Creating an audit log Certificate Signing Request
If you do not want to use a default sessions certificate provided with Safeguard for Privileged Passwords, you can enroll a certificate using a Certificate Signing Request (CSR) to replace the default certificate. You can return to the default certificate later.
To create a CSR for an audit log signing certificate
- Go to Audit Log Signing Certificate:
web client: Navigate to
Certificates | Audit Log Signing Certificate.
desktop client: Navigate to Administrative Tools | Settings | Certificates | Audit Log Signing Certificate.
- Click Add Certificate and select Create Certificate Signing Request (CSR).
- In the Audit Log Signing Certificate dialog, enter the following information:
-
Subject (Distinguished Name): Enter the distinguished name of the person or entity to whom the certificate is being issued in the proper format like: cn=common name,ou=organizational unit,o=organization. Using the format example, cn=sam doe,ou=marketing,o=mycompany. Maximum length is 500 characters.
- Click Use Distinguished Name Creator to create the distinguished name based on your entries in Fully Qualified Domain Name (required), Department, Organization, City/Locality, State/County/Region, and Country.
- Subject Alternate Names (DNS): Optionally, enter the Data Source Name (DNS) name of the server that will be protected by this certificate. For example, this might be the DNS names of all of the appliances in the Safeguard for Privileged Passwords cluster.
If the DNS name changes, you must generate a new certificate.
- Subject Alternate Names (IP Address): Optionally, enter the IP addresses of the server that will be protected by this certificate. For example, this might be the IP addresses of all the appliances in the Safeguard for Privileged Passwords cluster.
If the IP address changes, you must generate a new certificate.
-
Key Size: Select the bit length of the private key pair. The bit length determines the security level of the SSL certificate. A larger key size is more secure but encryption is slower.
-
Click OK . You are prompted with a message like: Please save and submit the following Certificate Signing Request to a Certificate Authority (CA).
- Click Save to save the CSR to a file. If you do not save the CSR, you will have to generate another one.
- In the Certificate Signing Request pane, click
Refresh to update the list of certificates added.
Installing an audit log certificate
It is recommended that you not use the default certificate provided with Safeguard for Privileged Passwords. Instead, replace it with another certificate with a private key.
To replace the default certificate with your own, the certificate must have the following:
- Enhanced Key Usage extension with the Server Authentication (1.3.6.1.5.5.7.3.1) OID value.
- Digital Signature key Usage extension with the Server Authentication (2.5.29.37.3) OID value.
CSRs may be installed in the following formats.
- Install Certificate generated from CSR including:
- DER Encoded Files (.cer, .crt, or .der)
- PEM Encoded Files (.pem)
- Install Certificate with Private Key including:
- PKCS#12 (.p12 or .pfx)
- Personal Information Exchange Files (.pfx)
To install an audit log signing certificate
-
Go to Audit Log Signing Certificate:
web client: Navigate to
Certificates | Audit Log Signing Certificate.
desktop client: Navigate to Administrative Tools | Settings | Certificates | Audit Log Signing Certificate.
-
Click Add Certificate for the sessions certificate to be replaced. Select the appropriate option:
- Install Certificate generated from CSR
- Install Certificate with Private Key
- Browse and select the certificate file then click Open.
- If you are installing a certificate with a private key, a dialog box displays. Enter the case sensitive passphrase to import the certificate. If the certificate does not have a private key passphrase, leave the field empty and click OK.
- Once installed, this new certificate will replace the default certificate listed on the Audit Log Signing Certificate pane.
If an audit log signing certificate upload fails, the audit log reflects: AuditLogSigningCertificateUploadFailed.
To use the default certificate
You can use the default sessions certificate provided with Safeguard for Privileged Passwords
- Go to Audit Log Signing Certificate:
web client: Navigate to
Certificates | Audit Log Signing Certificate
desktop client: Navigate to Administrative Tools | Settings | Certificates | Audit Log Signing Certificate.
- Click the Use Default button for the audit log signing certificate to be replaced with the default.
- On the warning Use Default dialog, type in the word Default to confirm you will be returning to the default certificate.
- Click Default to confirm.
Certificate Signing Request
Some certificates require a digital signature before a certification authority (CA) can process the certificate request. You may need to create a certificate signing request in Safeguard for Privileged Passwords for the following:
The Certificate Signing Request pane displays details about any certificates enrolled via Certificate Signing Requests (CSRs). From this pane, you can also delete a CSR.
Go to Audit Log Signing Certificate:
web client: Navigate to
Certificates | Certificate Signing Request.
desktop client: Navigate to Administrative Tools | Settings | Certificates | Certificate Signing Request.
Certificates enrolled via a CSR appear on this pane including the following details.
Table 149: Certificate Signing Request: Properties
Subject |
The distinguished name of the person or entity to whom the certificate is being issued |
Certificate Type |
The type of certificate requested:
- Audit Log Signing Certificate
- SSL Certificate
|
Key Size |
The bit length of the private key pair |
Thumbprint |
A unique hash value that identifies the certificate |
Expiration Date (web client)
Invalid After (desktop client) |
The date the CSR expires, if any. |
Alternate DNS Names |
Additional or alternate host names (such as, sites or common names) that were specified when the certificate was requested.. For more information, see Creating an audit log Certificate Signing Request. |
Alternate IP Addresses |
Additional or alternate host names (such as, IP addresses or common names) that were specified when the certificate was requested. For more information, see Creating an audit log Certificate Signing Request. |
Use these toolbar buttons to manage certificate signing requests.
Table 150: Certificate Signing Request: Toolbar
Delete Signing Request |
Delete the selected CSR from Safeguard for Privileged Passwords. |
Refresh |
Update the list of CSRs. |
Details
desktop client
|
Click to see more information about the CSR.
web client: Click the CSR.
|
SMTP Certificate
Initially, the default self-signed SMTP client certificate used is listed and assigned to the appliance. This default certificate is not a trusted certificate and should be replaced.
Considerations:
Go to SMTP Certificate:
web client: Navigate to
Certificates | SMTP Certificate.
desktop client: Navigate to Administrative Tools | Settings | Certificates | SMTP Certificate.
The SMTP Certificate pane displays the following information for the SMTP client certificates stored in the database.
Table 151: SSL Certificates: Properties
Refresh |
Update the list of SMTP client certificates available (uploaded to Safeguard for Privileged Passwords). |
Subject |
The name of the subject (such as user, program, computer, service, or other entity) assigned to the certificate when it was requested. |
Thumbprint |
A unique hash value that identifies the SMTP client certificate. |
Add Certificate |
Click Add Certificate and select one of the following options to replace the default SMTP client certificate with a new certificate:
- Install Certificate generated from CSR
- Install Certificate with Private Key
- Create Certificate Signing Request (CSR)
|
Default |
Click to return to the Safeguard for Privileged Passwords default SMTP client certificate. |