CERT+ > GROUPS & POLICIES > CA Policy.
    The CA Policy page is displayed.
  2. Click + Create from the top-right corner of the page.
    The CA Policy :: Create page is displayed.
  3. Refer the Configuring Policy Details section to configure the following:
    • Policy Details
    • Group Selection
    • Compliance Check
  4. In the CA Details section, from the Certificate Authority list in the left, select DigiCert One.
    The CA Details section is updated to display fields relevant to DigiCert.
  5. Enter the policy details for DigiCert One.
    Table 1. Field description for CA details
    Fields Description
    *CA Accounts From the dropdown list, select an existing CA account for which this policy is to be created.
    *Certificate Profiles From the dropdown list, select a certificate profiles.

    Certificate profiles are created in the DigiCert One instance and provide you with the list of fields that are mandatory for certificate issuance and also other configured settings that have static values or allow multiple values.

    Values in the dropdown lists for the subsequent fields will be populated based on what is specified in the selected certificate profile.
    *Validity Using the Days, Months, and Years dropdown lists, select a validity period for the certificate.

    Days: You can enter more than one validity period in days, to choose one in certificate enrolment.

    Months - You can enter more than one validity period in Months, to choose one in certificate enrolment. Year - You can enter more than one validity period in Year, to choose one in certificate enrolment.

    Year - You can enter more than one validity period in Year, to choose one in certificate enrolment.

    These dropdown lists are populated according to the certificate profile selected.
    *Bit Length - Key Type From the *Bit Length - Key Type dropdown list, select the required bit length- key type pair(s).

    The discovered certificate's Key Type and Bit length will be compared against the selected bit length- key type pair(s) to check for compliance with the policy. The selected bit length- key type pair(s) is enforced while performing any certificate request operations such as Enroll, Renew, Regenerate.
    *Hash Function From the *Hash Function dropdown list, select one (or more) hash functions.

    The discovered certificate's Key Hash Algorithm will be compared against the selected hash function to check for compliance with the policy. The selected hash function(s) is enforced while performing any certificate request operations such as Enroll, Renew, Regenerate.
    *: Mandatory fields
  6. Click Add.
    The CA details are added to the table below the Add button and a confirmation message is displayed.
    Note: You can use the Edit option in the table to modify the configuration and the Remove option to delete the configuration.
  7. Based on your organization's policies and standards, enter values for the Certificate Parameters.
    Table 2. Field description for certificate parameters
    Fields Description
    Restrict Wild Card Certificate Slide toggle switch to the ON position to restrict the creation of wild card certificates using the policy.
    Host name Enter the host name.

    The host name cannot start and end with a . (period)
    Allowed Domain Names Enter only the whitelisted domain names.

    Press enter after adding the domain name. Multiple domain names can be added.
    Common Name Enter the common name. For example, *.domain.com

    This enforces domains for which a certificate can be requested. The common name is enforced at the time of performing any certificate request operations such as New, Renew, and Regenerate.

    Note: Use the * (asterisk) for the host part of the FQDN to enforce the domain. For example, *.domain.com will only allow users to request certificates with domain.com. Allowed special characters: *(Asterisk), - (hyphen), . (period).
    Organization Enter the organization name.

    The discovered certificate's subject organization will be compared against the organization provided in the policy to check for compliance. The organization is enforced at the time of performing any certificate request operations such as New, Renew, and Regenerate.
    Organization Unit Enter the organization unit. The discovered certificate's Subject Organization Unit will be compared against the organization unit provided in the policy to check for compliance. Organization Unit is enforced at the time of performing any certificate request operations such as New, Renew, and Regenerate.
    Locality Enter the locality name.

    The discovered certificate's locality will be compared against locality provided in the policy to check for compliance. The locality is enforced at the time of performing any certificate request operations such as New, Renew, and Regenerate.
    State Enter the state.

    The discovered certificate's state will be compared against the state provided in the policy to check for compliance. The state is enforced at the time of performing any certificate request operations such as New, Renew, and Regenerate.
    Country code Enter the country code.

    The discovered certificate's country code will be compared against the country code provided in the policy to check for compliance. Country code is enforced at the time of performing any certificate request operations such as New, Renew, and Regenerate.
    Email Enter the email address of the organization unit.

    The discovered certificate's email address will be compared against the email address provided in the policy to check for compliance. The email address is enforced at the time of performing any certificate request operations such as New, Renew, and Regenerate.
    Subject Alternative Name Enter the subject alternative name (SAN). It helps enforce additional domains for which a certificate can be requested. The SAN is enforced at the time of performing any certificate request operations such as New, Renew, and Regenerate.
    Note: Use the * (asterisk) for the host part of the FQDN to enforce the domain. For example, *.domain.com will only allow users to request certificates with domain.com. Allowed special characters: *(Asterisk), - (hyphen), . (period)
    *: Mandatory fields
  8. Click Save CA Details to save the configuration.
    A green tick mark is displayed in the Certificate Authority list against Digicert One to indicate that the details are successfully stored.
  9. From the Group selection section, select one or more groups to map to the policy.
  10. From the Compliance Check section, to perform an immediate compliance check, enable Perform Compliance check.
    Note: A scheduled compliance check will run periodically based on the settings defined in the job scheduler.
  11. Click Create Policy to create a new policy.
    The policy is created and a confirmation message is displayed.