Chat now with support
Chat with Support

One Identity Safeguard for Privileged Passwords 7.0.3 LTS - Administration Guide

Introduction System requirements and versions Using API and PowerShell tools Using the virtual appliance and web management console Cloud deployment considerations Setting up Safeguard for Privileged Passwords for the first time Using the web client Home Privileged access requests Appliance Management
Appliance Backup and Retention Certificates Cluster Enable or Disable Services External Integration Real-Time Reports Safeguard Access Appliance Management Settings
Asset Management
Account Automation Accounts Assets Partitions Discovery Profiles Tags Registered Connectors Custom platforms
Security Policy Management
Access Request Activity Account Groups Application to Application Cloud Assistant Asset Groups Entitlements Linked Accounts User Groups Security Policy Settings
User Management Reports Disaster recovery and clusters Administrator permissions Preparing systems for management Troubleshooting Frequently asked questions Appendix A: Safeguard ports Appendix B: SPP and SPS join guidance Appendix C: Regular Expressions About us

Creating an SMTP Certificate Signing Request

If you do not want to use a default SMTP client certificate provided with Safeguard for Privileged Passwords, you can enroll a certificate using a Certificate Signing Request (CSR) to replace the default SMTP client certificate. You can return to the default certificate later.

To create a CSR for a SMTP certificate

  1.  Go to SMTP Certificate:
    • web client: Navigate to Certificates > SMTP Certificate.
  2. Click the Add Certificate button for the certificate to be replaced and select Create Certificate Signing Request (CSR).
  3. In the Certificate Signing Request dialog, enter the following information:

    1. Subject (Distinguished Name): Enter the distinguished name of the person or entity to whom the certificate is being issued in the proper format like: cn=common name,ou=organizational unit,o=organization. Using the format example, cn=sam doe,ou=marketing,o=mycompany. Maximum length is 500 characters.

      • Click Use Distinguished Name Creator to create the distinguished name based on your entries in Fully Qualified Domain Name (required), Department, Organization, City/Locality, State/County/Region, and Country.

    2. Key Size: Select the bit length of the private key pair. The bit length determines the security level of the SSL certificate. A larger key size is more secure but encryption is slower.

      • 1024
      • 2048 (default)

      • 4096

  4. Click OK then Save to save your selections and enroll the certificate. The certificate is listed in the SMTP Certificates pane.

Installing an SMTP certificate

It is recommended that you not use the default SMTP client certificate provided with Safeguard for Privileged Passwords.

To replace the default SMTP client certificate with your own, the certificate must have the following:

  • Enhanced Key Usage extension with the Server Authentication (1.3.6.1.5.5.7.3.1) OID value.
  • Digital Signature key Usage extension with the Server Authentication (2.5.29.37.3) OID value.

CSRs may be installed in the following formats.

  • Install Certificate generated from CSR including:
    • DER Encoded Files (.cer, .crt, or .der)
    • PEM Encoded Files (.pem)
  • Install Certificate with Private Key including:
    • PKCS#12 (.p12 or .pfx)
    • Personal Information Exchange Files (.pfx)

To install a SMTP signing certificate

  1.  Go to SMTP Certificate:
    • web client: Navigate to Certificates > SMTP Certificate.

    The SMTP Certificate pane displays the following information for the SMTP certificates stored in the database.

  2. Click the Add Certificate button for the SMTP certificate to be replaced. Select the appropriate option:

    • Install Certificate generated from CSR
    • Install Certificate with Private Key
  3. Browse to select the certificate file and click OK.
  4. Once installed, this new certificate will replace the default certificate listed on the SMTP Certificate pane.

To use the default certificate

  1. To use the default SMTP certificate provided with Safeguard for Privileged Passwords, go to SMTP Certificate:
    • web client: Navigate to Certificates > SMTP Certificate.
  2. Click the Use Default button for the SMTP certificate to be replaced with the default.
  3. On the warning Use Default dialog, type in the word Default to confirm you will be returning to the default certificate.
  4. Click OK.

SSL/TLS Certificates

Safeguard for Privileged Passwords enables an Appliance Administrator to upload SSL certificates with private keys or enroll SSL certificates via a CSR.

