You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docsource/configuration.md
+43-43Lines changed: 43 additions & 43 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,9 +1,9 @@
1
1
## Overview
2
2
3
-
The HID Global HydrantId AnyCA Gateway REST plugin extends the capabilities of HydrantId Certificate Authority Service to Keyfactor Command via the Keyfactor AnyCA Gateway. This plugin leverages the HydrantId REST API with Hawk authentication to provide comprehensive certificate lifecycle management. The plugin represents a fully featured AnyCA Plugin with the following capabilities:
3
+
The HID Global HID AnyCA Gateway REST plugin extends the capabilities of HID Certificate Authority Service to Keyfactor Command via the Keyfactor AnyCA Gateway. This plugin leverages the HID REST API with Hawk authentication to provide comprehensive certificate lifecycle management. The plugin represents a fully featured AnyCA Plugin with the following capabilities:
4
4
5
5
***CA Sync**:
6
-
* Download all certificates issued by the HydrantId CA
6
+
* Download all certificates issued by the HID CA
7
7
* Support for incremental and full synchronization
8
8
* Automatic extraction of end-entity certificates from PEM chains
9
9
***Certificate Enrollment**:
@@ -18,58 +18,58 @@ The HID Global HydrantId AnyCA Gateway REST plugin extends the capabilities of H
18
18
19
19
## Requirements
20
20
21
-
### HydrantId System Prerequisites
21
+
### HID System Prerequisites
22
22
23
23
Before configuring the AnyCA Gateway plugin, ensure the following prerequisites are met:
24
24
25
-
1.**HydrantId Account**:
26
-
- Active HydrantId account with API access enabled
27
-
- Access to the HydrantId management portal
28
-
-HydrantId Certificate Authority Service configured and operational
25
+
1.**HID Account**:
26
+
- Active HID account with API access enabled
27
+
- Access to the HID management portal
28
+
-HID Certificate Authority Service configured and operational
29
29
30
30
2.**API Credentials**:
31
-
-HydrantId API Authentication ID (AuthId)
32
-
-HydrantId API Authentication Key (AuthKey)
31
+
-HID API Authentication ID (AuthId)
32
+
-HID API Authentication Key (AuthKey)
33
33
- These credentials must have permissions for:
34
34
- Certificate enrollment (CSR submission)
35
35
- Certificate retrieval
36
36
- Certificate revocation
37
37
- Policy/profile listing
38
38
39
39
3.**Network Connectivity**:
40
-
- Gateway server must have HTTPS access to the HydrantId API endpoint
- Example: `https://acm-stage.HID.com` or `https://acm.HID.com`
43
43
- TLS 1.2 or higher must be supported
44
44
45
45
### Obtaining Required Configuration Information
46
46
47
-
#### 1. HydrantId Base URL
47
+
#### 1. HID Base URL
48
48
49
-
The HydrantId Base URL is the root endpoint for the HydrantId API.
49
+
The HID Base URL is the root endpoint for the HID API.
50
50
51
-
**Common HydrantId environments:**
52
-
- Production: `https://acm.hydrantid.com`
53
-
- Staging: `https://acm-stage.hydrantid.com`
51
+
**Common HID environments:**
52
+
- Production: `https://acm.HID.com`
53
+
- Staging: `https://acm-stage.HID.com`
54
54
- Custom instances may have different URLs
55
55
56
56
**To obtain your Base URL:**
57
-
1. Contact your HydrantId account representative
58
-
2. Check your HydrantId account documentation
57
+
1. Contact your HID account representative
58
+
2. Check your HID account documentation
59
59
3. Verify the URL is accessible from the Gateway server
60
60
61
61
#### 2. API Authentication Credentials
62
62
63
-
The Gateway authenticates to HydrantId using Hawk authentication protocol with an AuthId and AuthKey pair.
63
+
The Gateway authenticates to HID using Hawk authentication protocol with an AuthId and AuthKey pair.
64
64
65
65
**Steps to obtain API credentials:**
66
66
67
-
1.**Access HydrantId Portal**:
68
-
- Log in to your HydrantId management portal
67
+
1.**Access HID Portal**:
68
+
- Log in to your HID management portal
69
69
- Navigate to API or Integration settings
70
70
71
71
2.**Generate API Credentials**:
72
-
- Request API credentials from your HydrantId administrator
72
+
- Request API credentials from your HID administrator
73
73
- You will receive:
74
74
-**AuthId**: A unique identifier for your API client
75
75
-**AuthKey**: A secret key used for HMAC-based authentication
@@ -85,12 +85,12 @@ The Gateway authenticates to HydrantId using Hawk authentication protocol with a
85
85
86
86
#### 3. Certificate Policies
87
87
88
-
Certificate policies define the types of certificates that can be issued. The plugin automatically discovers available policies from the HydrantId system.
88
+
Certificate policies define the types of certificates that can be issued. The plugin automatically discovers available policies from the HID system.
89
89
90
90
**Policy discovery:**
91
91
- Policies are automatically retrieved when the CA is configured
92
92
- Policies appear in Keyfactor Command as "Product IDs" after CA registration
93
-
- Each policy represents a certificate template configured in HydrantId
93
+
- Each policy represents a certificate template configured in HID
94
94
95
95
**To view available policies:**
96
96
1. Policies are retrieved automatically using the GET /api/v2/policies endpoint
@@ -115,7 +115,7 @@ For each certificate template, you can configure:
115
115
116
116
The plugin supports the following standard CRL revocation reasons:
117
117
118
-
| Reason Code | Reason Name |HydrantId API Value |
@@ -124,13 +124,13 @@ The plugin supports the following standard CRL revocation reasons:
124
124
| 4 | Superseded |`Superseded`|
125
125
| 5 | Cessation of Operation |`CessationOfOperation`|
126
126
127
-
**Note**: Verify with your HydrantId administrator which revocation reasons are supported in your environment.
127
+
**Note**: Verify with your HID administrator which revocation reasons are supported in your environment.
128
128
129
129
## Installation
130
130
131
131
1. Install the AnyCA Gateway REST per the [official Keyfactor documentation](https://software.keyfactor.com/Guides/AnyCAGatewayREST/Content/AnyCAGatewayREST/InstallIntroduction.htm).
132
132
133
-
2. On the server hosting the AnyCA Gateway REST, download and unzip the latest [HID Global HydrantId AnyCA Gateway REST plugin](https://github.com/Keyfactor/hydrantid-caplugin/releases/latest) from GitHub.
133
+
2. On the server hosting the AnyCA Gateway REST, download and unzip the latest [HID Global HID AnyCA Gateway REST plugin](https://github.com/Keyfactor/HID-caplugin/releases/latest) from GitHub.
134
134
135
135
3. Copy the unzipped directory (usually called `net6.0` or `net8.0`) to the Extensions directory:
136
136
@@ -140,28 +140,28 @@ The plugin supports the following standard CRL revocation reasons:
140
140
Program Files\Keyfactor\AnyCA Gateway\AnyGatewayREST\net8.0\Extensions
141
141
```
142
142
143
-
> The directory containing the HID Global HydrantId AnyCA Gateway REST plugin DLLs (`net6.0` or `net8.0`) can be named anything, as long as it is unique within the `Extensions` directory.
143
+
> The directory containing the HID Global HID AnyCA Gateway REST plugin DLLs (`net6.0` or `net8.0`) can be named anything, as long as it is unique within the `Extensions` directory.
144
144
145
145
4. Restart the AnyCA Gateway REST service.
146
146
147
-
5. Navigate to the AnyCA Gateway REST portal and verify that the Gateway recognizes the HID Global HydrantId plugin by hovering over the ⓘ symbol to the right of the Gateway on the top left of the portal.
147
+
5. Navigate to the AnyCA Gateway REST portal and verify that the Gateway recognizes the HID Global HID plugin by hovering over the ⓘ symbol to the right of the Gateway on the top left of the portal.
148
148
149
149
## Gateway Registration
150
150
151
151
### CA Connection Configuration
152
152
153
-
When registering the HydrantId CA in the AnyCA Gateway, you'll need to provide the following configuration parameters:
153
+
When registering the HID CA in the AnyCA Gateway, you'll need to provide the following configuration parameters:
154
154
155
155
| Parameter | Description | Required | Example |
156
156
|-----------|-------------|----------|---------|
157
-
| **HydrantIdBaseUrl** | Full URL to the HydrantId API endpoint | Yes | `https://acm.hydrantid.com` or `https://acm-stage.hydrantid.com` |
158
-
| **HydrantIdAuthId** | API Authentication ID provided by HydrantId | Yes | `your-auth-id` |
159
-
| **HydrantIdAuthKey** | API Authentication Key provided by HydrantId | Yes | `your-secret-auth-key` |
157
+
| **HIDBaseUrl** | Full URL to the HID API endpoint | Yes | `https://acm.HID.com` or `https://acm-stage.HID.com` |
158
+
| **HIDAuthId** | API Authentication ID provided by HID | Yes | `your-auth-id` |
159
+
| **HIDAuthKey** | API Authentication Key provided by HID | Yes | `your-secret-auth-key` |
160
160
161
161
### Gateway Registration Notes
162
162
163
-
- Each defined Certificate Authority in the AnyCA Gateway REST can support one HydrantId API endpoint
164
-
- If you have multiple HydrantId environments or accounts, you must define multiple Certificate Authorities in the AnyCA Gateway
163
+
- Each defined Certificate Authority in the AnyCA Gateway REST can support one HID API endpoint
164
+
- If you have multiple HID environments or accounts, you must define multiple Certificate Authorities in the AnyCA Gateway
165
165
- Each CA configuration will manifest in Command as a separate CA entry
166
166
- The plugin uses Hawk authentication protocol for all API communications
167
167
- Authentication uses HMAC-SHA256 for secure API access
@@ -177,23 +177,23 @@ The plugin supports the following standard CRL revocation reasons:
177
177
2. **Secret Management**: Consider using a secrets management system for AuthKey storage
178
178
3. **Network Security**: Ensure TLS/SSL is properly configured for all API communications
179
179
4. **Least Privilege**: Request API credentials with minimal required permissions
180
-
5. **Audit Logging**: Enable comprehensive logging in both the Gateway and HydrantId for security monitoring
180
+
5. **Audit Logging**: Enable comprehensive logging in both the Gateway and HID for security monitoring
181
181
6. **Credential Rotation**: Regularly rotate API credentials according to your security policy
182
182
183
183
**CA Connection**
184
184
185
185
Populate using the configuration fields collected in the [requirements](#requirements) section.
186
186
187
-
* **HydrantIdBaseUrl** - The base URL for the HydrantId API endpoint. For example, `https://acm.hydrantid.com` or `https://acm-stage.hydrantid.com`.
188
-
* **HydrantIdAuthId** - The API Authentication ID provided by HydrantId for API access.
189
-
* **HydrantIdAuthKey** - The API Authentication Key (secret) provided by HydrantId for API access.
187
+
* **HIDBaseUrl** - The base URL for the HID API endpoint. For example, `https://acm.HID.com` or `https://acm-stage.HID.com`.
188
+
* **HIDAuthId** - The API Authentication ID provided by HID for API access.
189
+
* **HIDAuthKey** - The API Authentication Key (secret) provided by HID for API access.
190
190
191
191
2. **Certificate Template Configuration**
192
192
193
193
After adding the CA to the Gateway, configure each certificate template:
194
194
195
195
1. Navigate to the Templates/Products section for the newly added CA
196
-
2. For each template (policy) discovered from HydrantId, configure:
196
+
2. For each template (policy) discovered from HID, configure:
197
197
- **ValidityPeriod**: Select `Days`, `Months`, or `Years`
198
198
- **ValidityUnits**: Enter the numeric value (e.g., `365` for one year in days)
199
199
- **RenewalDays**: Enter the renewal window in days (e.g., `30`)
@@ -209,7 +209,7 @@ Populate using the configuration fields collected in the [requirements](#require
209
209
210
210
### Template (Product) Configuration
211
211
212
-
Each certificate template (policy) discovered from HydrantId requires configuration for enrollment:
212
+
Each certificate template (policy) discovered from HID requires configuration for enrollment:
213
213
214
214
| Parameter | Description | Required | Example |
215
215
|-----------|-------------|----------|---------|
@@ -218,7 +218,7 @@ Populate using the configuration fields collected in the [requirements](#require
218
218
| **RenewalDays** | Days before expiration to trigger renewal | Yes | `30` (renew within 30 days of expiration) |
219
219
220
220
**Important Notes:**
221
-
- Template names (Product IDs) are automatically discovered from HydrantId using the GET /api/v2/policies endpoint
221
+
- Template names (Product IDs) are automatically discovered from HID using the GET /api/v2/policies endpoint
222
222
- The ValidityPeriod and ValidityUnits combine to determine the certificate lifetime
223
223
- RenewalDays determines the behavior for certificate renewal:
224
224
- Within window: Performs a renewal operation (maintains certificate lineage)
0 commit comments