The Red Hat Certificate System creates, manages, renews, and deletes certificates and keys within an organization. There are five subsystems which govern the behavior of the public-key infrastructure (PKI) of the organization:
The Certificate Authority (CA), which creates, renews, and revokes certificates.
The Data Recovery Manager (DRM), which archives and recovers keys.
The Online Certificate Status Manager, which stores lists of revoked certificates for client applications to use to check if a certificate is valid.
The Token Processing System (TPS), which interacts with smart cards to generate and store keys and certificates for a specific user.
The Token Key Service (TKS), which generates and stores master keys used by the TPS.
End users can use security tokens, which are also called smart cards, to store user certificates used for applications such as single sign-on access and client authentication. End users are issued the tokens containing certificates and keys required for signing, encryption, and other cryptographic functions. To use the tokens, the TPS must be able to recognize and communicate with them. The tokens have to be enrolled, the process of formatting tokens with keys and certificates and adding them to the Certificate System. Enterprise Security Client provides the user interface for end entities to enroll tokens and to communicate with the TPS. Enterprise Security Client provides the conduit through which TPS communicates with each token over a secure HTTP channel (HTTPS).
After a token is enrolled, applications such as Mozilla Firefox and Thunderbird can be configured to recognize the token and use it for security operations, like client authentication and S/MIME mail. Enterprise Security Client provides the following capabilities:
Supports Visa Open Platform-compliant smart cards like Axalto Cyberflex egate 32k tokens.
Enrolls security tokens so they are recognized by TPS.
Maintains the security token, such as re-enrolling a token with TPS.
Provides information about the current status of the token or tokens being managed.
Supports server-side key generation so that keys can be archived and recovered on a separate token if a token is lost.