• About this guide
  • Overview
    • Certificate Authorities overview
    • Certificate Enrollment Gateway overview
    • CA Gateway overview
    • Certificate Hub overview
    • Timestamping Authority overview
    • Entrust Validation Authority overview
  • Release notes
    • Common known issues
    • Management Console known issues
    • Certificate Authorities known issues
    • CA Gateway known issues
    • Certificate Enrollment Gateway known issues
    • Certificate Hub known issues
    • Entrust Validation Authority known issues
    • Timestamping Authority known issues
  • Requirements
    • Machine requirements
      • Recommended number of nodes
      • Disk requirements
      • Memory and CPU requirements
    • Network requirements
      • DNS requirements
      • IP address requirements
      • Load balancing requirements
      • Required open ports
      • Reserved subnets
    • Software requirements
      • Database requirements
      • SIEM requirements
      • Web browser requirements
    • HSM requirements
  • Starting up PKI Hub
    • Downloading the Entrust PKI Hub image
    • Verifying the downloaded files
    • Installing the Entrust PKI Hub image
      • Installing the PKI Hub ISO image on an HCI
        • Installing the Entrust PKI Hub ISO image on VMware vSphere
          • Creating an Entrust PKI Hub virtual machine on VMware vSphere
          • Configuring the boot mode on VMware vSphere
          • Logging into Entrust PKI Hub on a VMware vSphere machine
        • Installing the Entrust PKI Hub ISO image on Microsoft Hyper-V
          • Creating an Entrust PKI Hub virtual machine on Hyper-V
          • Configuring an Entrust PKI Hub virtual machine on Hyper-V
          • Configuring the boot mode on Microsoft Hyper-V
          • Starting an Entrust PKI Hub machine on Hyper-V
        • Installing the Entrust PKI Hub ISO image on Nutanix
          • Uploading the Entrust PKI Hub image to Nutanix
            • Uploading the Entrust PKI Hub ISO image with Nutanix Prism Element
            • Uploading the Entrust PKI Hub image file with Nutanix Prism Central
            • Importing the Entrust PKI Hub image to Nutanix Prism Central
          • Creating an Entrust PKI Hub virtual machine on Nutanix
            • Creating a PKI Hub virtual machine with Nutanix Prism Element
            • Creating a cluster of Entrust PKI Hub virtual machines with Nutanix Prism Center
          • Configuring the boot mode on Nutanix
        • Configuring a PKI Hub ISO image installation
          • Configuring the connection of a PKI Hub ISO installation
          • Configuring the hostname of a PKI Hub ISO installation
          • Checking the connection of a PKI Hub ISO installation
      • Installing the Entrust PKI Hub RAW image on AWS
        • Creating an S3 bucket
        • Uploading the RAW image
        • Configuring the IAM policy
          • Creating a new IAM policy
          • Updating an existing IAM policy
        • Creating an IAM role
        • Creating the snapshot configuration file
        • Preparing the command-line interface
        • Importing the snapshot
        • Creating an AMI from the snapshot
        • Creating the EC2 instance
        • Opening a session into AWS
        • Configuring the hostname on AWS
      • Installing the Entrust PKI Hub VHD image on Azure
        • Creating the Azure storage account
        • Uploading the VHD image file to Azure
        • Creating the Azure image
          • Creating the Azure image with Azure Portal
          • Creating the Azure image with Azure CLI
        • Creating the Azure network rules
        • Creating the SSH key for Azure
        • Creating the Azure virtual machine
          • Creating the Azure virtual machine with Azure Portal
          • Creating the Azure virtual machine with Azure CLI
        • Opening a session into Azure
        • Configuring the hostname on Azure
    • Running clusterctl install
    • Replacing the default TLS certificate
    • Configuring the proxy
    • Changing the keyboard layout
    • Changing the operating system timezone
    • Configuring time synchronization
    • Manually starting starting the chrony service
    • Configuring an nShield HSM
  • Starting up the Management Console
    • Replacing the initial admin password
    • Setting or updating the license
    • Creating Management Console roles
    • Creating Management Console users
    • Integrating Identity providers
      • Entrust Identity as a Service (IDaaS)
      • Internal password
      • Lightweight Directory Access Protocol
      • OpenID Connect 1.0
  • Managing solutions
    • Managing the Certificate Authorities solution
      • Preparing the Certificate Authorities deployment
        • Creating the Certificate Authorities database
        • Verifying port access for Certificate Authorities
      • Configuring and deploying Certificate Authorities
        • Database
        • HSM
        • General
      • Creating Certificate Authority tenants
      • Creating Certificate Authority organizations
      • Creating Certificate Authority instances
        • Creating a root Certificate Authority
        • Adding an external root Certificate Authority
        • Creating an issuing Certificate Authority
      • Issuing certificates with Certificate Authority instances
        • Issuing certificates with a REST client
        • Issuing certificates with Certificate Hub
      • Changing the HSM vendor
    • Managing the CA Gateway solution
      • Preparing the CA Gateway deployment
        • Verifying port access for CA Gateway
        • Obtaining the CA Gateway server certificate
      • Integrating Certificate Authorities with CA Gateway
        • Integrating a Microsoft CA
          • Setting up the Entrust Proxy for Microsoft CA
