Chat now with support
Chat with Support

One Identity Safeguard for Privileged Passwords 6.7 - Administration Guide

Introduction System requirements and versions Using API and PowerShell tools Using the virtual appliance and web management console Cloud deployment considerations Setting up Safeguard for Privileged Passwords for the first time Using the web client Getting started with the desktop client Using the desktop client Search box Privileged access requests Toolbox Accounts Account Groups Assets Asset Groups Discovery Entitlements Partitions Settings
Access Request settings Appliance settings Asset Management settings Backup and Retention settings Certificates settings Cluster settings Enable or Disable Services settings External Integration settings Messaging settings (desktop client) Password Management settings Safeguard Access settings SSH Key Management settings
Users User Groups Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions Appendix A: Safeguard ports Appendix B: SPP 2.7 or later migration guidance Appendix C: SPP and SPS join guidance Appendix D: Regular Expressions SPP Glossary About us

Certificates settings

Use the Certificate settings to manage the certificates used to secure One Identity Safeguard for Privileged Passwords. The panes on this page display default certificates that can be replaced or user-supplied certificates that have been added to Safeguard for Privileged Passwords.

It is the responsibility of the Appliance Administrator to manage the Certificate Signing Requests (CSRs) used by Safeguard for Privileged Passwords.

Go to Certificates:

  • web client: Navigate to  Settings | Certificates.
  • desktop client: Navigate to Administrative Tools | Settings | Certificates.
Table 137: Certificates settings
Setting Description

Audit Log Signing Certificate

Where you manage the audit log signing certificate used to validate audit logs stored on an archive server. When the audit log is exported, the log is signed with this certificate to ensure that it is legitimate and has not been tampered with after export.

Certificate Signing Request

Where you can view and manage certificate signing requests (CSRs) that have been issued by Safeguard for Privileged Passwords. CSRs that may be created in Safeguard for Privileged Passwords include: Audit Log Signing Certificate, SMTP Client Certificate, SSL Certificates, or Syslog Client Certificates.

SMTP Certificate

Where you manage SMTP client certificates.

SSL/TLS Certificates Where you manage SSL/TLS certificates, including installing certificates or creating CSRs to enroll a public SSL/TLS certificate. This certificate is used to secure all HTTP traffic.

Syslog Client Certificate

Where you manage the syslog client certificate used to secure traffic between Safeguard for Privileged Passwords and the syslog server.

Trusted CA Certificates Where you add and manage certificates trusted by Safeguard for Privileged Passwordsand used to verify the chain of trust on certificates for various usages. For example , a trusted certificate may be your company's root Certificate Authority (CA) certificate or an intermediate certificate .

About Certificate Signing Requests (CSRs)

You can create a certificate signing request (CSR) in Safeguard for Privileged Passwords. The private key is kept securely on the Safeguard for Privileged Passwords Appliance and is not released. The public key and details are in an encoded text file. Here is the process:

  1. Create a CSR through Safeguard for Privileged Passwords. See:
  2. Submit the encoded text file to a Certificate Authority (CA) to create an appropriate X509 certificate that is trusted by other entities trusting the CA.
  3. Install the certificate generated by the CA on Safeguard for Privileged Passwords where it is associated with the private key. See:
  4. If necessary, add the CA certification to Trusted Certificates in Safeguard for Privileged Passwords. For more information, see Trusted CA Certificates.

The certificate infrastructure in One Identity Safeguard for Privileged Passwords consists of the following.

Replaceable certificates

One Identity Safeguard for Privileged Passwords ships with the following default certificates which are untrusted and are meant to be replaced:

User-supplied certificates

You can specify the security certificates to be used. When replacing or adding certificates, keep the following considerations in mind:

  • Safeguard for Privileged Passwords supports Certificate Signing Requests (CSRs) to enroll any type of certificate. CSRs use the Public-Key Cryptography Standard (PKCS) #10 format.
  • For imports, Safeguard for Privileged Passwords must access the relevant network resources to validate the CRL end points specified in the signed CSR.

  • For uploading certificates with private keys, Safeguard for Privileged Passwords supports .pfx ( or .p12) files that follow the PKCS #12 standard.

  • For installing certificates generated with a CSR, Safeguard for Privileged Passwords supports DER Encoded Files (.cer, .crt, or .der) and PEM Encoded Files (.pem).
  • For SSL/TLS certificates, Safeguard for Privileged Passwords allows you to upload or use a CSR to enroll multiple certificates that can then be applied to different appliances.
  • Safeguard for Privileged Passwords provides an SSL/TLS certificate store that allows you to assign any uploaded or enrolled a certificate to any appliance.
  • Consider if the server's signing authority certificate must be added to the Trusted Certificates store in Safeguard for Privileged Passwords. For example, prior to adding an asset that uses SSL/TLS server certificate validation, you must add the signing authority certificate to the Trusted Certificates store. Or, if you uploaded a syslog certificate with a private key, you may upload the certificate's root CA to the list of trusted certificates. For more information, see Trusted CA Certificates.

Audit Log Signing Certificate

The Audit Log Signing Certificate pane on the Certificates setting page displays details about the certificate used to sign the audit log files saved to an archive server.

