Request and issue a certificate

To get a new certificate from ITVA, you first request an enrollment. A user who can manage change requests approves the request, and ITVA creates the enrollment. You then issue the certificate from the enrollment. By the end of this guide, you will have an issued certificate in your inventory.

Before you begin

• Add an issuer. See Add a Windows ADCS issuer or Add a DigiCert issuer.
• Make sure that the issuer has at least one enabled CA template. See Set up certificate templates.
• To create or approve a request, your role needs the Manage permission for Change Requests.
• To issue the certificate, your role needs the Manage permission for Enrollments.
• To generate the key on a server, add the server to ITVA as a device first. To generate an ML-DSA key on a server, the server must run Linux with OpenSSL 3.5 or later.

Create an enrollment request

1. In the Tools menu, open Certificate Change Request.
2. Select New. The New Certificate Enrollment Request drawer opens.
3. In Name, type a name for the request.
4. Select the template. ITVA fills in the organization fields and the extended key usages from the template.
5. Check the extended key usages. Change them if the certificate needs different usages.
6. In Common Name, type the main name of the certificate, for example www.example.com.
7. Check Organization, Organization Unit, City, State / Province, and Country. All of these fields are required.
8. Under Subject Alt Names, select Add DNS:<common name> to add the common name as a DNS name.
9. To add another name, select Add Subject Alternative Name. Select a Kind (DNS or IP), then type the Value.
10. Select Save.

ITVA opens the request. Its status is Pending until a user approves or rejects it. A request needs at least one subject alternative name.

The template sets how the CA uses your extended key usages. A standalone CA issues the usages that the request asks for. An enterprise CA applies its own template, so it usually issues the usages from that template instead.

ITVA keeps one enrollment for each issuer and common name. If an enrollment with the same issuer and common name already exists, the approved request updates that enrollment. It does not create a second one.

Approve the request

Any user with the Manage permission for Change Requests can approve the request.

1. In the Tools menu, open Certificate Change Request.
2. Open the request. Its Kind is Enrollment.
3. Check the details. If something is wrong, select Edit and correct it.
4. Select Approve. To refuse the request, select Reject.

After approval, ITVA creates the enrollment in the background. The requester becomes the Owner of the enrollment. The request moves through these statuses:

Issue the certificate

1. In the PKI menu, open Enrollments.
2. Open the enrollment.
3. Select Issue.
4. Select where the private key comes from. The next section explains each option.
5. Fill in the fields for that option.
6. Select Issue.

ITVA sends the request to the CA and waits for the certificate. If the enrollment has installs with Auto Install on, the drawer lists them, and ITVA installs the new certificate on each one.

Private key sources

• ITVA Generated Private Key: ITVA makes the key and the CSR. Select the Private Key Algorithm.
• Provide a CSR: paste a PEM CSR that starts with -----BEGIN CERTIFICATE REQUEST-----. ITVA never has the private key. You must paste a new CSR each time you renew or reissue.
• Generate on Device: select a server in Device. In Private Key Path, type the path on the device where ITVA saves the key, for example /etc/ssl/private/www.example.com.key. Then select the Private Key Algorithm.
• Provide a Private Key: paste a PEM private key in Private Key. If the key is encrypted, type its Password. ITVA makes the CSR from the key.

ITVA supports RSA 2048, RSA 3072, RSA 4096, RSA 8192, ECDSA 256, ECDSA 384, ECDSA 521, ML-DSA-44, ML-DSA-65, and ML-DSA-87. The template can allow only some of them, and the list shows only the allowed algorithms. ITVA also checks the key in a pasted CSR or private key against the template.

Issue several certificates at once

A bulk issue uses an ITVA generated private key for each enrollment. To use another key source, issue each enrollment separately.

1. In the PKI menu, open Enrollments.
2. Select the enrollments to issue.
3. In the menu that shows your selection, select Issue. The Issue Certificates drawer opens.
4. Select the Private Key Algorithm.
5. Select Issue.

ITVA skips enrollments that already have a certificate, and the drawer tells you how many it skips. The list shows only the algorithms that the templates of all selected enrollments allow. If one enrollment fails, ITVA still issues the others and shows an error for each failure.

Check that it worked

1. Open the enrollment request on the Certificate Change Request page. Make sure that its status is Succeeded.
2. Open the enrollment. Make sure that the Versions card shows the new certificate with its issue and expiry dates.
3. Open the certificate from the Versions card. Make sure that its status is Valid.

Troubleshooting

There is no New, Approve, or Issue button

ITVA hides these buttons if your role does not have the permission. New and Approve need Manage for Change Requests. Issue needs Manage for Enrollments. Ask an administrator to add the permission to your role.

The template is not in the list

The template is not enabled. A user who can manage CA templates must turn on Enabled for it. See Set up certificate templates.

"... is not allowed by the ... template"

The key algorithm of the pasted CSR or private key is not allowed by the template. The message lists the allowed algorithms. Make a new key with an allowed algorithm, or select ITVA Generated Private Key.

The request status is Failed

Open the request and read the error. Fix the cause, for example the issuer connection, then select Retry.

"The selected enrollments do not share an allowed private key algorithm"

The templates of the selected enrollments have no algorithm in common. Select fewer enrollments, or issue them separately.

The issue fails with an error from the CA

ITVA shows the error that the issuer returned. Check the issuer connection and the template settings, then select Issue again.