Chat now with support
Chat with Support

Safeguard for Privileged Passwords On Demand Hosted - Administration Guide

Introduction System requirements and versions Using API and PowerShell tools Using the virtual appliance and web management console Cloud deployment considerations Setting up Safeguard for Privileged Passwords for the first time Using the web client Getting started with the desktop client Using the desktop client Activity Center Search box Privileged access requests Toolbox Accounts Account Groups Assets
General/Properties tab (asset) Accounts tab (asset) Account Dependencies tab (asset) Owners tab (asset) Access Request Policies tab (asset) Asset Groups tab (asset) Discovered SSH Keys (asset) Discovered Services tab (asset) History tab (asset) Managing assets
Asset Groups Discovery Entitlements Linked Accounts Partitions Profiles Settings
Access Request settings Appliance settings Asset Management settings Tags Backup and Retention settings Certificates settings Cluster settings Enable or Disable Services settings External Integration settings Password Management settings Real-Time Reports Safeguard Access settings SSH Key Management settings Security Policy Settings
Users User Groups Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions Appendix A: Safeguard ports Appendix B: SPP 2.7 or later migration guidance Appendix C: SPP and SPS join guidance Appendix D: Regular Expressions About us

Creating a syslog client Certificate Signing Request

A certificate signing request (CSR) is submitted to a Certificate Authority (CA) to obtain a digitally signed certificate. When creating a CSR, you uniquely identify the user or entity that will use the requested certificate. Safeguard for Privileged Passwords allows you to upload or enroll a syslog client certificate using CSRs. Once uploaded or enrolled, the syslog client certificate is added to the syslog client certificate store allowing you to assign it to one or more Safeguard for Privileged Passwords Appliances.

To create a CSR for syslog

  1.  Go to the following selection, based on your client:
    • web client: Navigate to Certificates | Syslog Client Certificate.
    • desktop client: Navigate to Administrative Tools | Settings | Certificates | Syslog Client Certificate.
  2. Click Add Certificate and select Create Certificate Signing Request (CSR).
  3. In the Certificate Signing Request dialog, enter the following information:

    1. Subject (Distinguished Name): Enter the distinguished name of the person or entity to whom the certificate is being issued in the proper format like: cn=common name,ou=organizational unit,o=organization. Using the format example, cn=sam doe,ou=marketing,o=mycompany. Maximum length is 500 characters.

      • Click Use Distinguished Name Creator to create the distinguished name based on your entries in Fully Qualified Domain Name (required), Department, Organization, City/Locality, State/County/Region, and Country.
    2. Subject Alternate Names (DNS): Optionally, enter the Data Source Name (DNS) name of the server that will be protected by this certificate. For example, this might be the DNS names of all of the appliances in the Safeguard for Privileged Passwords cluster.
      If the DNS name changes, you must generate a new certificate.
    3. Subject Alternate Names (IP Address): Optionally, enter the IP addresses of the server that will be protected by this certificate. For example, this might be the IP addresses of all the appliances in the Safeguard for Privileged Passwords cluster.
      If the IP address changes, you must generate a new certificate.

    4. Key Size: Select the bit length of the private key pair. The bit length determines the security level of the SSL certificate. A larger key size is more secure but encryption is slower.

      • 1024
      • 2048 (default)

      • 4096

  4. Click OK to save your selections and enroll the certificate.

Installing a syslog client certificate

To install a syslog client certificate

  1. Go to the following:
    • web client: Navigate to Certificates | Syslog Client Certificate.
    • desktop client: Navigate to Administrative Tools | Settings | Certificates | Syslog Client Certificate.
  2. Click Add Certificate and select one of the following:
    • Install Certificate with a Private Key: To upload a PFX file that contains the certificate and the private key
    • Install Certificate generate from CSR: To generate a CSR and have that signed by a trusted CA
  3. Browse to select the certificate file and complete the install.
  4. For Enter the private key passphrase:
    • Enter the passphrase to import the certificate then click OK. Click to see the passphrase.
    • If there is no passphrase, leave the field blank then click OK.

  5. The Subject, Thumbprint, and Expiration date for the key you uploaded displays. You can select Use Default and respond to the confirmation dialog to return to the default, if desired.

  6. If you uploaded a certificate with a private key, you may upload the certificate's root CA to the list of trusted certificates. For more information, see Trusted CA Certificates.

Trusted CA Certificates

It is the responsibility of the Appliance Administrator to add or remove trusted root certificates to the Safeguard for Privileged Passwords Appliance. If you are going to verify the server certificate, then you do need a certificate from the server certificates chain of trust in Trusted Certificates.

Examples:

  • If you uploaded a syslog client certificate with a private key, you may need to upload the certificate's root CA to the list of trusted certificates. For more information, see Syslog Client Certificate.
  • An SSL/TLS certificate must be trusted to resolve the chain of authority. For an SSL/TSL certificate, when Safeguard for Privileged Passwords connects to an asset that has the Verify SSL Certificate option enabled, the signing authority of the certificate presented by the asset is compared to the certificates in the trusted certificate store. For more information, see Verify SSL Certificate.

Go to the following:

  • web client: Navigate to Certificates | Trusted CA Certificates.
  • desktop client: Navigate to  Settings | Certificates | Trusted Certificates.

Select a certificate to display the following information for the user-supplied certificates added to the trusted certificate store.

Table 196: Trusted CA certificates: Properties
Property Description
Subject The name of the subject (such as user, program, computer, service or other entity) assigned to the certificate when it was requested.

Issued By

 The name of the certificate authority (CA) that issued the certificate.

Certificate Type

Trusted

Thumbprint

 A unique hash value that identifies the certificate.
Invalid Before A "start" date and time that must be met before a certificate can be used.
Expiration Date The date and time when the certificate expires and can no longer be used.

Toolbar options follow.

Table 197: Trusted Certificates: Toolbar
Option Description
Upload New Trusted CA Certificate

Add a trusted certificate.

Delete Selected

Delete the selected certificate.

Refresh

Update the list of certificates.

Adding a trusted certificate

Prior to adding an asset that uses SSL server certificate validation, add the certificate's root CA and any intermediate CAs to the Trusted Certificates store in Safeguard for Privileged Passwords. For more information, see Verify SSL Certificate.

You may need to add the syslog server certificate if it is signed by the same CA.

If a certificate upload fails, the audit log reflects: TrustedCertificateUploadFailed or ServerCertificateUploadFailed.

To add a trusted certificate

  1. Go to the following:
    • web client: Navigate to Certificates | Trusted CA Certificates.
    • desktop client: Navigate to Administrative Tools | Settings | Certificates | Trusted Certificates.

  2. Click  Upload New Trusted CA Certificate from the details toolbar.

  3. Browse and select the certificate file then click Open.

  4. On the dialog box, enter the case sensitive passphrase to import the certificate. If the certificate does not have a private key passphrase, leave the field empty and click OK.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating