If you do not want to use a default sessions certificate provided with SPP, you can enroll a certificate using a Certificate Signing Request (CSR) to replace the default certificate. You can return to the default certificate later.

To create a CSR for an audit log signing certificate

  1. Go to Audit Log Signing Certificate:
    • web client: Navigate to Certificates > Audit Log Signing Certificate.
  2. Click Add Certificate and select Create Certificate Signing Request (CSR).
  3. In the Audit Log Signing Certificate dialog, enter the following information:

    1. Subject (Distinguished Name): Enter the distinguished name of the person or entity to whom the certificate is being issued in the proper format like: cn=common name,ou=organizational unit,o=organization. Using the format example, cn=sam doe,ou=marketing,o=mycompany. Maximum length is 500 characters.

      • Click Use Distinguished Name Creator to create the distinguished name based on your entries in Fully Qualified Domain Name (required), Department, Organization, City/Locality, State/County/Region, and Country.

    2. Subject Alternate Names (DNS): Optionally, enter the Data Source Name (DNS) name of the server that will be protected by this certificate. For example, this might be the DNS names of all of the appliances in the SPP cluster.

      If the DNS name changes, you must generate a new certificate.

    3. Subject Alternate Names (IP Address): Optionally, enter the IP addresses of the server that will be protected by this certificate. For example, this might be the IP addresses of all the appliances in the SPP cluster.

      If the IP address changes, you must generate a new certificate.

    4. Key Size: Select the bit length of the private key pair. The bit length determines the security level of the SSL certificate. A larger key size is more secure but encryption is slower.

      • 1024
      • 2048 (default)

      • 4096

  4. Click OK . You are prompted with a message like: Please save and submit the following Certificate Signing Request to a Certificate Authority (CA).

  5. Click Save to save the CSR to a file. If you do not save the CSR, you will have to generate another one.
  6. In the Certificate Signing Request pane, click Refresh to update the list of certificates added.