DOCSEARCHbyAlgolia
Submit Docs

OmniTrust ILM Documentation

website·Indexed 32 days ago

https://docs.otilm.com/docs

Documentation for the OmniTrust ILM platform, focusing on certificate and key lifecycle management. Includes integration guides for OTPKI, Microsoft Intune, EJBCA, Keycloak, and Microsoft ADCS, as well as details on supported PKI protocols like CMP, secret management, and SignServer-based digital signing.

Tokens
232.6K
Snippets
691
Records
1.5K
Agent score
61%

What's inside OmniTrust ILM

  1. Overview of TridentSAMCryptoToken operation modes

    The TridentSAMCryptoToken implements the Trident SAM and requires access to Trident QSCD. It can be attached to any Signer implementation to create remote signatures on behalf of users. It operates in three primary modes:

    1. Signing-only mode: Supports only remote signing operations; user and key management are handled by external components.
    2. Key Management mode: Supports signing, user, and key management operations, acting as a single point of SAM key management.
    3. User Management mode: Supports additional user management functions such as creating, removing, or configuring authorization for users.
    com.czertainly.signserver.trident.TridentSAMCryptoToken

  3. Overview of the ILM Platform for Certificate and Key Management

    The ILM platform is designed to manage and automate cryptographic keys and digital certificates, providing the foundation for secure communication, authentication, and digital signatures. The core platform is open-source under the Apache License 2.0. It is designed for extensibility, allowing developers to create connectors and providers based on published OpenAPI specifications.

  4. Overview of the Digital Signature Service (DSS) framework

    The Digital Signature Service (DSS) framework is an open-source library developed by CEF Digital used for the creation and validation of electronic signatures. It provides the technical implementation of AdES baseline profiles and signature formats.

  5. Overview of Native Signing Architecture

    Native signing is the platform's built-in digital signing capability that operates independently of external products like SignServer. It consists of three primary collaborating components:

    1. Core: The central orchestrator that receives signing requests, validates them, and coordinates with connectors to produce a response.
    2. Cryptography Provider: A connector that holds and operates the signing key (consistent with the platform's standard key management).
    3. Signature Formatting Provider: A connector that assembles the required data structures before and after the cryptographic operation. The specific implementation depends on the active workflow.

  6. Overview of Authority Provider v3 Interface

    Authority Provider v3 is the current stateless interface between the Core and a certification authority (CA). It supports certificate issuance, renewal, rekeying, revocation, and pre-registration (registering an identity before a CSR exists).

    Key architectural differences from v2 include:

    • Statelessness: There is no authority-instance lifecycle. Authority identity and context are passed in every request.
    • Capability-driven: Optional behaviors (like polling or identity override) are advertised by the connector via feature flags and enforced by the platform.
    • Flexible Execution: Operations can be either synchronous (immediate completion) or asynchronous (accepted for later completion and polled by the platform).

  7. Overview of ilmctl CLI

    ilmctl (also installed as kubectl-ilm) is a command-line tool used to install, operate, inspect, and diagnose ILM on any Kubernetes cluster. It provides a wide range of capabilities including operator installation, health checks, diagnostics, and resource inspection.

  8. Overview of Extended JWS Authorizer for SignServer

    The Extended JWS Authorizer enables the separation of the authorization server from the signing application. It uses JSON Web Signatures (JWS) to exchange authentication and authorization identities between systems supporting OAuth 2.0. This implementation is compliant with RFC 7515 and supports eIDAS-compliant authentication and authorization, including multi-factor authentication (MFA). The JWS token authorizes the signing request and propagates claims information into the signing process, which can be used to configure specific certificate attributes.

  9. Overview of Identity Lifecycle Management (ILM)

    Identity Lifecycle Management (ILM) is a security platform designed to protect baseline security in digital communications. It automates and manages the lifecycle of trust services, specifically focusing on cryptographic keys, digital certificates, and digital signatures, particularly within hybrid environments.

  10. Overview of the Secret Provider interface

    The Secret Provider is a provider interface designed to fetch and manage secrets from various secret management systems. It abstracts the underlying implementation details to provide a consistent API for accessing secrets. It implements Common Interfaces as well as specific interfaces for Secret Management and Vault Management.

  11. Overview of the Signing Profile object

    A Signing Profile is the central configuration object for a signing operation. It defines the signing workflow (what is being signed), the signing scheme (how the key is used), and binds the TSP Profile (for inbound timestamp requests), the Time Quality Configuration (for time-source evaluation), and the signing records to be retained.

  12. Overview of supported certificate management protocols

    The platform acts as a proxy between clients and underlying certification authorities, implementing standardized protocols to ensure consistent certificate management and seamless migration between technologies. The following protocols are supported:

    • ACME (Automatic Certificate Management Environment): Based on RFC 8555. Used for automated requesting, validating, and issuing of certificates for web servers, clients, and IoT devices.
    • CMP (Certificate Management Protocol): Based on RFC 4210 with 3GPP Specification support. Used for comprehensive certificate management, particularly in telecommunications.
    • SCEP (Simple Certificate Enrollment Protocol): Based on RFC 8894 (with backward compatibility for draft-nourse-scep-23). Used for certificate management and CRL queries.