Creating a Certificate Profile for the Administrator

Follow the steps below to create a new Certificate Profile for administrators. The administrators certificates will be issued by a CA called ManagementCA.

1. Under CA Functions > Certificate Profiles.

2. Click Clone for the profile named ENDUSER.

3. Enter AdministratorEndEntityCertificateProfile as the new name and click Create from Template.

4. Click Edit for the new profile.

5. Under Validity, enter 365d (1 year validity).

6. Under Key usage, choose Digital Signature and Key encipherment (Ctrl+Click to select multiple).

7. Clear Allow Key Usage Override.

8. Select Use Extended Key Usage.

9. Under Extended Key Usage, choose Client Authentication.

10. Under Available bit lengths, "1024 bit", "2048 bit" and "4096 bit".

11. Under Available CAs, choose ManagementCA (the CA you use to issue Administrator certificates).

12. Click Save.

Creating an End Entity Profile for the Administrator

Follow the steps below to create a new End Entity Profile for Administrators. The profile will be connected to the Certificate Profile created above.

1. Under RA Functions > Edit End Entity Profiles.

2. Enter a name for your end entity profile, AdministratorEndEntityProfile.

3. ClickCreate.

4. Select AdministratorEndEntityProfile and clickEdit End Entity Profile.

5. Under the Subject DN Fields, add DN fields for the Admin DN, for example O, UID and C.

6. Under Default Certificate Profile, choose AdministratorEndEntityCertificateProfile.

7. Under Available Certificate Profiles, choose AdministratorEndEntityCertificateProfile.

8. Under Default CA, choose ManagementCA.

9. Under Available CAs, choose ManagementCA.

10. ClickSave.

Issue the following new end entity based on the new end entity profile: CN: SoftCard RA Admin1.

Creating a new RA Role

Follow the steps below to create a RA Admininistrator role with access to add/list/edit end entities:

1. Choose Administrator Roles in the left frame.

2. ClickAdd.

3. Choose a name for your new administrator group, RAAdministratorRole.

4. When the group is created, clickAccess Rules.

5. Choose the RA Administrator role template.

6. Under Authorized CAs, choose which CAs the role should have access to. Choose ManagementCA.

7. Under Edit End Entity Profiles, select AdministratorEndEntityProfile.

8. ClickSave.

Adding new Administrators to the RA Role

1. Choose Search/Edit End Entities and select your newly created end entity, choose View Certificates.

2. Copy the value of Certificate Serial Number, e.g. 5F003A0113F507F9.

3. Go to Administrator Roles, clickAdministrators under RAAdministratorRole.

4. Choose the CA that the administrator belongs to, ManagementCA.

5. Paste the text from < in the Match value.

6. ClickAdd.

In EJBCA Enterprise Edition, it is also possible to add a new administrator to an existing role by using the WS API call addSubjectToRole in your application or with the Web Services CLI.

Test the new Administrator

Log in with the new administrators to view differences between that and the superadmin. Additionally, try the different roles and privileges to see the differences between them all.