AKV Certificate Upload and Enrollment

How does emSigner handle the configuration of multiple AKV certificates for internal users?

To simplify the management of multiple Azure Key Vault (AKV) certificates, emSigner introduced a functionality that requires internal users to upload their AKV certificate upon first login. This ensures that every user has a valid certificate configured without manual intervention by administrators.

This feature allows users to upload and enroll their signing certificates in an Azure Key Vault (AKV) account managed by the organization's Super Admin. Automatic configuration of their individual signing certificates will be done in the emSigner application.

Why Was This Feature Introduced?

• When organizations need to configure multiple AKV certificates for different internal users, manual assignment can be cumbersome.

• To streamline this, emSigner automatically prompts each internal user to upload their own AKV certificate upon first login.

• This eliminates delays in certificate mapping and ensures seamless signing operations without admin dependency.

How It Works:

1. Administrator Configuration – The Super admin of the subscription has to provide the relevant details to configure the AKV account connection with emSigner.

2. First Login Prompt – When an internal user logs in for the first time, they must upload their AKV certificate in the Certificate Settings section.

3. Mandatory Upload – The user cannot proceed with signing until the certificate is uploaded.

4. Automatic Mapping – Once uploaded, the certificate is linked to the user's profile for all future signing activities.

Steps for Super Admin

1. Navigate to Settings > Admin Settings > AKV Account Settings.

2. Enter the required Azure account details:

   1. Client Secret*

   2. Tenant ID*

   3. Client ID*

   4. Key Vault URL*

   
3. Save the configuration to link the organization's Azure Key Vault account with emSigner.

4. Monitor all User AKV Certificate Profiles under the organization in the Certificate Settings Grid.

5. Users without certificates will be prompted to upload certificates upon login.

6. Super Admin can see all the profiles created in emSigner for the users.

Steps for Internal Users

1. If Super Admin has enabled AKV Signing and the user has not configured a certificate:

   1. The user will be redirected to the Certificate Upload Page upon attempting to sign a document.

   2. Upload the signing certificate and provide the password.

   3. The uploaded certificate is stored securely in the organization's AKV account.

   
2. Once the certificate is uploaded successfully:

   1. A User AKV Certificate Profile is created.

   2. The profile is listed in the Certificate Settings grid visible to the Super Admin.

3. To update or change the certificate:

   1. Navigate to My Profile > Certificates Section.

   2. Click on the Change icon beside the certificate. (only individual certificates have the Change option for the User).

   3. Upload the updated certificate.

4. View certificate validity and expiry details in the My Profile section.