Community
cancel
Showing results for 
Search instead for 
Did you mean: 
simple1
Beginner
150 Views

Use my own provisioning certificate in ema service

I can Use my own provisioning certificate in ema service,But I need 2 windows servers, 
Because the ema service will make the web certificate authority unavailable,and I only successfully setup the cira connect in the enterprise certificate authority environment。

Because the price of windows server is too expensive,So i need help

1.How to install enterprise ca and ema service on the same machine?

or

2.How to Use Standalone CA and be successful cira connect?

or

3. How to Use ubuntu to create a certificate authority and be successful cira connect?

0 Kudos
7 Replies
JoseH_Intel
Moderator
130 Views

Hello Huang,


Thank you for joining the Intel community


The configuration you are attempting to setup might not be fully supported. To be able to use your own certificate you must input it manually in MEBX or import it with a USB which will require you to physically touch every single machine before the provisioning process.


For #1, I will need to make sure if this is possible.

For #2, if not mistaking CIRA will require a TLS certificate

For #3 is totally out of the scope of this support.


For further details about how to upload a PKI certificate you want to check section 3.3 of: https://www.intel.com/content/dam/support/us/en/documents/software/manageability-products/intel-ema-...


I will look forward to your feedback


Regards


Jose A.

Intel Customer Support Technician


simple1
Beginner
124 Views

Dear JoseH

Thanks for your reply

I know how to upload a my own provisioning certificate PKI certificate and input it manually in MEBX,so i can setup the cira connect。

My question is how to use only one windows server device and create my own provisioning certificate and use my own provisioning certificate in ema service to complete the cira connection

For #1:Please help

For #2:How to create my own TLS certificate in Standalone CA environment?

 

 

JoseH_Intel
Moderator
121 Views

Hello Huang,


Not sure if such configuration is possible but I will look into that a bit and will let you know.


Regards


Jose A.

Intel Customer Support Technician


JoseH_Intel
Moderator
62 Views

Hello simple1,


There are many design decisions you can make here. You can virtualize your CA or do a bare metal install with EMA on the same server. It is possible, but there are design tradeoff around scalability when using the same server. If you don't plan on scaling beyond 5000 endpoints using the same server is an acceptable practice. It is also important to note that setting up your own PKI is considerably more complex than purchasing a Cert.


You will want to refer to Microsoft best practices and how to guides on setting up a CA. There are numerous video tutorials on this subject.


For best practices on setting up their EMA server you should refer to the EMA Installation and admin and user guide after you have established your PKI.


Section 3.3 will walk through on how to upload your private cert into their EMA server...


https://www.intel.com/content/dam/support/us/en/documents/software/manageability-products/intel-ema-...


Installation guide and consideration in setting up your Certs...


https://www.intel.com/content/dam/support/us/en/documents/software/manageability-products/intel-ema-...


Regards


Jose A.

Intel Customer Support Technician


simple1
Beginner
51 Views

Dear JoseH

Thanks for your reply

I have read these two documents ,but About the #1 question

How can I fix the following problem?

EMA service will make the web certificate authority unavailable,because the Web Certificate Authority and EMA service both use the default website

https://www.intel.com/content/dam/support/us/en/documents/software/manageability-products/intel-ema-...

page 21 

For first-time installations, if youcontinue with the installation process, the IntelEMA Setup Wizard will delete everything in thec:\inetpub\wwwroot folder. Be sure to backup anyneeded files before continuing with the installationprocess.This does NOT apply when updating from aprevious Intel EMA version, although IIS bindingswill be set to default values. Click Next on theWelcome screen to continue the setup process.When the License Agreement is displayed, acceptthe license to continue.

About the #2 question

Is there any update about this question?

thanks

JoseH_Intel
Moderator
39 Views

Hello simple1,


Let me research on this and I will let you know soon.


Regards


Jose A.

Intel Customer Support Technician


JoseH_Intel
Moderator
9 Views

Hello simple1,


You are correct if you have the requirement that his CA provide web enrollment environment. EMA does actively use IIS for it's own web portal. Developers are looking at changing this, but we don't have a timeframe for when this will be available.

 

The following are some options for testing. They are not supported for production environment and have not been tested by our teams, but may help you with your requirement to avoid another Windows license.

  1. Install EMA in a development environment and then install ISS and change the default directory. Again not to be done in production.
  2. Consider a Linux VM (to avoid licensing OS costs) This will of course be a non-iSS CA, which may not work for you.
  3. Investigate an open source CA PKI like EJBCA, https://www.ejbca.org/
  4. Using Dockers to containerize ISS. https://mcpmag.com/articles/2019/11/20/iis-on-windows-server-containers.aspx


And please remember that these alternative options are NOT supported by Intel, but ideas to help you to have a CA with self enrollment and EMA live on the server. No warranty or support for the suggestions.


Hope these help you


Regards


Jose A.

Intel Customer Support Technician