Initially, the default self-signed SSL certificate used for HTTPS is listed and assigned to the appliance. This default certificate is not a trusted certificate and should be replaced.

Go to the following selection, based on your client:

  • web client: Navigate to Certificates > SSL/TLS Certificates.

To display the following information for the SSL/TLS certificates, select a certificate.

Table 33: SSL Certificates: Properties
Property Description
Subject

The name of the subject (such as user, program, computer, service, or other entity) assigned to the certificate when it was requested.

Appliances

Lists the name of the appliance to which the certificate is assigned.

Issued By

The name of the certificate authority (CA) that issued the certificate.

Thumbprint

A unique hash value that identifies the certificate.

Alternate DNS Names

Additional or alternate host names (such as, sites or common names) that were specified when the certificate was requested.. For more information, see Creating an audit log Certificate Signing Request.

Alternate IP Addresses

Additional or alternate host names (such as, IP addresses or common names) that were specified when the certificate was requested. For more information, see Creating an audit log Certificate Signing Request.

For the default self-signed SSL certificate, the name and IP address of the appliance is used.

Invalid Before

A start date and time that must be met before a certificate can be used.

Expiration Date

The date and time when the certificate expires and can no longer be used.

Use these toolbar buttons to manage SSL certificates.

Table 34: SSL Certificates: Toolbar
Option Description
Add Certificate > Upload Certificate

Upload an SSL certificate.

For more information, see Installing an SSL/TLS certificate.

Add Certificate > Create Certificate Signing Request (CSR)

Create a CSR to enroll a certificate.

For more information, see Creating an SSL/TLS Certificate Signing Request.

Refresh

Update the list of SSL certificates available (uploaded to Safeguard for Privileged Passwords).

Assign Certificate to Appliance(s)

Assign the selected certificate to one or more appliances.

For more information, see Assigning an SSL/TLS certificate to appliances.

Unassign Certificate from Appliances

Unassign the selected certificate from one or more appliances.

Delete Selected

Delete the selected certificate from Safeguard for Privileged Passwords.

Creating an SSL/TLS Certificate Signing Request

When creating a CSR, you uniquely identify the user or entity that will use the requested certificate. Safeguard for Privileged Passwords allows you to upload or enroll SSL certificates using CSRs. Once uploaded or enrolled, the SSL certificate is added to the SSL certificate store allowing you to assign it to one or more Safeguard for Privileged Passwords Appliances.

To create a CSR for SSL

  1.  Go to the following selection, based on your client:
    • web client: Navigate to Certificates > SSL/TLS Certificates.
  2. Click Add Certificate and select Create Certificate Signing Request (CSR).
  3. In the Certificate Signing Request dialog, enter the following information:

    1. Subject (Distinguished Name): Enter the distinguished name of the person or entity to whom the certificate is being issued in the proper format like: cn=common name,ou=organizational unit,o=organization. Using the format example, cn=sam doe,ou=marketing,o=mycompany. Maximum length is 500 characters.

      • Click Use Distinguished Name Creator to create the distinguished name based on your entries in Fully Qualified Domain Name (required), Department, Organization, City/Locality, State/County/Region, and Country.

    2. Subject Alternate Names (DNS): Optionally, enter the Data Source Name (DNS) name of the server that will be protected by this certificate. For example, this might be the DNS names of all of the appliances in the Safeguard for Privileged Passwords cluster.

      If the DNS name changes, you must generate a new certificate.

    3. Subject Alternate Names (IP Address): Optionally, enter the IP addresses of the server that will be protected by this certificate. For example, this might be the IP addresses of all the appliances in the Safeguard for Privileged Passwords cluster.

      If the IP address changes, you must generate a new certificate.

    4. Key Size: Select the bit length of the private key pair. The bit length determines the security level of the SSL certificate. A larger key size is more secure but encryption is slower.

      • 1024
      • 2048 (default)

      • 4096

  4. Click OK. You are prompted with a message like: Please save and submit the following Certificate Signing Request to a Certificate Authority (CA).

  5. Click Save to save the CSR to a file. If you do not save the CSR, you will have to generate another one.
  6. In the Certificate Signing Request pane, click Refresh to update the list of certificates added.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating