Business Processes

In the navigation menu, select the menu item "System" → “Administrators” (or "Overview" → "System" → “Administrator” in the sidebar).

Click on "Create" in the list of KMS-Admins (see step 01);

Enter values for "Username", "Email";

Click on "Propose an administrator".

Log into the KMS-Admin as second administrator;

Select the proposal for creation via menu item "System" → "Available proposals" in the navigation menu and give the second vote. The process is described in detail in chapter P-KMS-ADM-05 – “Dual control” orders (vote, retract, reject).

In the list of KMS-Admins (see step 01), click on "Edit" for the KMS-Admin that should be modified;

Edit "E-Mail" or activate/deactivate the KMS-Administrator by checking/unchecking the “Status”-Checkbox.

Click on “Save”, to save the changes.

In the list of KMS-Admins (see step 01), click on "Edit" for the KMS-Admin that should be deleted;

If the status of the selected KMS-Admin is active, the KMS-Admin must first be deactivated (see step 4).

If the KMS-Admin is deactivated, the “Delete” button is active. Continue the process by clicking on the “Delete” button.

An intermediate page informs the administrator, that the operation is a “dual control” order. Click on “Send request” and confirm the action.

Log into the KMS-Admin as second administrator;

Select the proposal for deletion via menu item "System" → "Available proposals" in the navigation menu and give the second vote. The process is described in detail in chapter P-KMS-ADM-05 – “Dual control” orders (vote, retract, reject).

In the navigation menu, select menu item "Account" → “Change Passwort”;

Enter the new password and repeat the choice;

Click on “Submit” and the password is changed.

Select menu item "Overview" → "Tenants" → “All tenants” in the navigation menu (or alternatively "KMS" → "Tenants").

Click on „Create Tenant” in the list of tenants (step 1);

Enter value for „Name“;

Click on „Create Tenant“;

Optional: Click on “activate“ after the creation to activate the tenant.

Click on "Edit" in the list of tenants (see step 01);

Edit "Name;

Manage linked HSM (see step 05);

Manage KMS-Tenant-Client Users. (see steps 05, 07)

Click on "Edit" in the list of tenants (see step 01);

Click "Edit" in the Overview of the "Attached HSMs";

Click on "Attach" in the list of available HSMs to attach an HSM;

Click on "Detach" in the list of attached HSMs to detach an HSM.

Click on "Edit" in the list of tenants (see step 01);

Click on "Edit" in the section "Existing Tenant-Users";

Enter the number of new tenant users (between 2 and 10, e.g. 2) in the input field;

Click on "Create" and confirm;

Safely store the access data of the new tenant users:

 {
    "component": "KMS-Tenant",
    "tenant": "…",
    "users": [
    {
        "username": "…",
        "password": "…"
    },
    {
        "username": "…",
        "password": "…"
    }
    ]
}

Click on "Back".

Click on "Edit" in the list for a tenant;

Click on "Edit" for "Existing Tenant Users";

Click on "Delete all" and confirm.

Click on "Edit" in the list of existing tenant users;

Click on "Deactivate" to deactivate the tenant user (only deactivated tenant user can be deleted);

Click on "Delete";

Click on "Orderly decommissioning" to create a request for deletion.

Log into the KMS-Admin as second administrator;

Select the proposal for deletion via menu item "System" → "Available proposals" in the navigation menu and give the second vote. The process is described in detail in chapter P-KMS-ADM-05 – “Dual control” orders (vote, retract, reject).

Click on "Edit" in the list of tenants (see step 01);

Click "Edit" in the Overview of the "Attached Issuer CAs";

Click on "Attach" in the list of available CAs to attach a CA;

Click on "Edit" in the list of tenants (see step 01);

Click on "Create" or "Edit" in the "CMP configuration" section;

Enter the value for "Address". This is the base URL for the CMP server.

Enter the value for "Request path". The URL path for the certify request.

Enter the value for "Revoke path". The URL path for the revoke request.

Select the truststore with the TLS certificates of the CMP server. This must be a #PKCS12 file.

Enter the value for "Truststore password".

Select the TLS version.

Select the keystore with the signing key pair that the CMP client uses to sign its requests. This must be a #PKCS12 file.

Enter the value for "Keystore alias".

Enter the value for "Keystore password".

Select the root certificate of the certificate chain used to verify the responses signed by the CMP server.

Click on "Edit" in the list of tenants (see step 01);

Click on "Edit" in the "CMP configuration" section;

Click on "Delete";

Click on "Delete" in the confirmation dialog;

Select the menu item "Overview" → "Navigation" → “HSMs” in the navigation menu (or alternatively "KMS" → "HSMs").

Click on "Create HSM" (e.g. in the list of HSM objects);

Enter attribute values "Name", "Location", "Address", "Type";

Click on "Create HSM".

In the list of HSMs, click on "Edit" for the HSM that should be modified (e.g. in the HSM’s Object List);

Edit "Name", "Location", "Address", "Type" attributes;

Click on "Save HSM".

In the list of HSMs, click on "Edit" for the HSM that should be deleted (e.g. in the HSM’s Object List);

Click on "Delete HSM" and confirm.

Select menu item "System" → "Your proposals" in the navigation menu.

Click on "Details" in the list of your own proposal (see step 1);

Click on "Retract" and confirm your action;

Select menu item "System" → "Available proposals" in the navigation menu.

Click on "Edit" in the list of available proposals (see step 3);

Check the displayed data;

Click on "Accept" and confirm the action;

Depending on the proposal type, further final steps are necessary before the process is completed.

Click on "Edit" in the list of available proposals (see step 3);

Click on "Reject" and confirm the action;

Select menu item "Settings" → “Edit Settings”;

Set the preferred Cron Expressions;

Click on “Save”.

Select menu item "Settings" → “Edit settings”;

Click on “true” (or “false”);

Click on “Continue” in the upcoming Pop-Up Window.

Select menu item "Settings" → “Edit settings”;

Click on “true” (or “false”);

Click on “Continue” in the upcoming Pop-Up Window.

Select menu item "Settings" → “Edit settings”;

Set the address and port for the SMTP server;

Set the username and password for the SMTP server, if they are necessary;

Set the mail addresses for the sender and receiver;

Click on “Save”.

Select menu item "Settings" → “Edit settings”;

Set the address and port for the SNMP server;

Click on “Save”.

Select menu item "KMS" → “Licenses”;

Click on “Request a new License” and confirm the action;

On the next page, click on “Download” to download the license request as a “.csr” file.

Send the downloaded license request to MTG for signing. This is an out-of-band operation and can be performed by f.i. sending an encrypted email with the file attached. As a result, MTG will send back the signed license.

Select menu item "KMS" → “Licenses”;

Click on “Choose File” and select the signed license file in the file system dialog;

Click on “Import License”.