            • Installing the Entrust Proxy for Microsoft CA
            • Issuing the SSL certificates
            • Generating a client keystore for CA Gateway
            • Generating a truststore for CA Gateway
            • Generating the server keystore of the Entrust Proxy for Microsoft CA
            • Running the Entrust Proxy for Microsoft CA
          • Integrating a Microsoft CA with the Entrust Proxy
            • Adding Microsoft Management Console snap-ins
            • Creating a client authentication template for Microsoft CA
            • Creating the CA enrollment agents
            • Creating the RA recovery agents
            • Creating the RA enrollment agents
              • Creating RA enrollment agent credentials in a keystore file
              • Creating RA enrollment agent credentials in a PKCS#11 HSM
            • Enabling supply in the request
            • Configuring Request Handling in the Microsoft CA
            • Enabling SAN attributes in the enrollment request
        • Integrating an AWS CA
          • Installing and configuring the AWS CA plugin
          • Handling certificate events with DynamoDb
        • Integrating an ECS CA
          • Issuing the SSL certificate
          • Creating the API username and key
          • Adding tracking information to the certificate requests
        • Integrating an Entrust Certificate Authority
          • Enabling TLS 1.0 and TLS 1.1
          • Creating a certificate type for the administrator profile
          • Creating a new certificate definition policy for the certificate type
          • Mapping the certificate definition policy to the certificate type
          • Creating a client policy for the administrator profile
          • Creating a role for the administrator profile
          • Creating a user entry for the administrator profile
          • Creating the administrator profile
      • Configuring and deploying CA Gateway
        • Logging
          • CAGW Logging
          • JTK Logging
          • JSSE Logging
        • Server
        • Connector filters
          • Name
          • Connector name
          • Filter Settings
            • check-domains-external-to-cs
            • check-domains-from-csr
            • connection-timeout-millis
            • ct-policy-json
            • dns-server<.i>.<setting>
            • issuer-string
            • log-server.<i>.<setting>
            • proxy-host-name
            • proxy-port
            • socket-timeout-millis
        • Authorities
          • Minimum keysize
          • Authority settings
            • Choose a key name
            • Name
            • Issuer DN
            • Minimum keysize
            • Connector Name
              • com.entrust.ECS
                • ECS URL
                • User Name
                • API Key
                • Enrollment Agent PKCS#12 File
                • Enrollment Agent PKCS#12 Password
                • CA Certificate
                • CA Certificate Chain
                • Client ID defined in ECS for all domain operations
                • Proxy Hostname
                • Proxy Port
                • Proxy username
                • Proxy password
                • Additional ECS Properties
                  • api-key
                  • ca.cert
                  • ca.certchain.<i>
                  • client-id-domains
                  • ecs-url
                  • enrollment-agent-p12
                  • enrollment-agent-p12-password
                  • proxy-host-name
                  • proxy-password
                  • proxy-port
                  • proxy-username
                  • rdn-corrections.<i>.rep
                  • rdn-corrections.<i>.rep-with
                  • user-name
              • com.entrust.MicrosoftCA
                • CA Proxy URL
                • CA Host
                • CA Name
                • LDAP Port
                • LDAPS Port
                • LDAP Host
                • Key Recovery Agent PKCS#12
                • Key Recovery Agent PKCS#12 Password
                • Client Certificate Key Alias
                • Client Certificate Keystore Type
                • Client Certificate Keystore File
                • Client Certificate Keystore Password
                • SSL Truststore Type
                • SSL Truststore File
                • SSL Truststore Password
                • Additional Microsoft CA Properties
                  • ca-host
                  • ca-name
                  • ca-proxy-url
                  • key-recovery-agent-p12-<i>
                  • key-recovery-agent-p12-password-<i>
                  • ldap-host
                  • ldap-port
                  • ldaps-port
                  • proxy-host-name
                  • proxy-password
                  • proxy-port
                  • proxy-ssl
                    • client-cert-key-alias
                    • client-cert-key-store
                    • client-cert-key-store-password
                    • client-cert-key-store-type
                    • ssl-trust-store
                    • ssl-trust-store-password
                    • ssl-trust-store-type
                  • proxy-username
              • com.entrust.SecurityManager
                • Security Manager Host
                • PKIX Port
                • LDAP Host
                • LDAP Port
                • LDAPS Port
                • LDAP Principal
                • LDAP Credential
                • XAP Port
                • Admin EPF file
                • Admin EPF Password
                • Initial XAP Connections
                • Max XAP Connections
                • XAP Connection Idle Timer (seconds)
                • XAP Connection Socket Timer (seconds)
                • XAP Logging
                • XAP Logs Level
                • P11 APF File
                • P11 Library
                • P11 Slot
                • P11 Password
                • Enable niche certificate types
                • Allow 100% PKUP
                • Enable CA Profile Sync
        • Profiles
          • Choose a key name
          • Name
          • Copy CN in SubjectDN to SAN
          • Subject Variable Requirements
          • Subject Builder Configuration
            • Name
              • com.entrust.adminservices.cagw.common.subjects.BasicSubjectBuilder
              • com.entrust.adminservices.cagw.common.subjects.SubAltNameSubjectBuilder
              • com.entrust.adminservices.cagw.common.subjects.TemplateSubjectBuilder
            • Properties
              • Template
              • SAN type order
          • SAN Requirements
          • Minimum keysize
          • ECS Profile Properties
            • Certificate Type
            • Certificate lifetime
            • Client ID
          • Microsoft CA Profile Properties
            • Certificate Template
            • RA Enroll Key Store Provider Config
            • RA Enroll Key Store Provider
            • RA Enroll Key Store
            • RA Enroll Key Store Type
            • RA Enroll Key Store Password
            • RA Enroll Key Alias
            • RA Enroll Key Password
            • Client Key Generation mode
          • Security Manager Profile Properties
            • Certificate Type
            • Certificate Definition
            • LDAP entry creation mode
            • LDAP directory mode
            • User Role
            • User Type
        • Tenants
          • Tenants
          • Integrators
        • Clients
        • Cmpv2
          • Truststore
          • Alias
          • Customization
          • Shared Secret
            • DN of the node sending the message
            • Passcode
          • Caching of in-progress CMPv2 transactions
        • TLS CRL-settings
      • Issuing public trust certificates with CA Gateway
        • CA Authorization
        • Certificate Transparency
      • Administrating CA Gateway
        • Checking CA Gateway error codes
        • Checking the CA Gateway health
        • Checking the health of a CA
      • CA Gateway endpoints
        • diskSpace
        • docs
        • health
        • ping
        • prometheus
        • properties
        • status
        • swagger-ui
        • v1
      • CA Capabilities reference
        • CA management capabilities
        • Certificate enrollment capabilities
        • Certificate management capabilities
        • Certificate search capabilities
    • Managing the Certificate Enrollment Gateway solution
      • Preparing to deploy Certificate Enrollment Gateway
        • Verifying port access for Certificate Enrollment Gateway
        • Configuring an on-premises Entrust Certificate Authority for Certificate Enrollment Gateway
          • Configuring an on-premises Entrust Certificate Authority for ACMEv2 enrollment
            • Adding certificate types to Entrust Certificate Authority for ACMEv2 enrollment
            • Mapping certificate definition policies to the ACMEv2 certificate types
          • Configuring an on-premises Entrust Certificate Authority for MDM-SCEP enrollment
            • Configuring Entrust Certificate Authority to allow server-generated keys for MDM-SCEP enrollment
            • Adding certificate types to Entrust Certificate Authority for MDM-SCEP enrollment
            • Mapping certificate definition policies to the MDM-SCEP certificate types
          • Configuring an on-premises Entrust Certificate Authority for MDMWS enrollment
            • Configuring Entrust Certificate Authority to allow server-generated keys for MDMWS enrollment
            • Creating a client policy and role for MDMWS P12 enrollments
            • Adding certificate types to Entrust Certificate Authority for MDMWS P12 enrollment
            • Creating certificate definition policies for MDMWS P12 certificate types
            • Mapping certificate definition policies to the MDMWS P12 certificate types
          • Configuring an on-premises Entrust Certificate Authority for SCEP or Intune-SCEP enrollment
            • Adding certificate types to Entrust Certificate Authority for SCEP and Intune-SCEP enrollment
            • Mapping certificate definition policies to the SCEP certificate types
          • Configuring an on-premises Entrust Certificate Authority for WSTEP enrollment
            • Configuring certificates issued by Entrust Certificate Authority for WSTEP enrollment
            • Adding certificate types to Entrust Certificate Authority for WSTEP enrollment
            • Mapping certificate definition policies to the WSTEP certificate types
        • Deploying Entrust CA Gateway for an on-premises CA
          • Issuing a client credential for Certificate Enrollment Gateway
          • Generating a file containing the CA certificate chain for the CA Gateway server certificate
          • Defining profiles in CA Gateway for issuing RA certificates
          • Defining a profile in CA Gateway for TLS bootstrapping
          • Configuring CA Gateway for ACMEv2 enrollment
          • Configuring CA Gateway for MDM-SCEP enrollment
          • Configuring CA Gateway for MDMWS P12 enrollment
          • Configuring CA Gateway for SCEP and Intune-SCEP enrollment
          • Configuring CA Gateway for WSTEP enrollment
      • Issuing TLS certificates for Certificate Enrollment Gateway
        • Creating a CSR for the Certificate Enrollment Gateway certificate
        • Issuing TLS certificates with Entrust PKI as a Service
          • Processing the CSR with Entrust PKI as a Service
          • Downloading the CA certificate chain from Entrust PKI as a Service
        • Issuing TLS certificates with an on-premises CA
          • Creating or recovering a user account in an on-premises CA
