Skip to content

Commit 5df4ab4

Browse files
Update configuration.md
1 parent 4936828 commit 5df4ab4

File tree

1 file changed

+51
-52
lines changed

1 file changed

+51
-52
lines changed

docsource/configuration.md

Lines changed: 51 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
## Overview
22

3-
The HID Global HID AnyCA Gateway REST plugin extends the capabilities of HID Certificate Authority Service to Keyfactor Command via the Keyfactor AnyCA Gateway. This plugin leverages the HID REST API with Hawk authentication to provide comprehensive certificate lifecycle management. The plugin represents a fully featured AnyCA Plugin with the following capabilities:
3+
The HID Global HydrantId AnyCA Gateway REST plugin extends the capabilities of HydrantId Certificate Authority Service to Keyfactor Command via the Keyfactor AnyCA Gateway. This plugin leverages the HydrantId REST API with Hawk authentication to provide comprehensive certificate lifecycle management. The plugin represents a fully featured AnyCA Plugin with the following capabilities:
44

55
* **CA Sync**:
6-
* Download all certificates issued by the HID CA
6+
* Download all certificates issued by the HydrantId CA
77
* Support for incremental and full synchronization
88
* Automatic extraction of end-entity certificates from PEM chains
99
* **Certificate Enrollment**:
@@ -18,58 +18,58 @@ The HID Global HID AnyCA Gateway REST plugin extends the capabilities of HID Cer
1818

1919
## Requirements
2020

21-
### HID System Prerequisites
21+
### HydrantId System Prerequisites
2222

2323
Before configuring the AnyCA Gateway plugin, ensure the following prerequisites are met:
2424

25-
1. **HID Account**:
26-
- Active HID account with API access enabled
27-
- Access to the HID management portal
28-
- HID Certificate Authority Service configured and operational
25+
1. **HydrantId Account**:
26+
- Active HydrantId account with API access enabled
27+
- Access to the HydrantId management portal
28+
- HydrantId Certificate Authority Service configured and operational
2929

3030
2. **API Credentials**:
31-
- HID API Authentication ID (AuthId)
32-
- HID API Authentication Key (AuthKey)
31+
- HydrantId API Authentication ID (AuthId)
32+
- HydrantId API Authentication Key (AuthKey)
3333
- These credentials must have permissions for:
3434
- Certificate enrollment (CSR submission)
3535
- Certificate retrieval
3636
- Certificate revocation
3737
- Policy/profile listing
3838

3939
3. **Network Connectivity**:
40-
- Gateway server must have HTTPS access to the HID API endpoint
41-
- Default endpoint format: `https://<environment>.HID.com`
42-
- Example: `https://acm-stage.HID.com` or `https://acm.HID.com`
40+
- Gateway server must have HTTPS access to the HydrantId API endpoint
41+
- Default endpoint format: `https://<environment>.hydrantid.com`
42+
- Example: `https://acm-stage.hydrantid.com` or `https://acm.hydrantid.com`
4343
- TLS 1.2 or higher must be supported
4444

4545
### Obtaining Required Configuration Information
4646

47-
#### 1. HID Base URL
47+
#### 1. HydrantId Base URL
4848

49-
The HID Base URL is the root endpoint for the HID API.
49+
The HydrantId Base URL is the root endpoint for the HydrantId API.
5050

51-
**Common HID environments:**
52-
- Production: `https://acm.HID.com`
53-
- Staging: `https://acm-stage.HID.com`
51+
**Common HydrantId environments:**
52+
- Production: `https://acm.hydrantid.com`
53+
- Staging: `https://acm-stage.hydrantid.com`
5454
- Custom instances may have different URLs
5555

5656
**To obtain your Base URL:**
57-
1. Contact your HID account representative
58-
2. Check your HID account documentation
57+
1. Contact your HydrantId account representative
58+
2. Check your HydrantId account documentation
5959
3. Verify the URL is accessible from the Gateway server
6060

6161
#### 2. API Authentication Credentials
6262

63-
The Gateway authenticates to HID using Hawk authentication protocol with an AuthId and AuthKey pair.
63+
The Gateway authenticates to HydrantId using Hawk authentication protocol with an AuthId and AuthKey pair.
6464

6565
**Steps to obtain API credentials:**
6666

67-
1. **Access HID Portal**:
68-
- Log in to your HID management portal
67+
1. **Access HydrantId Portal**:
68+
- Log in to your HydrantId management portal
6969
- Navigate to API or Integration settings
7070

7171
2. **Generate API Credentials**:
72-
- Request API credentials from your HID administrator
72+
- Request API credentials from your HydrantId administrator
7373
- You will receive:
7474
- **AuthId**: A unique identifier for your API client
7575
- **AuthKey**: A secret key used for HMAC-based authentication
@@ -85,12 +85,12 @@ The Gateway authenticates to HID using Hawk authentication protocol with an Auth
8585

8686
#### 3. Certificate Policies
8787

88-
Certificate policies define the types of certificates that can be issued. The plugin automatically discovers available policies from the HID system.
88+
Certificate policies define the types of certificates that can be issued. The plugin automatically discovers available policies from the HydrantId system.
8989

9090
**Policy discovery:**
9191
- Policies are automatically retrieved when the CA is configured
9292
- Policies appear in Keyfactor Command as "Product IDs" after CA registration
93-
- Each policy represents a certificate template configured in HID
93+
- Each policy represents a certificate template configured in HydrantId
9494

9595
**To view available policies:**
9696
1. Policies are retrieved automatically using the GET /api/v2/policies endpoint
@@ -115,7 +115,7 @@ For each certificate template, you can configure:
115115

116116
The plugin supports the following standard CRL revocation reasons:
117117

118-
| Reason Code | Reason Name | HID API Value |
118+
| Reason Code | Reason Name | HydrantId API Value |
119119
|-------------|-------------|---------------------|
120120
| 0 | Unspecified | `Unspecified` |
121121
| 1 | Key Compromise | `KeyCompromise` |
@@ -124,13 +124,13 @@ The plugin supports the following standard CRL revocation reasons:
124124
| 4 | Superseded | `Superseded` |
125125
| 5 | Cessation of Operation | `CessationOfOperation` |
126126

127-
**Note**: Verify with your HID administrator which revocation reasons are supported in your environment.
127+
**Note**: Verify with your HydrantId administrator which revocation reasons are supported in your environment.
128128

129129
## Installation
130130

131131
1. Install the AnyCA Gateway REST per the [official Keyfactor documentation](https://software.keyfactor.com/Guides/AnyCAGatewayREST/Content/AnyCAGatewayREST/InstallIntroduction.htm).
132132

133-
2. On the server hosting the AnyCA Gateway REST, download and unzip the latest [HID Global HID AnyCA Gateway REST plugin](https://github.com/Keyfactor/HID-caplugin/releases/latest) from GitHub.
133+
2. On the server hosting the AnyCA Gateway REST, download and unzip the latest [HID Global HydrantId AnyCA Gateway REST plugin](https://github.com/Keyfactor/hydrantid-caplugin/releases/latest) from GitHub.
134134

135135
3. Copy the unzipped directory (usually called `net6.0` or `net8.0`) to the Extensions directory:
136136

