Setting up Trust Signing in Dev/Test subscription

Question

We would like to test this new service. We have used the private identity type successfully, but am unable to validate the public identify in our Dev/Test subscription.

We probably would request guidance on how an enterprise can manage multiple Trust Signing accounts (e.g. perhaps for different departments), as well as different public certs for perhaps testing purposes.

Do we have 1 public identity across all of our subscriptions/signing accounts, but have each cert scoped appropriately? For example, these could be different public certs?

• products.tungstenautomation.com
• tungstenautomation.com
• ps.tungstenautomation.com
• test.tungstenautomation.com

If possible, can we get advice on how this is managed for large enterprises?

Thx

Answer 1

@Thai K. Nguyen Thank you for reaching out to us, from what I understand, you are having trouble validating the public identity in your Dev/Test subscription and would like guidance on how to manage multiple Trust Signing accounts and public certificates for different departments.

To answer your first question, it is possible to have one public identity across all of your subscriptions and signing accounts, but with each certificate scoped appropriately. This means that you can have different public certificates for testing purposes, but they would still be associated with the same public identity.

As for managing multiple Trust Signing accounts for different departments, it is recommended to have a centralized team or group responsible for managing the accounts and certificates. This team can then delegate access to the appropriate departments as needed.

For large enterprises, it is important to have a clear and organized system for managing Trust Signing accounts and certificates. This can include having a naming convention for the accounts and certificates, as well as keeping track of who has access to each account and certificate.

Review Certificate profiles section in this doc for type of profiles subscriber can associate with.

Let me know if this information helps regarding your ask, if not will reach out to our product group for more clarity on the same.

Answer 2

Hi @Thai K. Nguyen

Thank you for reaching out. I see you're having problems with validating a public identity. Are you running into this problem during the identity validation process? There is information the vetting team must collect and validate in order to approve your account for a public identity. If you're stuck there, I can look into that for you.

In regard to your question about how an enterprise would manage multiple Trusted Signing accounts, you can make multiple Trusted Signing accounts for the same entity, and they can be within the same subscription or different subscriptions (If they are under different subscription, you will need to do identity validation again).

Within one Trusted Signing account, you can create different certificate profiles. Here is more information on the certificate profile feature. The certificate profile feature allows you to create different certificate types like in your example. Certificate profiles can be associated with the respective identity and are limited to the SKU selected for each account.

Depending on your organizational needs, you can use different certificate profiles, different Trusted Signing accounts, or different Azure subscriptions to manage different use cases across departments.

Please let me know if you need any more information. Thank you.

Best,

Annie