Certificate Profile

Ensure that the following relevant fields are set in the Certificate Profile (EJBCA CA Functions > Certificate Profiles):

• Authority Key ID: Use

• Subject Key ID: Use

• Key Usage: Digital Signature.

• Extended Key Usage: Client Authentication.
  

For more information on Certificate Profiles, see Managing Certificate Profiles.

End Entity Profile

Ensure that the following Subject DN Attributes and Subject Alternative Names values are available in the End Entity profile (EJBCA RA Functions > End Entity Profiles):

SCEP Alias

Lastly, ensure that the SCEP alias is set up as follows (EJBCA System Configuration > SCEP Configuration ):

For more information on Configuring SCEP, see SCEP Operations Guide.

Step 1 - Install the Google Cloud Certificate Connector

The Google Cloud Certificate Connector is downloaded when first setting up your Google Cloud account, as documented in the Google Help page Set up certificates for managed mobile devices. The Connector needs to be installed on a Microsoft Windows Server.

To install the Google Cloud Certificate Connector, perform the following steps:

1. Create an Active Directory service account user which will run the Google Cloud Certificate Connector. This account must have a static password.

2. Connect to the Google Admin console with an administrator account

3. Under Devices > Networks, click Secure SCEP connector.
   

4. The download connector page gives you access to:

   • The Connector Executable.

   • The connector configuration JSON file (config.json).

   • The service account credentials JSON file (key.json).
     

     

5. Copy all the files downloaded to the server hosting the Google Cloud Certificate Connector.

6. Run the Google Cloud Certificate Connector installer as an Administrator.

7. In the Google Cloud Certificate Connector Installer wizard, click Next .
   

   

8. Accept the terms of the license agreement and click Next .

9. Choose to install the service for Anyone who uses this computer and click Next .

10. Select the installation location. Google recommends using the default. Click Next .

11. Select a program folder, in this example Google Cloud Certificate Connector, and click Next .

12. Enter your AD service account credentials and click Next . The connector cannot be installed with a non-domain account.
    
    

13. View the settings and click Next to begin the installation.
    
    

14. The Connector installs.

Step 2 - Configure the Google Cloud Certificate Connector

To configure the Google Cloud Certificate Connector, perform the following steps:

1. Put the connector configuration JSON file (config.json) and the service account credentials JSON file (key.json) in the Google Cloud Certificate Connector folder created during installation, typically: C:\Program Files\Google Cloud Certificate Connector.

2. For the SSL handshake between the Google Cloud Certificate Connector and EJBCA to work, EJBCA's Management CA certificate needs to be added to the CA store of the Google Cloud Certificate Connector:

   • Locate the CA store of the Google Cloud Certificate Connector. The default location is: C:\Program Files\Google Cloud Certificate Connector\rt\lib\security\cacerts.

   • Next, either install a Java SDK on the Google Cloud Certificate Connector server or copy the cacerts file to a computer where a Java SDK is installed.

   • Add the Management CA certificate using the keytool utility:

     keytool.exe -import -keystore ./cacerts -trustcacerts -file <ManagementCA.pem> -storepass changeit

     

   • If keytool was not run on the server itself, copy the cacerts file back to the Google Cloud Certificate Connector server. Default location: C:\Program Files\Google Cloud Certificate Connector\rt\lib\security.

3. Start the Google Cloud Certificate Connector service.

4. Ensure that everything is properly started in the event viewer according to the following:

   • The Google Cloud Certificate Connector is able to parse its configuration:
     

     

   • Initialize the service.
     

     

   • Every 30 seconds the service will check against the Google backend if there are any requests to process.
     

     

Step 3 - Add your CA to Google Cloud

To add your own CA certificate to Google Cloud, do the following:

1. Connect to the Google Admin console with an administrator account.

2. Under Devices > Networks > Certificates, click Add certificate. This should be done at the root of the Google domain or for Chromebooks root OU
   

   

3. Provide a name for the CA, or otherwise, the common name of the issuer will be used). Then upload the CA certificate in PEM format and choose to deploy on Chromebooks.
   

   

4. Click Add to add the CA certificate.

Step 4 - Configure the SCEP Profile

To add and configure a secure SCEP profile in the Google Admin console, do the following_

1. Connect to the Google Admin console with an administrator account.

2. Under Devices > Networks > Secure SCEP connector, select Add Secure SCEP Profile. This can be done at the root domain level, at Chromebooks root OU in case of device certificates, or Users root OU in case of user certificates.
   

   

3. Specify a SCEP profile name, Subject name format, and Key size. The following example is focused on issuing device certificates, but can easily be adapted for user certificates:
   ¨
   CSR subject fields are defined in the SCEP profile. Placeholder variables can be used in order to customize the CSR to the need. For available placeholder variables, refer to the Google Help article Set up digital certificate provisioning.

4. If needed, Subject alternative names (SANs) can also be added:
   

   

5. Configure the following:

   • SCEP server URL: The URL of the SCEP server should look something like: https://<hostname>:<port>/ejbca/publicweb/apply/scep/<alias>/pkiclient.exe.
     

   • Certificate characteristics.

   • Challenge type: The static challenge (pass-phrase) used to authenticate the request coming from the Google Cloud Certificate Connector on the SCEP server and the corresponding certificate authority.
     

     

6. Configure how this template should be applied on Chromebooks, per user or per device:
   

   

7. Click Save to add the profile.

The added SCEP profile is listed with its name and the platforms it is enabled on. In the Platform column, the profile is enabled for platforms with blue icons and disabled for platforms with grey icons.

You have now completed the steps for configuring the Google Cloud Certificate Connector and can continue to test the setup in the next section.