One Identity Safeguard for Privileged Sessions 6.9.3 - Administration Guide

Verifying certificates with Certificate Authorities using trust stores

One Identity Safeguard for Privileged Sessions (SPS) can check the validity of certificates using the certificates and certificate revocation lists of the certificate authorities (CA) that issued the certificates. This can be used to verify the certificates of the servers in TLS connections.

Trust stores serve as local certificate storages where you can store the certificate chains of trusted CAs. Create and configure custom trust stores to verify the certificates in TLS connections. Note that you cannot modify the built-in trust store, which contains common CA certificates that the operational system of SPS uses.

To create a custom trust store or edit an existing custom trust store

1. Navigate to Basic Settings > Trust Stores.

   Figure 181: Basic Settings > Trust Stores

   

2. In the Custom trust stores section, click Add new Trust Store. To change the settings of an existing trust store, click Edit.

   The Add new trust store or Edit trust store window opens.

   Figure 182: Basic Settings > Trust Stores — Add new trust store

   

3. In the Trust Store Name field, enter a name for the trust store. For example ts1.

4. To add the certificate of the CA to the trust store that will be used to validate the certificates, click Add certificate. The Add certificate window opens.

5. Paste or drag the PEM certificate file to the Key content field. You can also click Browse to navigate to the PEM certificate file on your computer.

   Figure 183: Basic Settings > Trust Stores — Add certificate

   

   • You will have to upload all the CA certificates from the users' certificate chains (including the root CA). Therefore, these CA certificates must be available on your computer in PEM format.

   • The certificates of the users must contain the user name used to authenticate on SPS. You must know which certificate field will contain the user names (for example, CN or UID).

   • The certificates must be imported into the browsers of the users. SPS offers the possibility to authenticate with a certificate only if a personal certificate is available in the browser.

   NOTE:

   You can only upload a single PEM certificate.

   You cannot upload multiple PEM certificates in a single file.

   To upload more PEM certificates, add them as single entities one by one.

6. Click Add.

7. Set the revocation check type for the trust store.

   • None: Do not check certificate revocation status.

   • Leaf: Check the revocation status of the peer's certificate, but do not check the revocation status of the CA certificates in the chain.

   • Full: Check the revocation status of the peer's certificate and all CA certificates in the chain.

8. If you set the revocation check type to Leaf or Full, click Add new CRL URL to specify the CRL distribution point(s) of the CA that issued the peers' certificates.

   1. Enter the URL of the Certificate Revocation List (CRL) of the CA into the CRL URL field. Certificates appearing on the CRL list will be automatically rejected.

   2. Click Remove to remove a CRL distribution point from the trust store.

9. Click Save and close the window.

10. To delete a certificate from a trust store, click Edit to open the Edit trust store window, click on the certificate, and click Delete.
11. To delete a trust store, click Edit to open the Edit trust store window, and click Delete.

12. Click .