Microsoft Active Directory Certificate Services PKI

Prerequisites

ADCS Connector installation guide must be completed prior to the configuration of this connector.

1. Log in to Horizon Administration Interface.

2. Access PKI from the drawer or card: PKI > PKI Connectors.

3. Click on Add HTTP Proxy .

4. Select the correct PKI type.

5. Click on the next button

General tab

6. Fill in the common mandatory fields:

Connector Name* (string input):
Choose a meaningful connector name allowing to identify the mapping between the PKI and the Certificate Profile. It must be unique and must not contain spaces.
Proxy (string select):
If the PKI is not directly reachable from Horizon, you can set up an HTTP/HTTPS proxy to properly forward the traffic.
Queue PKI (string select):
The PKI Queue used to manage the PKI Requests (enrollment, revocation).
Timeout (finite duration):
Represents a predefined interval of time without a PKI response, when the time has passed "Horizon" will cease trying to establish the communication. Must be in valid finite duration.

7. Click on the next button

Details tab

8. Fill in all mandatory fields:

Endpoint* (string input):
URL to access the Web Enrollment ADCS component.
Active Directory Domain Netbios Name* (string input):
The Active Directory domain where to find the technical user and the ADCS server.
Profile* (string input):
It is recommended to duplicate default template, and grant the enrolment permissions to the created technical user. Example: Web Server
CA Config* (string input):
The CaConfig string, as given out by certutil -config for the considered ADCS CA. It’s usually in the form <ADCS Hostname>\<CA CommonName>

9. Click on the next button.

Authentication tab

10. Fill in the PKI-authentication fields:

Signer PKCS#12* (import):
Import the PKCS#12 file containing the signature certificate used to sign the CMP messages.
Sign certificate password* (string input):
Enter the password used to secure the aforementioned PKCS#12.
Technical account MSUPN* (string input):
Create a user that has certificate issuance, revocation and management permissions at CA level and for the relevant certificates template.
Technical account password* (string input):
Password associated with aforementioned defined user.

11. Click on the save button.

You can edit Edit PKI , duplicate Duplicate PKI or delete Delete PKI the Microsoft Active Directory Certificate Services PKI connector.