Skip to main content
Version: 4.42

How to set up unattended browsers

info

This feature is available from Redtrust version 4.42.3 onwards.

Overview​

This guide explains how to enable unattended browsers mode so an automated system can use Redtrust certificates in web browsers without the browser extension. You install the agent without the extension and turn on a policy flag that lets the server authorize browser signing operations that arrive without a URL. It's intended for IT technicians who deploy the agent and administrators who manage policies.

For background on how this mode works, see Unattended browsers.

Before you start​

Before you start, make sure you have:

  • A Windows machine for the automated system.
  • Access to the admin console with permissions to manage policies.
  • A user dedicated to the unattended environment, along with the certificate and policy that user needs.
warning

In unattended browsers mode, Redtrust can't validate the site where a certificate is used, and the URL doesn't appear in audit events. Use a dedicated unattended user and confirm that the loss of URL control is acceptable for your environment.

Steps​

Step 1: Install the agent in unattended browsers mode​

On the automation machine, install the Windows agent with the UNATTENDED_BROWSERS parameter set to 1. The installer skips every browser-extension component, so you don't configure or install any browser extension.

msiexec /i rt-agent-x64-VERSION-SUFFIX.msi RTPRIMARY="PRIMARY_SERVER" RTSECONDARY="SECONDARY_SERVER" CLIENTID="YOUR_CLIENT_ID" AuthMode=LocalUsers LANGUAGE="en-US" UNATTENDED_BROWSERS="1"

Where:

  • PRIMARY_SERVER and SECONDARY_SERVER are the addresses of the primary and secondary Redtrust servers.
  • YOUR_CLIENT_ID is the client identifier for your Redtrust installation.

For all installation options, see Agent installation parameters and the Windows installation guide.

Step 2: Turn on the Unattended browsers flag on the policy​

  1. In the admin console, go to Policies > Policies.
  2. Create a policy or edit the policy that applies to the unattended user. To create one, follow Create a policy.
  3. Turn on Unattended browsers.
  4. Apply the change.
note

In this mode, all of the user's certificates (personal and corporate) behave as usual and can be used without URL validation. It's the administrator's responsibility to assign only appropriate users to unattended environments.

Step 3: Verify​

From the automated system, run a browser signing operation that uses the certificate. The operation completes without any browser extension, and the server authorizes it even though no URL is sent. You can confirm the result in Events: the certificate usage event records the command line of the requesting process instead of a URL.

Summary​

You installed the agent with UNATTENDED_BROWSERS="1" so it skips the browser extension, and you turned on the Unattended browsers flag on the policy so the server authorizes browser operations without a URL. The automated system can now use certificates in browsers concurrently, without the extension bottleneck.

Next steps​

Was this page helpful?