The audit log signing certificate proves that the audit logs were created by and came from a particular Safeguard for Privileged Passwords (SPP) cluster.

Define an audit log signing certificate

You can have only one audit log signing certificate defined, which is used by all Safeguard for Privileged Passwords Appliances in the same cluster. A default audit log signing certificate is supplied, however it is recommends that you load your own. If you do not upload a certificate, the default is used. For more information, see Installing an audit log certificate.

Generate a Certificate Signing Request (CSR)

Once the audit log signing certificate is defined, it is recommended you generate the Certificate Signing Request (CSR) using Create Certificate Signing Request (CSR) . For more information, see Creating an audit log Certificate Signing Request.

A common signature format is used. Each audit log archive is hashed using the SHA256 hash algorithm. The hash value is signed with the audit log signing certificate private key using RSA signing with PSS signature padding. The signature file is created using the same file name as the archive file but with the .sig file extension.

How to use the signing certificate

This signing certificate is used by administrators who want to verify that the exported audit log history originated from their Safeguard for Privileged Passwords cluster.

The certificate's public key and the certificate's issuer, must be available to validate the signed audit log.

  1. Get the audit log public certificate. See the following:
    • If you are using your own PKI, the public certificate should be available
    • Get the public certificate in Base64 format from the SPP API at:
      GET /AuditLog/Retention/SigningCertificate
  2. If the public certificate is obtained from the API, save the Base64 data to cert.pem
  3. Use OpenSSL to convert the pem file to a public key file.
    • openssl x509 -pubkey -in cert.pem -noout > cert.pub
  4. Use OpenSSL to verify that the audit log file has been signed and the contents are valid.
    • openssl dgst -sha256 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:-1 -signature <signature-file>.sig -verify cert.pub <audit-log-file>
PowerShell cmdlet

Starting with the 6.6 version of the Safeguard-ps PowerShell cmdlets, a new cmdlet called Test-SafeguardAuditLogArchive has been added. This cmdlet will verify all of the audit log files in the archived zip file in one command and show the results for each file. See OneIdentity/safeguard-ps.

Manage audit log signing certificates

Go to Audit Log Signing Certificate:

  • web client: Navigate to  Settings | Certificates | Audit Log Signing Certificate.
  • desktop client: Navigate to Administrative Tools | Settings | Certificates | Audit Log Signing Certificate.

The following properties and controls are available to manage your audit log signing certificate.

Table 138: Audit Log Certificates: Properties
Properties/Controls Description
Refresh

Click Refresh to update the certificate displayed on the Audit Log Certificates pane.

Subject

The name of the subject (such as user, program, computer, service or other entity) assigned to the certificate when it was requested.

Thumbprint

A unique hash value that identifies the certificate.

Use Default

Click Use Default to reset the certificate back to the default supplied by Safeguard for Privileged Passwords.

Add Certificate

Click Add Certificate and select one of the following options to replace the default certificate with a new certificate:

  • Install Certificate generated from CSR
  • Install Certificate with Private Key
  • Create Certificate Signing Request (CSR)

Creating an audit log Certificate Signing Request

If you do not want to use a default sessions certificate provided with Safeguard for Privileged Passwords, you can enroll a certificate using a Certificate Signing Request (CSR) to replace the default certificate. You can return to the default certificate later.

To create a CSR for an audit log signing certificate

  1. Go to Audit Log Signing Certificate:
    • web client: Navigate to  Settings | Certificates | Audit Log Signing Certificate.
    • desktop client: Navigate to Administrative Tools | Settings | Certificates | Audit Log Signing Certificate.
  2. Click Add Certificate and select Create Certificate Signing Request (CSR).
  3. In the Audit Log Signing Certificate dialog, enter the following information:
    1. Subject (Distinguished Name): Enter the distinguished name of the person or entity to whom the certificate is being issued in the proper format like: cn=common name,ou=organizational unit,o=organization. Using the format example, cn=john doe,ou=marketing,o=mycompany. Maximum length is 500 characters.

      • Click Use Distinguished Name Creator to create the distinguished name based on your entries in Fully Qualified Domain Name (required), Department, Organization, City/Locality, State/County/Region, and Country.
    2. Subject Alternate Names (DNS): Optionally, enter the Data Source Name (DNS) name of the server that will be protected by this certificate. For example, this might be the DNS names of all of the appliances in the Safeguard for Privileged Passwords cluster.
      If the DNS name changes, you must generate a new certificate.
    3. Subject Alternate Names (IP Address): Optionally, enter the IP addresses of the server that will be protected by this certificate. For example, this might be the IP addresses of all the appliances in the Safeguard for Privileged Passwords cluster.
      If the IP address changes, you must generate a new certificate.
    4. Key Size: Select the bit length of the private key pair. The bit length determines the security level of the SSL certificate. A larger key size is more secure but encryption is slower.

      • 1024
      • 2048 (default)
      • 4096

  4. Click OK . You are prompted with a message like: Please save and submit the following Certificate Signing Request to a Certificate Authority (CA).

  5. Click Save to save the CSR to a file. If you do not save the CSR, you will have to generate another one.
  6. In the Certificate Signing Request pane, click Refresh to update the list of certificates added.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating