The following prerequisites apply:

• Protocol Gateway must be installed. See Install Protocol Gateway.
• Initial configuration of Protocol Gateway must be done. See Initial configuration of Protocol Gateway. 

The elements that were imported during the initial configuration are marked with a black and yellow "under construction" bar, since they are not signed yet.

In Administrator's workbench (AWB), open each element and make needed configurations and sign the changes: 

1. Modify Protocol Gateway CMP Certificate Procedure:
   1. Change Issuing CA to the Device Issuing CA.
   2. Click OK and sign the updates. See Sign tasks in Certificate Manager.
2. For each of the following token procedures, select Modify, click OK and sign the updates. See Sign tasks in Certificate Manager.
   1. CMP Registration and Enroll Procedure
      This token procedure uses the input view GPIV 6 - Save and Search CMP Enrollment Registrations.
   2. CMP Password Registration and Enroll Procedure
      This token procedure uses the input view GPIV 7 - Save and Search CMP Password Enrollment Registrations.
      

To set the properties for the CMP protocols: 

1. Open \Nexus\cm-gateway\conf\CMP.properties for editing.
2. Modify the following properties: 
   1. Enable the CMP protocol by setting start to true. 

   2. Set default.tokenprocedure to CMP Registration and Enroll Procedure.

   3. Set default.ra.keyfile to the Protocol Gateway RA token file and default.ra.password to the related PIN.

      For more information on how to configure verifications of certificate requests in .properties files, see Certificate request verifications in Protocol Gateway.

3. If needed, scramble sensitive parameters in the configuration file, for example the RA password. See Scramble sensitive data in configuration files in Protocol Gateway.
4. Save the file.  

start = true
default.tokenprocedure = CMP Registration and Enroll Procedure
default.ra.keyfile = protocol-gateway-ra.p12
default.ra.password = <Protocol Gateway RA PIN>

1. Restart the Tomcat service. 

For information on how to start using Nexus test client, see Set up and use test clients in Protocol Gateway.

To configure the CMP test client: 

1. Copy the protocol-gateway-ra.cer to \Nexus\testclients\temp.
2. Open the file com.nexussafe.cm.test.app.CMPClient.properties for editing: 
3. Set the parameter raCert to temp\protocol-gateway-ra.cer.

Create a demo vendor and demo device:

1. In the command prompt, start an interactive session, by typing the command: 

   Example: Generate CMP request

   java –jar testtools.jar CMPClient interactive

2. Generate a new Vendor CA with the CMP client, by running the vendorcacert command. 
   A demo Vendor CA certificate is created in the folder \Nexus\testclient\temp. 

3. In Administrator's workbench (AWB), select Cross > Import Certificate. Select the Vendor CA certificate from \Nexus\testclient\temp.

4. Create a demo device with the vendor command.
   A demo device is created with a serial number.  

Register a wildcard CMP device: 

1. In Registration Authority (RA) in Certificate Manager, go to the Order tab. 
2. In Procedure, select CMP Password Registration and Enroll Procedure.
3. Register a wildcard FQDN, by entering the following details:
   1.  In FQDN, enter *.example.com
      Any device on this wildcard domain can get a certificate. For more information, see Allowed domain names for preregistration in Certificate Manager.
   2. In Validity time (days), enter the number of days that the registration shall be valid. 
   3. In State, select Open. 

To verify the installation using the Nexus CMP Client: 

1. In the same interactive CMPClient session, do the following: 

   1. Generate a key pair for the device with the genkeypair command.

   2. Create an initialization request with the ir command.

   3. Send the request with the send command.

   4. Build a confirmation of the certificate reception with the certconf command. 

   5. Send the certificate confirmation with the send command