One Identity Safeguard for Privileged Sessions (SPS) can check the validity of certificates using the certificates and certificate revocation lists of the certificate authorities (CA) that issued the certificates. This can be used to verify the certificates of the servers in TLS connections.

Trust stores serve as local certificate storages where you can store the certificate chains of trusted CAs. Create and configure custom trust stores to verify the certificates in TLS connections. Note that you cannot modify the built-in trust store, which contains common CA certificates that the operational system of SPS uses.

You can use custom trust stores in the following locations:

Prerequisites

To specify cipher settings and version requirements that SPS uses for establishing TLS connections in the Cryptography Settings section, navigate to Basic Settings > Trust Stores.

Figure 180: Basic Settings > Trust Stores — Cryptography settings

Cipher strength specifies the cipher string OpenSSL will use. The following settings options are possible:

  • Recommended: this setting only uses ciphers with adequate security level.

  • Custom: this setting allows you to specify the list of ciphers you want to permit SPS to use in the connection. This setting is only recommended to ensure compatibility with older systems. For more details on customizing this list, check the 'openssl-ciphers' manual page on your SPS appliance.

    For example: ALL:!aNULL:@STRENGTH

Minimum TLS version specifies the minimal TLS version SPS will offer during negotiation. The following settings options are possible:

  • TLS 1.2: this setting will only offer TLS version 1.2 during negotiation. This is the recommended setting.

  • TLS 1.1: this setting will offer TLS version 1.1 and later versions during negotiation.

  • TLS 1.0: this setting will offer TLS version 1.0 and later versions during negotiation.

Maximum TLS version specifies the maximal TLS version SPS will offer during negotiation. The following settings options are possible:

  • TLS 1.2: this setting will only offer TLS version 1.2 during negotiation. This is the recommended setting.

  • TLS 1.1: this setting will offer TLS version 1.1 and later versions during negotiation.

  • TLS 1.0: this setting will offer TLS version 1.0 and later versions during negotiation.

  • Latest: this setting will offer the latest TLS version during negotiation.

NOTE: Note that SPS only permits TLS-encrypted connections. SSLv3 is not supported.

NOTE: TLS 1.1 and 1.2 support for Windows 7 Service Pack 1 (SP1) and for Windows Server 2008 R2 Service Pack 2 (SP2) is not available by default. For more information about the requirements and process of enabling this feature, click here or contact our Support Team.

To create a custom trust store or edit an existing custom trust store

  1. Navigate to Basic Settings > Trust Stores.

    Figure 181: Basic Settings > Trust Stores

  2. In the Custom trust stores section, click Add new Trust Store. To change the settings of an existing trust store, click Edit.

    The Add new trust store or Edit trust store window opens.

    Figure 182: Basic Settings > Trust Stores — Add new trust store

  3. In the Trust Store Name field, enter a name for the trust store. For example ts1.

  4. To add the certificate of the CA to the trust store that will be used to validate the certificates, click Add certificate. The Add certificate window opens.

  5. Paste or drag the PEM certificate file to the Key content field. You can also click Browse to navigate to the PEM certificate file on your computer.

    Figure 183: Basic Settings > Trust Stores — Add certificate

    • You will have to upload all the CA certificates from the users' certificate chains (including the root CA). Therefore, these CA certificates must be available on your computer in PEM format.

    • The certificates of the users must contain the user name used to authenticate on SPS. You must know which certificate field will contain the user names (for example, CN or UID).

    • The certificates must be imported into the browsers of the users. SPS offers the possibility to authenticate with a certificate only if a personal certificate is available in the browser.

    NOTE:

    You can only upload a single PEM certificate.

    You cannot upload multiple PEM certificates in a single file.

    To upload more PEM certificates, add them as single entities one by one.

  6. Click Add.

  7. Set the revocation check type for the trust store.

    • None: Do not check certificate revocation status.

    • Leaf: Check the revocation status of the peer's certificate, but do not check the revocation status of the CA certificates in the chain.

    • Full: Check the revocation status of the peer's certificate and all CA certificates in the chain.

  8. If you set the revocation check type to Leaf or Full, click Add new CRL URL to specify the CRL distribution point(s) of the CA that issued the peers' certificates.

    1. Enter the URL of the Certificate Revocation List (CRL) of the CA into the CRL URL field. Certificates appearing on the CRL list will be automatically rejected.

    2. Click Remove to remove a CRL distribution point from the trust store.

  9. Click Save and close the window.

  10. To delete a certificate from a trust store, click Edit to open the Edit trust store window, click on the certificate, and click Delete.
  11. To delete a trust store, click Edit to open the Edit trust store window, and click Delete.

  12. Click .