          • Processing the CSR with an on-premises CA
          • Obtaining the CA certificate chain
        • Building a TLS certificate chain for the Certificate Enrollment Gateway certificate
        • Installing the Certificate Enrollment Gateway certificate chain into Entrust PKI Hub 1.0
      • Configuring and deploying Certificate Enrollment Gateway
        • Tenants
          • CEG Tenant Unique ID
          • CEG Web Admin Username
          • CEG Web Admin Password
        • CAGW
          • CA Gateway URL
          • CAGW Keystore File (P12)
          • CAGW Keystore Password
          • CAGW Keystore Alias
          • Trusted CA Certificates File Format
          • RA Certificate Profile IDs
        • ACMEv2
          • Enable ACMEv2
          • ACMEv2 Order Expiry Interval
          • Delete Expired Order Cron Job
          • Delete Expired Authorizations Cron Job
          • ACMEv2 DNS-01 Nameservers
          • ACMEv2 DNS-01 Query Timeout
          • ACMEv2 HTTP-01 Retry Count
          • ACMEv2 HTTP-01 Retry Interval
          • ACMEv2 HTTP-01 Redirect on POST
        • MDMWS
          • Enable MDMWS
          • MDM-SCEP Token Expire Lifetime
          • MDMWS Expired Token Clean-up Cron Job
          • MDMWS Users
          • MDMWS Enrollment Service Configuration
        • Intune
          • Enable InTune-SCEP
          • InTune Revocation Cron Job
          • InTune-SCEP Enrollment Service Configurations
            • CAGW CA ID
            • Azure Application ID
            • Azure Tenant
            • Azure Authentication Method
            • Override Default InTune Endpoints
        • SCEP
          • Enable SCEP
          • SCEP Enrollment Service Configurations
            • CAGW CA ID
            • SCEP Challenge Password
            • Insecure SCEP (Permit an empty challenge password)
            • Revoke Old Certificate on Renewal
        • WSTEP
          • Enable WSTEP
          • WSTEP CAGW Settings
            • CAGW CA ID
            • Parent DN
            • CAGW Profile ID for Digital Signature
            • CAGW Profile ID for Key Encipherment
            • CAGW Profile ID for Digital Signature and Key Encipherment
            • CAGW Profile ID for Digital Signature and Nonrepudiation
            • Certificate Templates
          • Active Directory Domains
            • Domain Name
            • Computer Name
            • Enable WSTEP Kerberos Authentication for WSTEP Enrollment
            • Authentication Type for LDAP and Global Catalog Connections
              • LDAP Connection Settings
              • Kerberos LDAP Referrals
      • Enrollment URLs for Certificate Enrollment Gateway
        • ACMEv2 enrollment URL
        • Intune-SCEP enrollment URL
        • MDM-SCEP enrollment URL
        • MDMWS enrollment URL
        • SCEP enrollment URL
        • WSTEP enrollment URL
      • Integrating Certificate Enrollment Gateway
        • Integrating ACMEv2 clients with Certificate Enrollment Gateway
          • Configuring Certificate Enrollment Gateway for ACMEv2 enrollment
          • Configuring ACMEv2 clients for enrollment with Certificate Enrollment Gateway
            • About CSRs with an empty Subject DN
            • Supported validation methods
            • Adding the CA certificate chain to the ACMEv2 client
            • Supported algorithms for CSRs
            • Enrollment URL for ACMEv2 clients
          • ACMEv2 client examples
            • Certbot example
              • Preparing to use Certbot
              • Using Certbot to request a certificate
            • Win-acme example
            • acme.sh example
            • Cert-manager.io example
              • Cert-manager.io prerequisites
              • Preparing Linux for HTTPS (optional)
              • Deploying Kubernetes and Cert-manager.io
              • Configuring Cert-manager.io for Certificate Enrollment Gateway with ACMEv2
        • Integrating Microsoft Intune with Certificate Enrollment Gateway
          • How Certificate Enrollment Gateway works with Microsoft Intune
          • Configuring Microsoft Intune for Certificate Enrollment Gateway
            • Registering an application for Certificate Enrollment Gateway
            • Generating a client secret for password-based authentication with Certificate Enrollment Gateway
            • Generating and importing a TLS certificate for certificate-based authentication with Certificate Enrollment Gateway
            • Adding API permissions to the CEG Service application
            • Adding CAs to Microsoft Intune as trusted third-party CAs
            • Configuring identity protection profiles for Windows Hello for Business
            • Configuring SCEP certificate profiles
            • Obtaining information required to configure Certificate Enrollment Gateway for Microsoft Intune
          • Configuring Certificate Enrollment Gateway for Microsoft Intune
          • Updating the client secret (application key) used by the integration
        • Integrating SCEP clients with Certificate Enrollment Gateway
          • Configuring Certificate Enrollment Gateway for SCEP enrollment
          • Configuring SCEP clients for enrollment with Certificate Enrollment Gateway
          • SCEP client examples
            • Google ChromeOS example
              • ChromeOS integration requirements
              • Configuring Google Admin for SCEP enrollment
              • Downloading and installing the Google Cloud Certificate Connector
              • Testing SCEP enrollment with ChromeOS
              • Troubleshooting SCEP enrollments with ChromeOS
        • Integrating MDM and MDM-SCEP clients with Certificate Enrollment Gateway
          • Configuring a Mobile Device Management product for enrollment with Certificate Enrollment Gateway
            • Supported MDM authentication methods
