Enigma Bridge PKI uses EJBCA as the PKI engine. The security of the PKI engine is paramount for security and trustworthiness of your certificates. One of the strongest authentication mechanisms is based on client-side HTTPS authentication and this mechanism is used by EJBCA as the default one.
Users have to install their client authentication keys before they can connect to the PKI web interface. The key is generated automatically by the installation script. You have to download it and install on your management "console" (i.e., your laptop).
Steps to complete first:
- Start Amazon Enigma Bridge PKI instance
- Connect to AMI instance via Putty SSH client software
- Initialize the EB PKI system
What you need:
- domain name of your new PKI system
- password for the 'ejbca-admin.p12' file - this was displayed at the end of the EB PKI initialization (the previous step)
- optional: fingerprint of your server to verify it when connecting to it with WinSC
Procedure
Download A Key-File From the Enigma Bridge PKI Instance
- Simple but non-GUI - command "scp", if available or "pscp" - part of the Putty application - we leave this option for geeks
- GUI option - WinSCP
- Download WinSCP from https://winscp.net/eng/download.php
- Install as usual on your Windows computer
- Start WinSCP by selecting it from a list of installed applications
- Enter the domain name <yourPKI>.pki.enigmabridge.com as "Host name".
Select path to *.ppk private AMI instance authentication key.
- Save connection details in WinSCP by 'Save' button for later use.
- Click 'Login' button to connect to AMI instance.
- If required, verify server's fingerprint and click confirm with the 'Yes' button if fingerprints match.
- Once logged-in to your PKI system, find the 'ejbca-admin.p12' file in the "/root" folder and copy it to your computer.
- at this point, you have the authentication key-file on your computer. The next step is to import it to your operating system.
Import EJBCA client certificate for management
- Find the downloaded 'ejbca-admin.p12' file and open it (e.g., with double-click on its name in Windows Explorer).
- Keep store location 'Current user' and click 'Next' button.
- Click 'Next' button to continue with import.
- Insert password for key import obtained during AMI instance setup.
- Keep option 'Automatically select the certificate store...' and click 'Next' button.
- Complete import of certificate by clicking 'Finish' button
- As you know where the key file came from, we can confirm security warning when importing the new Certification authority (CA) certificate by clicking "Yes".
- Delete the 'ejbca-admin.p12' file as it is not needed any more. (remove it from Thrash as well)
- Your client authentication certificate is now installed in your local certificate store and usable by common browsers like MS Internet Explorer, MS Edge, Google Chrome etc.
- Mozilla Firefox uses own certificate store - if you use Firefox, please import certificate via
Firefox→Preferences→Advanced→Certificates→View certificates→Import
Access your PKI Frontend (demonstrating with MS Edge browser)
- Start MS Edge or Google Chrome browser and type URL obtained during the PKI initialization
https://bristol4.pki.enigmabridge.com:8443/ejbca/adminweb/ - Confirm use of TLS certificate for client authentication by clicking 'OK' button
- Confirm access to the private key of this TLS certificate.
- Finally, you should see the front-end of your PKI system as the administrator.
