Installing an audit log certificate
It is recommended that you not use the default certificate provided with Safeguard for Privileged Passwords. Instead, replace it with another certificate with a private key.
To replace the default certificate with your own, the certificate must have the following:
CSRs may be installed in the following formats.
- Install Certificate generated from CSR including:
- DER Encoded Files (.cer, .crt, or .der)
- PEM Encoded Files (.pem)
- Install Certificate with Private Key including:
- PKCS#12 (.p12 or .pfx)
- Personal Information Exchange Files (.pfx)
To install an audit log signing certificate
-
Go to Audit Log Signing Certificate:
web client: Navigate to 
Certificates > Audit Log Signing Certificate.
-
Click Add Certificate for the sessions certificate to be replaced. Select the appropriate option:
- Install Certificate generated from CSR
- Install Certificate with Private Key
- Browse and select the certificate file then click Open.
- If you are installing a certificate with a private key, a dialog box displays. Enter the case sensitive passphrase to import the certificate. If the certificate does not have a private key passphrase, leave the field empty and click OK.
- Once installed, this new certificate will replace the default certificate listed on the Audit Log Signing Certificate pane.
If an audit log signing certificate upload fails, the audit log reflects: AuditLogSigningCertificateUploadFailed.
To use the default certificate
You can use the default sessions certificate provided with Safeguard for Privileged Passwords
- Go to Audit Log Signing Certificate:
- web client: Navigate to Certificates > Audit Log Signing Certificate
- Click the Use Default button for the audit log signing certificate to be replaced with the default.
- On the warning Use Default dialog, type in the word Default to confirm you will be returning to the default certificate.
- Click Default to confirm.
Certificate Signing Request
Some certificates require a digital signature before a certification authority (CA) can process the certificate request. You may need to create a certificate signing request in Safeguard for Privileged Passwords for the following:
The Certificate Signing Request pane displays details about any certificates enrolled via Certificate Signing Requests (CSRs). From this pane, you can also delete a CSR.
Go to Audit Log Signing Certificate:
- web client: Navigate to Certificates > Certificate Signing Request.
Certificates enrolled via a CSR appear on this pane including the following details.
Table 23: Certificate Signing Request: Properties
| Subject |
The distinguished name of the person or entity to whom the certificate is being issued |
| Certificate Type |
The type of certificate requested:
- Audit Log Signing Certificate
- SSL Certificate
|
|
Key Size |
The bit length of the private key pair |
|
Thumbprint |
A unique hash value that identifies the certificate |
|
Expiration Date (web client) |
The date the CSR expires, if any. |
|
Alternate DNS Names |
Additional or alternate host names (such as, sites or common names) that were specified when the certificate was requested.. For more information, see Creating an audit log Certificate Signing Request.. |
|
Alternate IP Addresses |
Additional or alternate host names (such as, IP addresses or common names) that were specified when the certificate was requested. For more information, see Creating an audit log Certificate Signing Request. |
Use these toolbar buttons to manage certificate signing requests.
Table 24: Certificate Signing Request: Toolbar
 Delete Signing Request |
Delete the selected CSR from Safeguard for Privileged Passwords. |
 Refresh |
Update the list of CSRs. |
Hardware Security Module Certificates
Safeguard for Privileged Passwords enables an Appliance Administrator to upload both Hardware Security Module client certificates with private keys and Hardware Security Module server certificates for connecting to Thales Network Luna devices.
Hardware Security Module Client Certificates
Go to Hardware Security Module Client Certificates:
- web client: Navigate to Certificates > Hardware Security Module Certificates > Client Certificates.
To display the following information for the Hardware Security Module client certificate, select a certificate.
Table 25: Client Certificates: Properties
| Subject |
The name of the subject (such as user, program, computer, service, or other entity) assigned to the certificate when it was requested. |
|
Appliances |
Lists the name of the appliance to which the certificate is assigned. |
|
Issued By |
The name of the certificate authority (CA) that issued the certificate. |
|
Thumbprint |
A unique hash value that identifies the certificate. |
|
Invalid Before |
A start date and time that must be met before a certificate can be used. |
|
Expiration Date |
The date and time when the certificate expires and can no longer be used. |
Use these toolbar buttons to manage Hardware Security Module client certificates.
Table 26: Client Certificates: Toolbar
|
 Add Certificate
|
Upload a Hardware Security Module client certificate. For more information, see Installing a Hardware Security Module client certificate. |
| Delete Selected |
Delete the selected certificate from Safeguard for Privileged Passwords. |
|
 Assign Certificate to Appliance(s)
|
Assign the selected certificate to one or more appliances. For more information, see Assigning a Hardware Security Module client certificate. |
|
 Unassign Certificate from Appliance(s)
|
Unassign the selected certificate from one or more appliances. |
| Refresh |
Update the list of available Hardware Security Module client certificates. |
Hardware Security Module Server Certificates
Go to Hardware Security Module Server Certificates:
- web client: Navigate to Certificates > Hardware Security Module Certificates > Server Certificates.
To display the following information for the Hardware Security Module server certificate, select a certificate.
Table 27: Server Certificates: Properties
| Subject |
The name of the subject (such as user, program, computer, service, or other entity) assigned to the certificate when it was requested. |
|
Issued By |
The name of the certificate authority (CA) that issued the certificate. |
|
Certificate Type |
This will be listed as Unknown. |
|
Thumbprint |
A unique hash value that identifies the certificate. |
|
Invalid Before |
A start date and time that must be met before a certificate can be used. |
|
Expiration Date |
The date and time when the certificate expires and can no longer be used. |
Use these toolbar buttons to manage Hardware Security Module server certificates.
Table 28: Server Certificates: Toolbar
|
Upload Certificate |
Upload a Hardware Security Module server certificate. For more information, see Uploading a Hardware Security Module server certificate. |
| Delete Selected |
Delete the selected certificate from Safeguard for Privileged Passwords. |
| Refresh |
Update the list of certificates. |
Installing a Hardware Security Module client certificate
To install a Hardware Security Module client certificate
- Go to Client Certificates:
- web client: Navigate to Certificates > Hardware Security Module Certificates > Client Certificates.
-
Click Add Certificate.
- For Client Public Key, click Upload File.
- Select the client certificate public key file and click Open.
- For Client Private Key, click Upload File.
- Select the client certificate private key file and click Open.
-
On the Add Client Certificate dialog, click OK. After the certificate has been uploaded, you need to assign the certificate to one or more appliances. For more information, see Assigning a Hardware Security Module client certificate.