            • Adding the CA certificate chain to the MDM product
            • Issuing a signing certificate to the MDM product
            • Enrollment URL for MDMWS clients
          • Configuring MDM-SCEP clients for enrollment with Certificate Enrollment Gateway
          • Configuring Certificate Enrollment Gateway for MDMWS and MDM-SCEP enrollment
        • Integrating WSTEP clients with Certificate Enrollment Gateway
          • WSTEP integration architecture
            • Enrollment clients
            • Certificate Enrollment Policy Web Service
            • Domain Controller
            • Cross-forest trust
            • Entrust Certificate Enrollment Gateway
            • Entrust CA Gateway
            • Certification Authority
          • Configuring the Windows domain for WSTEP enrollment
            • Active Directory schema requirements
            • Active Directory role requirements for running the Entrust-provided PowerShell scripts
            • Creating a service logon account for read-only access to Active Directory
            • Creating a Kerberos Service Account for Kerberos authentication
            • Configuring the Group Policy for cross-forest deployments
            • Adding referrals for cross-forest deployments
          • Creating Kerberos files for Certificate Enrollment Gateway
            • Creating a Kerberos keytab file for WSTEP enrollment
            • Creating a Kerberos configuration file for cross-forest WSTEP enrollment
          • Adding the Windows Certificate Templates to Active Directory
            • Adding the certificate templates feature using PowerShell
            • Adding the certificate templates feature using the Windows graphical interface
          • Creating Windows certificate templates for the Entrust WSTEP Service
            • Compatibility tab
            • General tab
            • Security tab
            • Request Handling tab
            • Cryptography tab
            • Key Attestation tab
            • Subject Name tab
            • Issuance Requirements tab
            • Extensions tab
          • Configuring Active Directory for secure LDAP (Optional)
            • Creating a CSR for an Active Directory server certificate
            • Installing the CA certificate chain for the Active Directory certificate
            • Issuing the Active Directory server certificate with Entrust PKI as a Service
            • Issuing the Active Directory server certificate with an on-premises CA
              • Creating or recovering a user account for the Active Directory server certificate
              • Processing the CSR for the Active Directory server certificate
            • Installing the Active Directory server certificate
            • Verifying LDAPS in Active Directory
          • Preparing to install the Certificate Enrollment Policy Web Service
            • Installing a server for the Certificate Enrollment Policy Web Service
            • Installing Microsoft Internet Information Services
          • Issuing TLS certificates for the Certificate Enrollment Policy Web Service
            • Creating a CSR for the Web server certificate
            • Issuing the Web server certificate with an on-premises CA
              • Creating or recovering a user account for the Web server certificate
              • Processing the CSR for the Web server certificate
            • Issuing the Web server certificate with Entrust PKI as a Service
            • Installing the Web server certificate into Microsoft IIS
            • Updating Microsoft IIS to use the Web server certificate
            • Installing the CA certificate chain for the Web server certificate
          • Installing and configuring the Certificate Enrollment Policy Web Service
            • Installing and configuring the CEP Web Service using a PowerShell script
            • Installing and configuring the CEP Web Service using the Windows graphical interface
              • Installing the CEP Web Service using the Windows graphical interface
              • Selecting the authentication mode of the CEP Web Service using the Windows graphical interface
              • Assigning a friendly name to the CEP Web Service using the Windows graphical interface
              • Assigning a unique Enrollment Policy Identifier
          • Adjusting the polling interval of the Certificate Enrollment Policy Web Service (Optional)
          • Creating an enrollment service in Active Directory using a PowerShell script
          • Editing an enrollment service in Active Directory using a PowerShell script
            • Updating the enrollment URLs for an enrollment service using a PowerShell script
            • Updating the security groups for an enrollment service using a PowerShell script
          • Editing an enrollment service in Active Directory using Windows tools
            • Building the Enrollment URL
            • Adding the enrollment URL to the enrollment service using the certutil utility
            • Changing the enrollment URL of the enrollment service using ADSI Edit
          • Removing an enrollment service from Active Directory using a PowerShell script
          • Adding certificate templates to the enrollment service
          • Configuring enrollment endpoints
            • Configuring Windows Domain Endpoints
              • Obtaining the URL of the Certificate Enrollment Policy Web Service
              • Importing the CA certificate into Windows domain endpoints
              • Configuring the Certificate Enrollment Policy Web Service for Windows domain endpoints
              • Configuring the Certificate Enrollment Policy Web Service for Windows users
              • Enabling certificate auto-enrollment for computers and domain controllers
              • Enabling certificate auto-enrollment for users
