When creating a CSR, you uniquely identify the user or entity that will use the requested certificate. Safeguard for Privileged Passwords allows you to upload or enroll SSL certificates using CSRs. Once uploaded or enrolled, the SSL certificate is added to the SSL certificate store allowing you to assign it to one or more Safeguard for Privileged Passwords Appliances.
- Go to the following selection, based on your client:
- web client: Navigate to Certificates | SSL/TLS Certificates.
- desktop client: Navigate to Administrative Tools | Settings | Certificates | SSL Certificates.
- Click Add Certificate and select Create Certificate Signing Request (CSR).
- In the Certificate Signing Request dialog, enter the following information:
Subject (Distinguished Name): Enter the distinguished name of the person or entity to whom the certificate is being issued in the proper format like: cn=common name,ou=organizational unit,o=organization. Using the format example, cn=sam doe,ou=marketing,o=mycompany. Maximum length is 500 characters.
- Click Use Distinguished Name Creator to create the distinguished name based on your entries in Fully Qualified Domain Name (required), Department, Organization, City/Locality, State/County/Region, and Country.
- Subject Alternate Names (DNS): Optionally, enter the Data Source Name (DNS) name of the server that will be protected by this certificate. For example, this might be the DNS names of all of the appliances in the Safeguard for Privileged Passwords cluster.
If the DNS name changes, you must generate a new certificate.
- Subject Alternate Names (IP Address): Optionally, enter the IP addresses of the server that will be protected by this certificate. For example, this might be the IP addresses of all the appliances in the Safeguard for Privileged Passwords cluster.
If the IP address changes, you must generate a new certificate.
Key Size: Select the bit length of the private key pair. The bit length determines the security level of the SSL certificate. A larger key size is more secure but encryption is slower.
- 2048 (default)
Click OK . You are prompted with a message like: Please save and submit the following Certificate Signing Request to a Certificate Authority (CA).
- Click Save to save the CSR to a file. If you do not save the CSR, you will have to generate another one.
- In the Certificate Signing Request pane, click Refresh to update the list of certificates added.