The following requirements must be met for Sectigo S/MIME enrollment and renewal.
Sectigo organization
The Sectigo organization must have the following custom fields defined:
- firstName
- lastName
After adding these fields:
- Redeploy CA Gateway
- Refresh the authority profile list in Certificate Manager
CA Gateway profile type
The profile defined in CA Gateway for S/MIME enrollment must be a static profile created from the Management Console, not one synchronized as explained in Sectigo CA profile synchronization.
When enrolling or renewing a certificate, select the static profile instead of the synchronized entry for the same S/MIME Sectigo profile.
TLS/SSL profiles can continue to use synchronized profiles.
CA Gateway profile name
When Creating a certificate, Certificate Manager displays a list of the profiles supported by the selected authority. Each profile name is displayed in the following format:
<name> (ID: <key>)Where:
<name>is the value of the profile Name field.<key>is the value of the Choose a key name field.
For the users to select a static profile instead of a synchronized one:
- Set Choose a key name to a non-numeric identifier, for example "sectigo-smime-ov", so that it does not collide with the numeric identifiers of the synchronized profiles.
- Set Name to a descriptive value that differs from the Sectigo profile name, for example "Sectigo S/MIME OV".
CA Gateway profile properties
Under the Sectigo CA Profile properties of the static profile:
- Add a terms field as explained in Configuring Sectigo CA profile properties
- Set Certificate Type to the numeric profile identifier of the Sectigo S/MIME profile