            • Configuring non-domain endpoints
              • Configuring the enrollment policy in non-domain endpoints
              • Importing the root CA certificate into non-domain endpoints
          • Configuring the TLS certificate of the Windows endpoints
            • Obtaining the CA certificates
            • Installing the CA certificates in the Active Directory domain
    • Managing the Certificate Hub solution
      • Preparing the Certificate Hub database
      • Configuring and deploying Certificate Hub
        • Certificate Hub Hostname
        • Discovery Scanner version
        • Initial Administrator Username
        • Initial Administrator Password
        • Initial Administrator Email
        • Name of the PostgreSQL Database
        • Database User Name
        • Database User Password
        • Host of the PostgreSQL database
        • External database port
        • SSLMode for the PostgreSQL external database
        • CA Certificate(s)
      • Managing certificates with the Certificate Hub console
        • Dashboard
        • Menu
          • Find
            • Browsing Discovery Scanners
            • Creating a Discovery Scanner
            • Editing a Discovery Scanner
            • Checking the Discovery Scanner connection
            • Configuring the scans of a Discovery Scanner
              • Creating the first scan configuration of a Discovery Scanner
              • Adding a scan configuration to a Discovery Scanner
              • Copying the scan configuration of a Discovery Scanner
              • Running a scan configuration
              • Deleting a scan configuration
            • Deleting Discovery Scanners
            • Endpoints
          • Control
            • CA Gateways
              • Browsing CA Gateways
              • Adding a CA Gateway
              • Editing a CA Gateway
              • Deleting CA Gateways
            • Authorities
              • Browsing authorities
              • Adding authorities
              • Editing an authority
              • Deleting authorities
            • Key Managers
              • Browsing key managers
              • Creating a key manager
                • F5-BIG-IP-KMS-Plugin
                • KMIP-KeyManagement-Plugin
              • Editing a key manager
              • Deleting key managers
            • Custom Fields
              • Browsing custom fields
              • Creating a custom field
              • Editing a custom field
              • Deleting custom fields
            • Public Enrollment Forms
              • Browsing public enrollment forms
              • Creating a public enrollment form
              • Editing a public enrollment form
              • Deleting public enrollment forms
              • Using public enrollment forms
            • Requests For Approval
              • Browsing pending requests
              • Approving a pending certificate request
              • Rejecting a pending certificate request
            • My Certificate Requests
              • Browsing my certificate requests
              • Issuing a PKCS #12
              • Making a certificate request
                • General
                • Destinations
                • Profile Options
                • Renewal
            • Certificates
              • Browsing certificates
              • Creating a certificate
                • General
                • Destinations
                • Profile Options
                • Renewal
              • Automating certificate renewal
                • Certificate Authority
                • Certificate Profile
                • Destinations
                • Renewal
              • Manually renewing a certificate
                • General
                • Destinations
                • Profile Options
                • Renewal
              • Requesting a certificate renewal
                • General
                • Destinations
                • Profile Options
                • Renewal
              • Editing a single certificate
              • Editing certificates in bulk
              • Revoking a certificate
              • Releasing a certificate from hold
              • Exporting a certificate
              • Importing certificates
              • Archiving certificates
            • Certificate History
              • Browsing the certificate history
              • Restoring archived certificates
            • Domains
              • Browsing domains
              • Registering a domain
              • Checking a domain status
              • Re-verifying a domain
          • Automate
            • Sources
              • Browsing sources
              • Creating a source
                • Azure-KeyVault-Source-Plugin
                • CAGW-Source-Plugin
                • F5-BIG-IP-Source-Plugin
              • Editing a source
              • Deleting sources
            • Destinations
              • Browsing destinations
              • Creating a destination
                • Creating a HashiCorp Vault destination
                • Creating a Microsoft IIS web server destination
                  • Microsoft IIS web server prerequisites
                  • Microsoft IIS web destination settings
                • Creating an Apache web server destination
                • Creating an AWS Certificate Manager destination
                  • AWS Certificate Manager prerequisites
                  • AWS Certificate Manager destination settings
                • Creating an Azure Key Vault destination
                  • Azure Key Vault prerequisites 
                  • Azure Key Vault destination settings
                • Creating an F5 BIG-IP destination
                • Creating an Nginx web server destination
                • Creating an SFTP destination
