ACME HTTP and DNS Validation Guide

The Device Role Policy maps the device management platform in JoinNow to facilitate device attestation. To create a device role policy, follow these steps:

1. Navigate to Policy Management > Device Role.
2. Click Add Device Role Policy.
   
3. In the Basic tab, enter a name and a suitable description for the Device Role Policy in the Name and Description fields.
   
4. Click Save. The page refreshes, and the Conditions tab opens.
5. Click the Conditions tab.
6. From the Identity drop-down, select the ACME (Domain Validation) Server Certificate Enrollment Token created in the Creating a Device Management Platform section.
7. Click Update.

An Enrollment Policy defines the client certificate template and Certificate Issuer to be used for each Policy Workflow. It leverages the segmentation established in the Policy Workflow to ensure the appropriate client certificate template is issued for each workflow. For example, an administrator can create a separate Enrollment Policy for each department, such as Finance, Marketing, or Sales, based on the Policy Workflows, and assign a specific certificate type to each department based on business requirements.

To create an Enrollment policy, follow these steps:

1. Navigate to Policy Management > Enrollment.
2. Click Add Enrollment Policy.
   
3. In the Basic section, enter the name of the enrollment policy in the Name field.
4. In the Display Description field, enter a suitable description for the enrollment policy.
   
5. Click Save. The page refreshes, and the Conditions and Settings tabs are displayed.
6. Select the Conditions tab.
7. From the Role list, select the policy workflow you created earlier.
8. From the Device Role drop-down list, select the device role created in the Device Role Policy section.
   
9. Select the Settings tab.
10. In the Settings section, from the Use Certificate Authority drop-down list, select the intermediate CA created for ACME.
11. From the Use Certificate Template drop-down list, select the template you created earlier (see the Creating a Certificate Template section).
12. From the Revoke Certificate drop-down list, select Automatically. In the adjacent Using field, enter ${/template/san/dns}.
13. Click Update.

To set up JoinNow ACME Forwarder on Windows, follow these steps:

1. Run the acme_forwarder-1.0.0-x86_64 Windows installer and wait for the installation to complete.
   
2. In Windows, search for ACME Forwarder CLI and open it.
   
3. To open and modify the configuration file for the ACME Forwarder tool, run the following command: acme_forwarder_cli edit-config
   
4. The config.toml file opens, allowing you to configure the parameters according to your business requirements.
   
5. For environments that use a local DNS server, set the DNS mode to custom. For example:
6. To store a secure API secret, run the following command: acme_forwarder_cli set-secret
7. To apply configuration changes, restart the ACME Forwarder service by running the following command: acme_forwarder_cli start|stop|status