- Overview
- Reference Guide
- Setup & Architecture
- Release Notes
- Workflow
- API Reference
- Integration Guide
- Discovery Agent Setup Guide
Approval Workflow
The Approval Workflow adds a review step to certificate issuance. When an approval policy is applied to a certificate template, certificates requested from that template are not issued immediately. Instead, each request is sent to the PKI Admin of the requester's department for review, and the certificate is issued only after the request is approved.
This gives your organization control over which certificates are issued from sensitive Certificate Authorities (CAs) and templates, without changing how users request certificates.
How the Workflow Works
The Approval Workflow has four stages:
- Configure the approval policy: An Admin or PKI Admin selects one or more templates of a CA and sets the number of approvals required for each.
- Save the policy: The approval requirement takes effect for all new certificate requests from those templates.
- Request a certificate: A user requests a certificate from one of those templates. Instead of being issued, the certificate is submitted as a request to the PKI Admin of the user's department.
- Approve or deny the request: The PKI Admin reviews the request under Certificate Request and approves or denies it. The certificate is issued only when the request is approved.
Roles Involved
| Role | Responsibility in the workflow |
|---|---|
| Admin or PKI Admin | Configures the approval policy for CA templates under Enrollment > Manage Policies. |
| Requester (any other user) | Requests certificates as usual. Requests from templates with an approval policy wait for approval. |
| PKI Admin of the requester's department | Reviews the request under Enrollment > Certificate Request and approves or denies it. |
Step 1: Configure the Approval Policy
This step is performed by a user with the Admin or PKI Admin role.
- Go to Enrollment > Manage Policies.
- Under Certificate Authority Information, select the CA in Configure Templates for Certificate Authority.
- In the Find Templates for CAs section, select one or more templates from Certificate Templates and click Add. The templates are added to the table below.
- For each template, choose the Number of Approval Required. The Number of Approvers column shows how many users are available to approve requests for that template.
To stop requiring approval for a template, click Remove in its row.
Step 2: Save the Policy
Save the policies to apply your changes. From this point, every new certificate request for the selected templates follows the Approval Workflow. Certificates that were already issued are not affected.
For details of the other settings on this page, see Manage Policies.
Step 3: Request a Certificate
The workflow starts when a user requests a certificate from a template that has an approval policy, using any of the following:
The user fills in the request and submits it as usual, and the request is initialized.
Because the template requires approval, the certificate is not issued immediately. CertSecure Manager shows a message with the number of approvals required, for example Certificate has to be approved by: 1 Approver, and sends the request to the PKI Admin of the user's department.
Step 4: Approve or Deny the Request
This step is performed by the PKI Admin of the requester's department.
- Go to Enrollment > Certificate Request. The page lists the pending requests with their Enrollment ID, CA, Template, Common Name and Key Length.
- Click View Detail under Cert Info to review the details of a request before you decide.
To approve a request
- Click Approve in the row of the request.
- In the confirmation dialog, click Yes.
A Certificate Approved message confirms the approval, and the request is removed from the list. Once the required number of approvals is reached, CertSecure Manager issues the certificate.
To deny a request
Click Deny in the row of the request and confirm. The certificate is not issued, and the request is marked as declined for the requester.
Note: Requests from templates without an approval policy are not affected by this workflow. Their certificates are issued as soon as the request is submitted.