GlobalTrust

GlobalTrust-specific sections in MPKI

(new in 12.0)

Sections on this page:

Section Default parameters

Depending on the contract, the necessary settings have to be made here. As a rule, these are made available by GlobalTrust upon the conclusion of the contract between the email domain owner and GlobalTrust.

Parameters	Description
Default UID	Provided by GlobalTrust
Certificate period	Communicated by GlobalTrust

Section Domain specific parameters (optional)

If the SEPPmail Secure E-Mail Gateway manages several email domains (Managed Domains), this option can be used to specify specific parameters for creating user certificates for each domain.

After saving the domain specific option via Save entries another input field appears in each case.

Parameters

Description

New domain entry:

UID

Provided by GlobalTrust

Domains:

Provided by GlobalTrust

empty

Attention:

The domain entered here must be selected under Connectors MPKI managed domains in order to obtain certificates.

Certificate period

(empty if default)

Communicated by GlobalTrust if applicable

Section Certificate

Used for authentication with the certification authority provider (GlobalTrust)

Parameters

Description

PKCS12 identity file

Certificate for authentication vis-à-vis the certification authority (GlobalTrust).

This file is provided by GlobalTrust and is provided with a password (see parameter PKCS12 password)

If the access to the certification authority is successful, the following message appears at this point:

an operator certificate with valid password has been found.

empty

Note:

As of 30 days before the operator certificate expires, a message is added to the Daily Report (see also Groups admin and statisticsadmin), and the status of the Daily Reports is changed to IMPORTANT.

PKCS12 password

Password to activate the "private keys" contained in the PKCS12 identity file.

This is also provided by GlobalTrust.

Section Settings

Settings for the automatic renewal of certificates.

empty

Note:

The validity period of the certificates of the individual users can be found in the file user-stats.csv which comes with the Daily Report (see also Groups statisticsadmin).

This is especially helpful if no automatic renewal of certificates has been set.

Parameters

Description

CheckBoxInactive Automatically renew expiring certificates if validity days left less than

This option is inactive by default and pre-set to 30.

Initiates the automatic renewal of certificates of active users (Users) if the remaining validity period is the set value. One pre-condition in this respect is that the corresponding user sends an email within the set overlap time. This prevents certificates from being obtained for "corpses" in the Users menu, including certificates subject to a fee, if applicable. The thus initiated process runs overnight (!).

empty

Note:

If the MPKI is activated retrospectively, existing, manually imported certificates are also taken into account. The certificate of the user with the longest validity period (expires on) is decisive for the renewal via MPKI.

Certificates of the internal certification authority as well as revoked or expired certificates are not taken into account.

empty

Note:

The greater the overlap in the certificate validity, the greater the chance that the communication partner will come into possession of a valid public key, which they need for sending encrypted emails.

CheckBoxInactive Automatically create certificates for active users without certificates

By default, this option is inactive.

This function obtains a certificate for all existing active Users, who are not in possession of a valid (!) certificate, automatically overnight (!).

Active Users are users who have sent an email in the last 30 days and do not have the State inactive.

empty

Attention:

Only works if the following option is active at the same time: Automatically renew expiring certificates if validity days left less than

Chain certificates (needed to sign emails)

By clicking on Add or update..., the intermediate certificates under X.509 Root Certificates required for supplementing the certificate chain when signing are added/updated.

empty

Note:

This action is mandatory after completion of the MPKI configuration!

The changes made are saved via the Save button.

Please enable JavaScript to view this site.

Keyboard Navigation