Chatta subito con l'assistenza
Chat con il supporto

One Identity Safeguard for Privileged Passwords 7.5 - Administration Guide

Introduction System requirements and versions Using API and PowerShell tools Using the virtual appliance and web management console Cloud deployment considerations Setting up Safeguard for Privileged Passwords for the first time Using the web client Home page Privileged access requests Appliance Management
Appliance Backup and Retention Certificates Cluster Global Services External Integration Real-Time Reports Safeguard Access Appliance Management Settings
Asset Management
Account Automation Accounts Assets Partitions Discovery Profiles Tags Registered Connectors Custom platforms Importing objects
Security Policy Management
Access Request Activity Account Groups Application to Application Cloud Assistant Asset Groups Entitlements Linked Accounts User Groups Security Policy Settings
User Management Reports Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions Appendix A: Safeguard ports Appendix B: SPP and SPS join guidance Appendix C: Regular Expressions

Creating an SSL/TLS Certificate Signing Request

When creating a CSR, you uniquely identify the user or entity that will use the requested certificate. SPP allows you to upload or enroll SSL certificates using CSRs. Once uploaded or enrolled, the SSL certificate is added to the SSL certificate store allowing you to assign it to one or more SPP Appliances.

To create a CSR for SSL

  1.  Go to the following selection, based on your client:
    • web client: Navigate to Certificates > SSL/TLS Certificates.
  2. Click Add Certificate and select Create Certificate Signing Request (CSR).
  3. In the Certificate Signing Request dialog, enter the following information:

    1. Subject (Distinguished Name): Enter the distinguished name of the person or entity to whom the certificate is being issued in the proper format like: cn=common name,ou=organizational unit,o=organization. Using the format example, cn=sam doe,ou=marketing,o=mycompany. Maximum length is 500 characters.

      • Click Use Distinguished Name Creator to create the distinguished name based on your entries in Fully Qualified Domain Name (required), Department, Organization, City/Locality, State/County/Region, and Country.

    2. Subject Alternate Names (DNS): Optionally, enter the Data Source Name (DNS) name of the server that will be protected by this certificate. For example, this might be the DNS names of all of the appliances in the SPP cluster.

      If the DNS name changes, you must generate a new certificate.

    3. Subject Alternate Names (IP Address): Optionally, enter the IP addresses of the server that will be protected by this certificate. For example, this might be the IP addresses of all the appliances in the SPP cluster.

      If the IP address changes, you must generate a new certificate.

    4. Key Size: Select the bit length of the private key pair. The bit length determines the security level of the SSL certificate. A larger key size is more secure but encryption is slower.

      • 1024
      • 2048 (default)

      • 4096

  4. Click OK. You are prompted with a message like: Please save and submit the following Certificate Signing Request to a Certificate Authority (CA).

  5. Click Save to save the CSR to a file. If you do not save the CSR, you will have to generate another one.
  6. In the Certificate Signing Request pane, click Refresh to update the list of certificates added.

Installing an SSL/TLS certificate

To install an SSL/TLS certificate, the certificate must have at least the following:

  • Enhanced Key Usage extension with the Server Authentication (1.3.6.1.5.5.7.3.1) OID value.

  • Key Usage extension with the Digital Signature bit set.

To install an SSL certificate

  1. Go to the following selection:
    • web client: Navigate to Certificates > SSL/TLS Certificates.
  2. Click Add Certificate and select Upload Certificate.
  3. Browse and select the certificate file then click Open.

  4. On the dialog box, enter the case sensitive passphrase to import the certificate. If the certificate does not have a private key passphrase, leave the field empty and click OK.

  5. After the certificate has been uploaded, assign the certificate to one or more appliances. For more information, see Assigning an SSL/TLS certificate to appliances..

    You may also upload the certificate's root CA to the list of trusted certificates. For more information, see Trusted CA Certificates..

Caution: Improper access to the private SSL key could compromise traffic to and from the appliance. For the most secure configuration, create a Certificate Signature Request (CSR) and have it signed by your normal signing authority.

Then use the signed request as your SPP SSL Webserver Certificate. This way, no administrator will have access to the private SSL key that is used by SPP and the traffic will be secure.

Assigning an SSL/TLS certificate to appliances

SPP supports an SSL certificate store that is owned by the cluster. This allows you to assign any SSL certificate that you have previously uploaded or enrolled via CSR to any appliance in your clustered environment.

To assign a certificate to appliances

  1.  Go to the following selection:
    • web client: Navigate to Certificates > SSL/TLS Certificates.
  2. Select a certificate from the grid and click the Assign Certificate to Appliance(s) toolbar button.
  3. In the Appliances dialog, select one or more appliances and click OK to save your selection.

Follow the same steps to Unassign Certificate later.

Syslog Client Certificate

An Appliance Administrator can upload a syslog client certificate so that Safeguard for Privileged Passwords can send authenticated messages to syslog servers that do not accept anonymous clients. For more information, see Syslog..

You can have only one syslog client certificate defined, which is used by all Safeguard for Privileged Passwords Appliances in the same cluster.

Instead of using the default syslog client certificate supplied, it is recommended you generate the Certificate Signing Request (CSR) using Create Certificate Signing Request (CSR). For more information, see Creating a syslog client Certificate Signing Request..

If you do use the default syslog client certificate, you are responsible for configuring the syslog server to accept the default certificate. For more information, see Installing a syslog client certificate..

Manage a Certificate Signing Request (CSR)

To define, generate, or manage a syslog client certificate, go to Syslog Client Certificate:

  • web client: Navigate to Certificates > Syslog Client Certificate.

The following properties and controls are available to manage your syslog client certificate.

Table 34: Syslog Client Certificate: Properties
Property Description
Refresh

Click to get the latest information about the client certificate used.

Subject

Displays the client which is the name of the subject assigned to the certificate when it was requested.

Thumbprint

A unique hash value that identifies the certificate.

Expiration Date

The expiration date of the certificate.

Add Certificate

Click Add Certificate and select one of the following options to replace the default certificate with a new certificate:

Use Default

Click Use Default to reset the certificate back to the default supplied by SPP.

By default, the data is encrypted in transit but there is no authentication of the client/server.

Related Documents

The document was helpful.

Seleziona valutazione

I easily found the information I needed.

Seleziona valutazione