@@ -140,60 +140,60 @@ The plugin supports the following standard CRL revocation reasons:
140140
Program Files\Keyfactor\AnyCA Gateway\AnyGatewayREST\net8.0\Extensions
141141
```
142142

143-
> The directory containing the HID Global HID AnyCA Gateway REST plugin DLLs (`net6.0` or `net8.0`) can be named anything, as long as it is unique within the `Extensions` directory.
143+
> The directory containing the HID Global HydrantId AnyCA Gateway REST plugin DLLs (`net6.0` or `net8.0`) can be named anything, as long as it is unique within the `Extensions` directory.
144144

145145
4. Restart the AnyCA Gateway REST service.
146146

147-
5. Navigate to the AnyCA Gateway REST portal and verify that the Gateway recognizes the HID Global HID plugin by hovering over the ⓘ symbol to the right of the Gateway on the top left of the portal.
147+
5. Navigate to the AnyCA Gateway REST portal and verify that the Gateway recognizes the HID Global HydrantId plugin by hovering over the ⓘ symbol to the right of the Gateway on the top left of the portal.
148148

149149
## Gateway Registration
150150

151151
### CA Connection Configuration
152152

153-
When registering the HID CA in the AnyCA Gateway, you'll need to provide the following configuration parameters:
153+
When registering the HydrantId CA in the AnyCA Gateway, you'll need to provide the following configuration parameters:
154154
155155
| Parameter | Description | Required | Example |
156156
|-----------|-------------|----------|---------|
157-
| **HIDBaseUrl** | Full URL to the HID API endpoint | Yes | `https://acm.HID.com` or `https://acm-stage.HID.com` |
158-
| **HIDAuthId** | API Authentication ID provided by HID | Yes | `your-auth-id` |
159-
| **HIDAuthKey** | API Authentication Key provided by HID | Yes | `your-secret-auth-key` |
157+
| **HydrantIdBaseUrl** | Full URL to the HydrantId API endpoint | Yes | `https://acm.hydrantid.com` or `https://acm-stage.hydrantid.com` |
158+
| **HydrantIdAuthId** | API Authentication ID provided by HydrantId | Yes | `your-auth-id` |
159+
| **HydrantIdAuthKey** | API Authentication Key provided by HydrantId | Yes | `your-secret-auth-key` |
160160
161161
### Gateway Registration Notes
162162
163-
- Each defined Certificate Authority in the AnyCA Gateway REST can support one HID API endpoint
164-
- If you have multiple HID environments or accounts, you must define multiple Certificate Authorities in the AnyCA Gateway
165-
- Each CA configuration will manifest in Command as a separate CA entry
166-
- The plugin uses Hawk authentication protocol for all API communications
167-
- Authentication uses HMAC-SHA256 for secure API access
168-
- The plugin automatically handles:
169-
- Policy/template discovery
170-
- Certificate status mapping
171-
- End-entity certificate extraction from PEM chains
172-
- Enrollment completion polling (30-second timeout)
163+
- Each defined Certificate Authority in the AnyCA Gateway REST can support one HydrantId API endpoint
164+
- If you have multiple HydrantId environments or accounts, you must define multiple Certificate Authorities in the AnyCA Gateway
165+
- Each CA configuration will manifest in Command as a separate CA entry
166+
- The plugin uses Hawk authentication protocol for all API communications
167+
- Authentication uses HMAC-SHA256 for secure API access
168+
- The plugin automatically handles:
169+
- Policy/template discovery
170+
- Certificate status mapping
171+
- End-entity certificate extraction from PEM chains
172+
- Enrollment completion polling (30-second timeout)
173173
174174
### Security Considerations
175175
176176
1. **Credential Storage**: Store API credentials securely and restrict access to the Gateway configuration
177177
2. **Secret Management**: Consider using a secrets management system for AuthKey storage
178178
3. **Network Security**: Ensure TLS/SSL is properly configured for all API communications
179179
4. **Least Privilege**: Request API credentials with minimal required permissions
180-
5. **Audit Logging**: Enable comprehensive logging in both the Gateway and HID for security monitoring
180+
5. **Audit Logging**: Enable comprehensive logging in both the Gateway and HydrantId for security monitoring
181181
6. **Credential Rotation**: Regularly rotate API credentials according to your security policy
182182
183183
**CA Connection**
184184
185185
Populate using the configuration fields collected in the [requirements](#requirements) section.
186186
187-
* **HIDBaseUrl** - The base URL for the HID API endpoint. For example, `https://acm.HID.com` or `https://acm-stage.HID.com`.
188-
* **HIDAuthId** - The API Authentication ID provided by HID for API access.
189-
* **HIDAuthKey** - The API Authentication Key (secret) provided by HID for API access.
187+
* **HydrantIdBaseUrl** - The base URL for the HydrantId API endpoint. For example, `https://acm.hydrantid.com` or `https://acm-stage.hydrantid.com`.
188+
* **HydrantIdAuthId** - The API Authentication ID provided by HydrantId for API access.
189+
* **HydrantIdAuthKey** - The API Authentication Key (secret) provided by HydrantId for API access.
190190
191191
2. **Certificate Template Configuration**
192192
193193
After adding the CA to the Gateway, configure each certificate template:
194194
195195
1. Navigate to the Templates/Products section for the newly added CA
196-
2. For each template (policy) discovered from HID, configure:
196+
2. For each template (policy) discovered from HydrantId, configure:
197197
- **ValidityPeriod**: Select `Days`, `Months`, or `Years`
198198
- **ValidityUnits**: Enter the numeric value (e.g., `365` for one year in days)
199199
- **RenewalDays**: Enter the renewal window in days (e.g., `30`)
@@ -209,7 +209,7 @@ Populate using the configuration fields collected in the [requirements](#require
209209
210210
### Template (Product) Configuration
211211
212-
Each certificate template (policy) discovered from HID requires configuration for enrollment:
212+
Each certificate template (policy) discovered from HydrantId requires configuration for enrollment:
213213
214214
| Parameter | Description | Required | Example |
215215
|-----------|-------------|----------|---------|
@@ -218,9 +218,8 @@ Populate using the configuration fields collected in the [requirements](#require
218218
| **RenewalDays** | Days before expiration to trigger renewal | Yes | `30` (renew within 30 days of expiration) |
219219
220220
**Important Notes:**
221-
- Template names (Product IDs) are automatically discovered from HID using the GET /api/v2/policies endpoint
221+
- Template names (Product IDs) are automatically discovered from HydrantId using the GET /api/v2/policies endpoint
222222
- The ValidityPeriod and ValidityUnits combine to determine the certificate lifetime
223223
- RenewalDays determines the behavior for certificate renewal:
224224
- Within window: Performs a renewal operation (maintains certificate lineage)
225225
- Outside window: Performs a re-issue operation (new certificate enrollment)
226-

0 commit comments

Comments
 (0)