              • Editing a destination
              • Deleting destinations
            • Rules and Actions
              • Browsing rules
              • Creating a rule
              • Editing a rule
              • Deleting rules and actions
          • Report
            • Designer
              • Browsing reports
              • Creating a report
              • Editing a report
              • Designing a report
              • Updating a report design
              • Deleting reports
            • Report Schedules
              • Browsing report schedules
              • Creating a report schedule
              • Editing a report schedule
              • Deleting report schedules
            • History
              • Browsing generated reports
              • Deleting generated reports
              • Downloading generated reports
          • Administer
            • Administrators
              • Browsing administrators
              • Creating an administrator
              • Editing an administrator
              • Deleting administrators
            • Address Book
              • Browsing the address book
              • Creating an address
              • Importing addresses
              • Editing an address
              • Deleting addresses
            • Audit Log
              • Administration logs
              • Authentication and authorization logs
              • Automation logs
              • Certificate logs
              • Certificate policy logs
              • Control logs
              • Destination logs
              • Public form logs
              • Source logs
            • API Tokens
              • Browsing API tokens
              • Creating an API token
              • Deleting API tokens
            • Certificate Access Tags
              • Browsing certificate access tags
              • Creating a certificate access tag
              • Editing a certificate access tag
              • Deleting Certificate Access Tags
            • Roles
              • Browsing roles
                • <ca>_admin
                • <user_defined>
                • global_admin
                • Operator Role
                • renewal_daemon
              • Creating a role
                • Certificate Role
                • Custom Role
              • Editing a role
              • Deleting roles
            • Settings
              • General
              • Identity Provider
              • Reports
              • License
              • Plugins
        • Notifications
        • User options
      • Certificate Hub API
      • Certificate Hub error reference
        • Certificate Hub authentication and authorization errors
        • Certificate Hub administration errors
        • Certificate Hub automation errors
        • Certificate Hub control errors
        • Certificate Hub certificate errors
    • Managing the Timestamping Authority solution
      • Loading the HSM configuration on Timestamping Authority
      • Verifying port access for Timestamping Authority
      • Configuring Entrust Certificate Authority for Timestamping Authority
      • Generating a timestamping certificate and key pair
        • Generating a timestamping key pair
        • Issuing a timestaping certificate
          • Issuing a timestamping certificate with Entrust Certificate Authority
          • Issuing a timestamping certificate with the Certificate Authorities solution
      • Configuring and deploying Timestamping Authority
        • Hsm
          • Vendor
          • Token Label
          • HSM PIN
          • Number of sessions
        • Tsa Server
          • Read timeout
          • Write timeout
          • Idle timeout
          • Max header bytes
          • Max body bytes
          • Graceful timeout
          • Listen limit
          • Keep alive
        • Clock service
          • Maximum allowed error
          • Poll interval
          • Connection timeout
        • Tsa issuers
          • Issuer ID
          • Log timestamp response
          • TSA certificate
          • CA chain
          • TST profile
            • Accuracy
            • Allowed hash algorithms
            • Ordering
            • Policy ID
            • Qualified timestamp extension
            • Serial number length
            • Signature digest algorithm
      • Testing the timestamping service
      • Troubleshooting Timestamping Authority
    • Managing the Entrust Validation Authority solution
      • Loading the HSM configuration on Entrust Validation Authority
      • Initializing the Entrust Validation Authority database
        • Database Management System requirements for Entrust Validation Authority
        • Downloading the Entrust Validation Authority database scripts
        • Setting the variables of the Entrust Validation Authority database scripts
        • Running the Entrust Validation Authority database scripts
      • Configuring a certificate information source for Entrust Validation Authority
        • Certificate Revocation List
        • CA Gateway for Entrust Validation Authority
          • Generating the CA Gateway client certificate
          • Configuring the client certificate in CA Gateway
          • Importing the CA Gateway client certificate
      • Verifying port access for Entrust Validation Authority
      • Generating a VA certificate and key pair
        • Generating a VA key pair
        • Issuing a VA certificate
          • Issuing an OCSP responder VA certificate with Entrust Certificate Authority
          • Issuing an OCSP responder VA certificate with the Certificate Authorities solution
      • Configuring Entrust Certificate Authority for Entrust Validation Authority
        • Configuring the CA Gateway administrator role in Entrust Certificate Authority
        • Adding the OCSP Server certificate type to Entrust Certificate Authority
