This article describes how to create a new Signing Authority (SA) in Smart ID Certificate Manager (CM). This task is done in the Administrator's workbench (AWB).  

Prerequisites

The following task requires MSO signatures to be completed. Both officers must have the following roles:

• Use AWB

• Signing Authority and SA Key tasks

A connection to the CM host must have been established. See Connect to a Certificate Manager host.

The following information is required by the CMO during the task:

• The SA name that will appear in the Authority Hierarchy in the explorer bar

• The name of the issuing CA

• SA key to be used for the certificate, see SA key tasks in Certificate Manager

• The signature algorithm

• The distribution rules applicable

• The applicable certificate format

Step-by-step instruction

Request SA

To create a SA request:

1. In AWB, select New > Authority.

2. In the Create Authority Request dialog, enter the SA name that should appear in the Authority Hierarchy in the explorer bar. This field is mandatory.

3. Set the SA State to Active or Closed as required.

4. Select Domain and check Visible in subdomain if applicable.

5. Select the Authority type SA.

6. Modify Valid from and Expiration date by selecting the days, hours, and minutes, and adjust the values with the up and down arrows. The date and time units may also be entered manually.

7. The SA is subordinate to a CA. This field is mandatory. Click the browse button to open the Select Authority window.

8. Click on the required CA to highlight it and click OK. The selected CA appears in the Issuing CA field.

9. In Key, click the browse button, select the required key and click OK.
   The selected key appears in the Key field. This field is mandatory.

10. If an RSA key was selected, select a Key algorithm.

11. Select a Signature algorithm. The drop-down list contains only those algorithms that matches the key algorithm for the key for the selected issuing SA.

12. If immediate publishing is wanted, do the following steps in Distribution rules, for each relevant distribution rule:

    1. Click on + to open the Select Distribution Rules window.

    2. Select the required distribution rule for the CA certificate from the list in the window and click OK.

13. When all the relevant distribution rules have been entered, edit the processing order of distribution rules if needed. To change the order, select a procedure and use the arrow buttons to move it up or down. The distribution rules will be processed in the order selected and then stored in CMDB.

14. In Format, click the browse button, select the required format and click OK.
    The selected certificate format appears in the Format field. This field is mandatory.

15. Once a format has been selected, you can customize the set of format definition fields and modules.

    1. At Format, click Advanced.

       1. A pop-up window will appear containing all fields and modules from the selected format file.

          • The modules are shown in the top section with their indexes in the right column (the indexes determine the execution order of the modules).

          • The format definition fields are shown in the bottom section with the values of the parameters in the right column. You can edit the values for the definition fields parameters and store them for this particular procedure.

            Here is an example with the certificate format rfc5280.

            Open

            

    2. To add new format definition fields or modules click Add Parameter or Add Module. For added fields and modules (that are not present in the format file) you can edit values in the left column and also remove the row with Remove Parameter or Remove Module.

    The new values will take precedence over the values in the format file, but the format file will not be affected by these changes.

16. Continue to set the certificate attributes.

Set certificate attributes

To set certificate attributes:

1. Select the required Country attribute.

2. Enter the Organization and Organizational Unit names.

3. In Common Name, enter a new SA name. The SA name will appear in the SA certificate.

4. If you want to change what certificate attributes to be displayed, do the following:

   1. Click Browse, to the right of the certificate attributes.

   2. Select which attributes to present and click OK.
      The attributes will be shown in the same order as they are listed in this dialog box.

      The Auto add data fields option is used to present all available fields of an existing certificate. It is not applicable in the Create SA Request dialog.

5. If Subject Information Access is displayed, do the following:

   For information concerning the subject information access extension, refer to RFC 5280 - Internet X.509 Public Key Infrastructure Certificate and CRL Profile.

   1. Click the + button associated with the Subject Information Access field to open the fields below.

   2. Enter the Access method OID to be used.

   3. Select either the URI or E-mail option button in the Access Location section and enter the required information.

   4. Click Finish.

   5. Click OK to close the dialog.

6. In Create Authority Request, click OK. The Signature dialog box appears. See Sign tasks in Certificate Manager for more information.

Additional information