Manage Certificates with DigiCert IoT Trust Manager Integration
Note: The DigiCert IoT Trust Manager integration is available for Belden Horizon Data Manager 2.21.0 and later.
In this use case, you will integrate DigiCert IoT Trust Manager to manage certificates for all your edge devices.
- First, you will set up the DigiCert IoT Trust Manager Integration from your Belden Horizon Data Manager (BHDM) Admin Console.
- Then, you will configure the Certificate Authority (CA) for both BHDM and Edge devices.
- Finally, you will verify if the DigiCert certificates are applied to your BHDO devices.
Before You Begin
- Ensure you have at least one Edge device activated in your BHDM. See Activate an Edge Device for more information.
- Ensure you have access to the DigiCert IoT Trust Manager to obtain the required configuration parameters. If you are not a DigiCert IoT Trust Manager customer, visit https://www.digicert.com/device-trust-manager to sign up.
Step 1: Access DigiCert IoT Trust Manager Integration
To access the DigiCert IoT Trust Manager integration pane:
- Log in to the BHDM Admin Console at the following URL: https://[BHDM IP address]:8446.
- From the Navigation panel, select Integration. Integration's Kafka pane by default appears.
From Integration's navigation sub-panel, select DigiCert. Integration's DigiCert pane appears.
DigiCert pane
You will see three fields for configuration: URL, Profile ID, and Passcode. By default, placeholder values will be in these fields. In the next step, you will retrieve these configuration parameters from the DigiCert IoT Trust Manager.
Step 2: Set up Integration with DigiCert
To retrieve the URL, Profile ID, and Passcode parameters from the DigiCert IoT Trust Manager, follow the steps below:
- Select IoT Trust Manager from the switcher icon at the top right corner.
- From the navigation panel, select Enrollment configurations. The Enrollment profiles page opens.
Click the desired Enrollment profile name. The Enrollment profile details page appears. Note: 1. For this use case, the enrollment profile is already created. See Create an enrollment profile to learn more. 2. Set up the enrollment profile method for REST API, as it is the integrated method with BHDM.
Certificate enrollment methods dialog boxConfigure the keypair generation settings to be used.
Keypair generation settings- After creating the Enrollment Profile, edit the enrollment profile. Scroll to the bottom of the Enrollment Profile details page and create a passcode. Copy and save this passcode to a secure location. See also Enrollment Passcodes to generate the passcode for authenticating to the REST API.
- You can retrieve the URL, Profile ID, and Passcode parameters from the Enrollment profile details page as follows:
URL: This is the DigiCert server URL. Navigate to API section and copy Request URL link.
Enrollment profile details page - API sectionProfile ID: Copy this from the Enrollment profile ID.
Enrollment profile details page- Passcode: This was generated and shown when you created the passcode above.
- Enter the retrieved parameters into the DigiCert Integration fields in the BHDM Admin Console.
Click Save. A confirmation message will appear indicating that the DigiCert settings are saved.
DigiCert Integration Page
Step 3: Set up Certificate Authority for BHDM
To set up the certificate authority for BHDM:
- From the BHDM Admin Console, navigate to Settings > Domain/SSL.
From the SSL settings pane, choose the DigiCert option.
SSL settings pane- Click Save.
- The Page Reload Required dialog box appears. Click Yes, and refresh the page. SSL settings are saved and the page is reloaded after updating the certificate settings for proper system functioning.
Step 4: Issue a certificate for BHDO Device from BHDM User UI
To issue a certificate for BHDO Device from BHDM User UI:
Log in to BHDM and navigate to Certificates tab. The list of current certificates for your edge devices along with their details appears.
Certificates tabTo issue a new certificate, click the Action button for an edge device and select Issue a new certificate.
Certificates Management pane- From the Issue a new certificate dialog box, configure the following:
- Certificate Authority: From the dropdown menu, select DigiCert IoT Trust Manager as the new certificate authority.
- (Optional) Keep default settings for the other fields.
Click ISSUE CERTIFICATE.
Issue a new certificate dialog box
The certificate has been added to the BHDO device along with the issuer details.
Step 5: Verify Certificate for BHDO Device
To verify that the certificate has been added to the BHDO device:
- Navigate to the specific edge device instance where you applied the certificate and log in.
Go to Systems > Network and find the Device Certificates panel.
Systems > Network page
You can verify the certificate details and ensure that the new certificate has been added.
Note: Refresh the screen if necessary to see the updated certificate and issuer details. Reboot is required to see the certificate update on browser tab.