      • Configuring and deploying Entrust Validation Authority
        • Database
          • Connection timeout
          • Database name
          • Driver
          • Host
          • JDBC URL
          • Max connections
          • OCSP Responder password
          • OCSP Responder User
          • Port
          • SSL mode
          • SSL validation certificate
          • Status Feeder password
          • Status Feeder User
        • Hsm
          • Vendor
          • Token label
          • HSM PIN
          • Number of sessions
        • OCSP Responder-Server
          • Read timeout
          • Write timeout
          • Idle timeout
          • Max header bytes
          • Max body bytes
          • Graceful timeout
          • Listen limit
          • Keep alive
          • Response Profile ID
          • HTTP Error
        • LDAP Servers
          • Choose a key name
            • URL
            • Username
            • Password
        • Certificate Authorities
          • CA ID
          • Certificates Source
          • CA Gateway
            • URL
            • Wait to pull certs duration
            • Wait on error duration (WaitOnErrorDuration)
            • Batch Size
            • Timeout
            • TLS client certificate
            • TLS CA certificate
            • Push by serial
          • Certificate Revocation List
            • Wait to pull certs duration
            • Wait on error duration
            • CRL warning time
            • CRL Host Server
            • Use SN Lists
          • Certificate Revocation List in HTTP server
            • CRL HTTP URL
            • Connection timeout
          • Certificate Revocation list in LDAP server
            • LDAP Server ID
            • Connection timeout
            • CRL Entry Distinguished Name
            • CRL Attribute Name
          • Serial number list HTTP
            • Serial Number list URL
            • Connection timeout
          • OCSP Responder
            • Profile ID
            • CA certificate
            • VA certificate
      • Testing the OCSP Responder
        • Testing the OCSP Responder with openssl
        • Testing the OCSP Responder with the health check endpoint
      • Troubleshooting Entrust Validation Authority
    • Managing the log-forwarder solution
  • Browsing logs with Grafana
    • Browsing and exporting logs with the Grafana Loki Dashboard
    • Browsing log file contents with Grafana
      • Filtering Entrust Validation Authority logs
      • Filtering Timestamping Authority logs
  • Administrating
    • Adding nodes
    • Administrating nShield HSM integration
      • Applying nShield HSM configuration updates
      • Integrating a nShield TVD
    • Checking the etcd database size
    • Checking the persistent volume disk usage
    • Defragmenting the etcd database
    • Managing the retention policies
    • Recovering from disaster
    • Restarting the nodes
    • Updating DNS resolution
  • Backing up and restoring
    • Backing up
      • Backing up the PKI Hub state
      • Backing up solution settings
      • Backing up databases
      • Backing up the HSM
    • Restoring
      • Restoring the PKI Hub state
      • Restoring solution settings
      • Restoring databases
      • Restoring the HSM
  • Uninstalling
  • Command reference
    • clusterctl backup create
    • clusterctl backup restore
    • clusterctl certificate
    • clusterctl help
    • clusterctl install
    • clusterctl license import
    • clusterctl node add
    • clusterctl node info
    • clusterctl node join-token
    • clusterctl proxy clear
    • clusterctl proxy info
    • clusterctl proxy set
    • clusterctl retention config logs
    • clusterctl retention config metrics
    • clusterctl retention info
    • clusterctl solution config export
    • clusterctl solution config import
    • clusterctl solution deploy
    • clusterctl solution info
    • clusterctl solution secret set
    • clusterctl solution upload
    • clusterctl uninstall
    • clusterctl version
    • clusterctl volume capacity
    • clusterctl volume info
    • evactl check all
    • evactl check cert-source
    • evactl check db
    • evactl check hsm
    • evactl create-csr
    • evactl create-key
    • evactl delete-key
    • evactl enroll
    • evactl export-nshield
    • evactl import-nshield
    • evactl import-p12
    • evactl import-thales
    • evactl list-certs
    • evactl list-keys
    • evactl load-oracle-wallet
    • evactl reenroll
    • evactl stop
    • tsactl check clock
    • tsactl check hsm
    • tsactl create-csr
    • tsactl create-key
    • tsactl delete-key
    • tsactl export-nshield
    • tsactl import-nshield
    • tsactl import-thales
    • tsactl list-keys
    • tsactl stop
  • CIS benchmarks
    • Linux CIS benchmarks
    • Password policy CIS benchmarks
    • Kubernetes CIS benchmarks
  • Troubleshooting and technical assistance
  • Licensing
    • Customer license
    • Third-party license acknowledgments
  • Certificate profiles reference
    • Basic authority certificate profiles
    • External subordinate CA certificate profiles
      • Azure Firewall Intermediate CA certificate profiles
      • TLS Proxy CA certificate profiles
    • Subscriber certificate profiles
      • Active Directory (WSTEP) certificate profiles
      • CMPv2 certificate profiles
      • Code signing certificate profile
      • eSIM certificate profiles
      • EST certificate profiles
      • Intune certificate profiles
      • MDMWS certificate profiles
      • Mobile device certificate profile
      • Multiuse certificate profiles
      • Private SSL (ACMEv2) certificate profiles
      • S/MIME Secure Email certificate profiles
      • SCEP certificate profiles
      • Smartcard certificate profiles
      • V2G certificate profiles