Re: [Pki-users] Router identity certificate auto-renewal questions

Hi Emily, Please see my in-line reply below. Actually, you might want to read my last comment first, and then circle back, so you won't get confused. Christina On 04/08/2015 02:38 PM, Emily Stemmerich wrote: If you intend to do auto-enrollment, then one-time pin is not the right authentication method. See my reply to #2 below. a trick I hear in testing is to reset the clock the caRouterCert profile works just like all the other profiles where the authentication/authorization are configurable. Here is a link that explains how authentication works and how to configure in profiles: https://access.redhat.com/documentation/en-US/Red_Hat_Certificate_System/... You have choices of authentication. For example, if you want auto-approval (without agent manual approval), you will need to set up directory-based authentication. Please note that the renewal feature is not intended for the router. You can read the doc here: https://access.redhat.com/documentation/en-US/Red_Hat_Certificate_System/... In case of router renewal, you just need to go through the same caRouterCert profile. As you can see from the renewal link above, renewal can take two forms: 1. reuse keys - in this case, you just need to resubmit the same request 2. new keys - in this case, you generate a new request to submit Hope this helps. Christina