Chat now with support
Chat with Support

One Identity Safeguard for Privileged Passwords 6.7 - Administration Guide

Introduction System requirements and versions Using API and PowerShell tools Using the virtual appliance and web management console Cloud deployment considerations Setting up Safeguard for Privileged Passwords for the first time Using the web client Getting started with the desktop client Using the desktop client Search box Privileged access requests Toolbox Accounts Account Groups Assets Asset Groups Discovery Entitlements Partitions Settings
Access Request settings Appliance settings Asset Management settings Backup and Retention settings Certificates settings Cluster settings Enable or Disable Services settings External Integration settings Messaging settings (desktop client) Password Management settings Safeguard Access settings SSH Key Management settings
Users User Groups Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions Appendix A: Safeguard ports Appendix B: SPP 2.7 or later migration guidance Appendix C: SPP and SPS join guidance Appendix D: Regular Expressions SPP Glossary About us

Trusted CA Certificates

It is the responsibility of the Appliance Administrator to add or remove trusted root certificates to the Safeguard for Privileged Passwords Appliance. If you are going to verify the server certificate, then you do need a certificate from the server certificates chain of trust in Trusted Certificates.

Examples:

  • If you uploaded a syslog client certificate with a private key, you may need to upload the certificate's root CA to the list of trusted certificates. For more information, see Syslog Client Certificate.
  • An SSL/TLS certificate must be trusted to resolve the chain of authority. For an SSL/TSL certificate, when Safeguard for Privileged Passwords connects to an asset that has the Verify SSL Certificate option enabled, the signing authority of the certificate presented by the asset is compared to the certificates in the trusted certificate store. For more information, see Verify SSL Certificate.

Go to the following selection, based on your client:

  • web client: Navigate to  Settings | Certificates | Trusted CA Certificates.
  • desktop client: Navigate to  Settings | Certificates | Trusted Certificates.

Select a certificate to display the following information for the user-supplied certificates added to the trusted certificate store.

Table 145: Trusted CA certificates: Properties
Property Description
Subject The name of the subject (such as user, program, computer, service or other entity) assigned to the certificate when it was requested.

Issued By

The name of the certificate authority (CA) that issued the certificate.

Certificate Type

Trusted

Thumbprint

A unique hash value that identifies the certificate.
Invalid Before A "start" date and time that must be met before a certificate can be used.
Expiration Date The date and time when the certificate expires and can no longer be used.

Toolbar options follow.

Table 146: Trusted Certificates: Toolbar
Option Description
Upload New Trusted CA Certificate

Add a trusted certificate.

Delete Selected

Delete the selected certificate.

Refresh

Update the list of certificates.

Adding a trusted certificate

Prior to adding an asset that uses SSL server certificate validation, add the certificate's root CA and any intermediate CAs to the Trusted Certificates store in Safeguard for Privileged Passwords. For more information, see Verify SSL Certificate.

You may need to add the syslog server certificate if it is signed by the same CA.

If a certificate upload fails, the audit log reflects: TrustedCertificateUploadFailed or ServerCertificateUploadFailed.

To add a trusted certificate

  1. Go to the following selection, based on your client:
    • web client: Navigate to  Settings | Certificates | Trusted CA Certificates.
    • desktop client: Navigate to Administrative Tools | Settings | Certificates | Trusted Certificates.
  2. Click  Upload New Trusted CA Certificate from the details toolbar.

  3. Browse and select the certificate file then click Open.
  4. On the dialog box, enter the case sensitive passphrase to import the certificate. If the certificate does not have a private key passphrase, leave the field empty and click OK.

Removing a trusted certificate

To remove certificates from the appliance

  1. Go to the following selection, based on your client:
    • web client: Navigate to  Settings | Certificates | Trusted CA Certificates.
    • desktop client: Navigate to Administrative Tools | Settings | Certificates | Trusted Certificates.
  2. Select a certificate.
  3. Click  Delete Trusted CA Certificate from the details toolbar.

    Important: Safeguard for Privileged Passwords does not allow you to remove built-in certificate authorities.

Cluster settings

Use the Cluster settings to create a clustered environment, to monitor the health of the cluster and its members, and to define managed networks for high availability and load distribution.

It is the responsibility of the Appliance Administrator or the Operations Administrator to create a cluster, monitor the status of the cluster, and define managed networks.

Before creating a Safeguard for Privileged Passwords cluster, become familiar with the Disaster recovery and clusters chapter to understand:

  • Go to Clusters:
    • web client: Navigate to  Settings | Cluster.
    • desktop client: Navigate to Administrative Tools | Settings | Cluster.
    Table 147: Cluster settings
    Setting Description

    Cluster Management

    Where you create and manage a cluster and monitor the health of the cluster and its members.

    Managed Networks

    Where you define managed networks to distribute the task load for the clustered environment.

    Offline Workflow (automatic)

    Where you configure Offline Workflow Mode to automatically trigger if an appliance has lost consensus (quorum) and, optionally, automatically resume online workflow. You can also manually Enable Offline Workflow and Resume Online Operations from this dialog. For more information, see About Offline Workflow Mode.

    Session Appliances with SPS join

    Where you view, edit, and delete join connections when a Safeguard for Privileged Sessions (SPS) cluster is joined to a Safeguard for Privileged Password (SPP) for session recording and auditing. For more information, see SPP and SPS sessions appliance join guidance.

  • Related Documents

    The document was helpful.

    Select Rating

    I easily found the information I needed.

    Select Rating