Chat now with support
Chat with Support

One Identity Safeguard for Privileged Passwords 7.3 - Administration Guide

Introduction System requirements and versions Using API and PowerShell tools Using the virtual appliance and web management console Cloud deployment considerations Setting up Safeguard for Privileged Passwords for the first time Using the web client Home Privileged access requests Appliance Management
Appliance Backup and Retention Certificates Cluster Global Services External Integration Real-Time Reports Safeguard Access Appliance Management Settings
Asset Management
Account Automation Accounts Assets Partitions Discovery Profiles Tags Registered Connectors Custom platforms
Security Policy Management
Access Request Activity Account Groups Application to Application Cloud Assistant Asset Groups Entitlements Linked Accounts User Groups Security Policy Settings
User Management Reports Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions Appendix A: Safeguard ports Appendix B: SPP and SPS join guidance Appendix C: Regular Expressions About us

Audit Log Signing Certificate

The Audit Log Signing Certificate pane on the Certificates setting page displays details about the certificate used to sign the audit log files saved to an archive server.

The audit log signing certificate proves that the audit logs were created by and came from a particular Safeguard for Privileged Passwords (SPP) cluster.

Define an audit log signing certificate

You can have only one audit log signing certificate defined, which is used by all Safeguard for Privileged Passwords Appliances in the same cluster. A default audit log signing certificate is supplied, however it is recommends that you load your own. If you do not upload a certificate, the default is used. For more information, see Installing an audit log certificate.

Generate a Certificate Signing Request (CSR)

Once the audit log signing certificate is defined, it is recommended you generate the Certificate Signing Request (CSR) using Create Certificate Signing Request (CSR) . For more information, see Creating an audit log Certificate Signing Request.

A common signature format is used. Each audit log archive is hashed using the SHA256 hash algorithm. The hash value is signed with the audit log signing certificate private key using RSA signing with PSS signature padding. The signature file is created using the same file name as the archive file but with the .sig file extension.

How to use the signing certificate

This signing certificate is used by administrators who want to verify that the exported audit log history originated from their Safeguard for Privileged Passwords cluster.

The certificate's public key must be available to validate the signed audit log and, in the case of a certificate chain, the certificate's issuer.

IMPORTANT: Starting with the 6.6 version of the Safeguard-ps PowerShell cmdlets, a new cmdlet called Test-SafeguardAuditLogArchive has been added. This cmdlet will verify all of the audit log files in the archived zip file in one command and show the results for each file. When running the cmdlet you are validating the signature of each individual log file within the zip file; you are not validating the signature of the zip file. See OneIdentity/safeguard-ps.

The following instructions are also provided should you wish to use OpenSSL or would like more information on what the PowerShell cmdlet does.

  1. Get the audit log public certificate. See the following:
    • If you are using your own PKI, the public certificate should be available
    • Get the public certificate in Base64 format from the SPP API at:
      GET /AuditLog/Retention/SigningCertificate
  2. If the public certificate is obtained from the API, save the Base64 data to cert.pem
  3. Use OpenSSL to convert the pem file to a public key file.
    • openssl x509 -pubkey -in cert.pem -noout > cert.pub
  4. Use OpenSSL to verify that the audit log file has been signed and the contents are valid.
    • openssl dgst -sha256 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:-1 -signature <signature-file>.sig -verify cert.pub <audit-log-file>
Manage audit log signing certificates

Go to Audit Log Signing Certificate:

  • web client: Navigate to Certificates > Audit Log Signing Certificate.

The following properties and controls are available to manage your audit log signing certificate.

Table 24: Audit Log Certificates: Properties
Properties/Controls Description
Refresh

Click Refresh to update the certificate displayed on the Audit Log Certificates pane.

Subject

The name of the subject (such as user, program, computer, service or other entity) assigned to the certificate when it was requested.

Thumbprint

A unique hash value that identifies the certificate.

Use Default

Click Use Default to reset the certificate back to the default supplied by Safeguard for Privileged Passwords.

Add Certificate

Click Add Certificate and select one of the following options to replace the default certificate with a new certificate:

  • Install Certificate generated from CSR
  • Install Certificate with Private Key
  • Create Certificate Signing Request (CSR)

Creating an audit log Certificate Signing Request

If you do not want to use a default sessions certificate provided with Safeguard for Privileged Passwords, you can enroll a certificate using a Certificate Signing Request (CSR) to replace the default certificate. You can return to the default certificate later.

To create a CSR for an audit log signing certificate

  1. Go to Audit Log Signing Certificate:
    • web client: Navigate to Certificates > Audit Log Signing Certificate.
  2. Click Add Certificate and select Create Certificate Signing Request (CSR).
  3. In the Audit Log Signing Certificate dialog, enter the following information:

    1. Subject (Distinguished Name): Enter the distinguished name of the person or entity to whom the certificate is being issued in the proper format like: cn=common name,ou=organizational unit,o=organization. Using the format example, cn=sam doe,ou=marketing,o=mycompany. Maximum length is 500 characters.

      • Click Use Distinguished Name Creator to create the distinguished name based on your entries in Fully Qualified Domain Name (required), Department, Organization, City/Locality, State/County/Region, and Country.

    2. Subject Alternate Names (DNS): Optionally, enter the Data Source Name (DNS) name of the server that will be protected by this certificate. For example, this might be the DNS names of all of the appliances in the Safeguard for Privileged Passwords cluster.

      If the DNS name changes, you must generate a new certificate.

    3. Subject Alternate Names (IP Address): Optionally, enter the IP addresses of the server that will be protected by this certificate. For example, this might be the IP addresses of all the appliances in the Safeguard for Privileged Passwords cluster.

      If the IP address changes, you must generate a new certificate.

    4. Key Size: Select the bit length of the private key pair. The bit length determines the security level of the SSL certificate. A larger key size is more secure but encryption is slower.

      • 1024
      • 2048 (default)

      • 4096

  4. Click OK . You are prompted with a message like: Please save and submit the following Certificate Signing Request to a Certificate Authority (CA).

  5. Click Save to save the CSR to a file. If you do not save the CSR, you will have to generate another one.
  6. In the Certificate Signing Request pane, click Refresh to update the list of certificates added.

Installing an audit log certificate

It is recommended that you not use the default certificate provided with Safeguard for Privileged Passwords. Instead, replace it with another certificate with a private key.

To replace the default certificate with your own, the certificate must have the following:

  • Key Usage extension with the Digital Signature bit set.

  • Key Usage extension with the Non-Repudiation bit set.

CSRs may be installed in the following formats.

  • Install Certificate generated from CSR including:
    • DER Encoded Files (.cer, .crt, or .der)
    • PEM Encoded Files (.pem)
  • Install Certificate with Private Key including:
    • PKCS#12 (.p12 or .pfx)
    • Personal Information Exchange Files (.pfx)

To install an audit log signing certificate

  1. Go to Audit Log Signing Certificate:

    • web client: Navigate to Certificates > Audit Log Signing Certificate.

  2. Click Add Certificate for the sessions certificate to be replaced. Select the appropriate option:

    • Install Certificate generated from CSR
    • Install Certificate with Private Key
  3. Browse and select the certificate file then click Open.
  4. If you are installing a certificate with a private key, a dialog box displays. Enter the case sensitive passphrase to import the certificate. If the certificate does not have a private key passphrase, leave the field empty and click OK.
  5. Once installed, this new certificate will replace the default certificate listed on the Audit Log Signing Certificate pane.

If an audit log signing certificate upload fails, the audit log reflects: AuditLogSigningCertificateUploadFailed.

To use the default certificate

You can use the default sessions certificate provided with Safeguard for Privileged Passwords

  1. Go to Audit Log Signing Certificate:
    • web client: Navigate to Certificates > Audit Log Signing Certificate
  2. Click the Use Default button for the audit log signing certificate to be replaced with the default.
  3. On the warning Use Default dialog, type in the word Default to confirm you will be returning to the default certificate.
  4. Click Default to confirm.

Certificate Signing Request

Some certificates require a digital signature before a certification authority (CA) can process the certificate request. You may need to create a certificate signing request in Safeguard for Privileged Passwords for the following:

The Certificate Signing Request pane displays details about any certificates enrolled via Certificate Signing Requests (CSRs). From this pane, you can also delete a CSR.

Go to Audit Log Signing Certificate:

  • web client: Navigate to Certificates > Certificate Signing Request.

Certificates enrolled via a CSR appear on this pane including the following details.

Table 25: Certificate Signing Request: Properties
Property Description
Subject

The distinguished name of the person or entity to whom the certificate is being issued

Certificate Type

The type of certificate requested:

  • Audit Log Signing Certificate
  • SSL Certificate

Key Size

 The bit length of the private key pair

Thumbprint

 A unique hash value that identifies the certificate

Expiration Date (web client)

The date the CSR expires, if any.

Alternate DNS Names

Additional or alternate host names (such as, sites or common names) that were specified when the certificate was requested.. For more information, see Creating an audit log Certificate Signing Request.

Alternate IP Addresses

Additional or alternate host names (such as, IP addresses or common names) that were specified when the certificate was requested. For more information, see Creating an audit log Certificate Signing Request.

Use these toolbar buttons to manage certificate signing requests.

Table 26: Certificate Signing Request: Toolbar
Option Description
Delete Signing Request

Delete the selected CSR from Safeguard for Privileged Passwords.

Refresh Update the list of CSRs.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating