One Identity Safeguard for Privileged Sessions 7.5 - Installation Guide

You can use custom trust stores in the following locations:

• Basic Settings > Management > Syslog — Check server certificate. For more information, see Configuring system logging.

• Basic Settings > Management > Universal SIEM forwarder — TLS with certificate validation. For more information, see Using the universal SIEM forwarder.

• Users & Access Control > Settings > Authentication settings — Configuring X.509 authentication. For more information, see Authenticating users with X.509 certificates.

• Users & Access Control > Settings > Authentication settings — Configuring LDAP, TLS and STARTLS encryption method. For more information, see Managing One Identity Safeguard for Privileged Sessions (SPS) users from an LDAP database.

• Policies > LDAP Servers — Configuring encryption. For more information, see Authenticating users to an LDAP server.

Prerequisites

To specify cipher settings and version requirements that SPS uses for establishing TLS connections in the Cryptography Settings section, navigate to Basic Settings > Trust Stores.

Figure 159: Basic Settings > Trust Stores — Cryptography settings

Cipher strength specifies the cipher string OpenSSL will use. The following settings options are possible:

• Recommendedrecommended: this setting only uses ciphers with adequate security level.

• Customcustom: this setting allows you to specify the list of ciphers you want to permit SPS to use in the connection. This setting is only recommended to ensure compatibility with older systems. For more details on customizing this list, check the 'openssl-ciphers' manual page on your SPS appliance.

  For example: ALL:!aNULL:@STRENGTH

Minimum TLS version specifies the minimal TLS version SPS will offer during negotiation. The following settings options are possible:

• TLS 1.2TLSv1_2: this setting only offers TLS version 1.2 during the negotiation. This is the recommended setting.

• TLS 1.1TLSv1_1: this setting offers TLS version 1.1 and later versions during the negotiation.

• TLS 1.0TLSv1_0: this setting offers TLS version 1.0 and later versions during the negotiation.

Maximum TLS version specifies the maximal TLS version SPS will offer during negotiation. The following settings options are possible:

• TLS 1.2TLSv1_2: this setting will only offer TLS version 1.2 during negotiation. This is the recommended setting.

• TLS 1.1TLSv1_1: this setting will offer TLS version 1.1 and later versions during negotiation.

• TLS 1.0TLSv1_0: this setting will offer TLS version 1.0 and later versions during negotiation.

• Latestnull: this setting will offer the latest TLS version during negotiation.

To create a custom trust store or edit an existing custom trust store

1. Navigate to Basic Settings > Trust Stores.

   Figure 160: Basic Settings > Trust Stores

   

2. In the Custom trust stores section, click Add new Trust Store. To change the settings of an existing trust store, click Edit.

   The Add new trust store or Edit trust store window opens.

   Figure 161: Basic Settings > Trust Stores — Add new trust store

   

3. In the Trust Store Name field, enter a name for the trust store. For example, ts1.

4. To add the certificate of the CA to the trust store that will be used to validate the certificates, click Add certificate. The Add certificate window opens.

5. Paste or drag the PEM certificate file to the Key content field. You can also click Browse to navigate to the PEM certificate file on your computer.

   Figure 162: Basic Settings > Trust Stores — Add certificate

   

   • You must upload all the CA certificates from the users' certificate chains (including the root CA). Therefore, these CA certificates must be on your computer in PEM format.

   • The certificates of the users must contain the user name used to authenticate on SPS. You must know which certificate field will contain the user names (for example, CN or UID).

   • The certificates must be imported into the browsers of the users. With SPS, you can authenticate with a certificate only if a personal certificate is available in the browser.

   NOTE:

   You can only upload a single PEM certificate.

   You cannot upload multiple PEM certificates in a single file.

   To upload more PEM certificates, add them as single entities one by one.

6. Click Add.

7. Set the revocation check type for the trust store.

   • None: Do not check certificate revocation status.

   • Leaf: Check the revocation status of the peer's certificate, but do not check the revocation status of the CA certificates in the chain.

   • Full: Check the revocation status of the peer's certificate and all CA certificates in the chain.

8. If you set the revocation check type to Leaf or Full, click Add new CRL URL to specify the CRL distribution point(s) of the CA that issued the peers' certificates.

   1. Enter the URL of the Certificate Revocation List (CRL) of the CA into the CRL URL field. Certificates appearing on the CRL list will be automatically rejected.

   2. To remove a CRL distribution point from the trust store, click Remove.

9. Click Save and close the window.

10. To delete a certificate from a trust store, click Edit to open the Edit trust store window, click on the certificate, and click Delete.
11. To delete a trust store, click Edit to open the Edit trust store window, and click Delete.

12. Click .