Certificate Signing Options

UMS supports three options for ICG certificate signing:

• Use the UMS to create a CA and sign ICG certificates.

  • Advantages: Free of charge, independent

  • Disadvantages: Client users have to check the CA certificate fingerprint when first connecting to ICG, no advanced PKI management features

• Import the root certificate and private key of your existing private CA into UMS, and use the certificate to sign a certificate for ICG.

  • Advantages: Free of charge

  • Disadvantages: Client users have to check the CA certificate fingerprint when first connecting to ICG. You may not want to save your CA private key in a networked application such as UMS, and it may be difficult to synchronize it with your main private CA.

• Import the root certificate of a publicly known CA into UMS, and an ICG certificate signed by it.

  • Advantages: If the CA is one of the approximately 170 that are supported by IGEL OS, users will not need to check the certificate fingerprint at all.

  • Disadvantages: Cost. You will not be able to sign certificates yourself.