Top

Manage SSL Certificates

 

SSL certificates can be created, discovered, and stored in the centralized repository of Key Manager Plus, and requests can be raised for new certificates or domain addition to an existing certificate. Moreover, you are notified when a certificate is about to expire to help you with their timely renewal.

Use Key Manager Plus to:

  1. Create, discover, or import self-signed or CA issued certificates in the network.
  2. Generate Certificate Signing Request (CSR).
  3. Add requests for new certificates or adding a sub domain to an existing certificate.
  4. Receive notifications when certificates are about to expire.

Self-signed certificates and CSRs can be generated using RSA / DSA / EC key algorithms and SHA signature algorithm as per the details below:

RSA – 1024, 2048, or 4096 bit keys; & SHA-2 (256, 384, or 512 bit) signature

DSA – 512, or 1024 bit keys; & SHA-1 (160 bit) signature

EC – 128, or 256 bit keys; & SHA-2 (256, 384, or 512 bit) signature

 

1.Discover certificates in your network

You can automatically discover all the certificates available in your network using Key Manager Plus, irrespective of the CA. You can discover the certificates anytime as needed or periodically based on scheduled tasks. The discovery options are quite flexible - you can discover certificates from a single server or multiple servers, and from multiple ports, at one go.

Discover SSL Certificates On Demand

To discover the certificates manually:

Note : The file to be imported must be a text file containing the hostname or IP addresses of individual servers, entered on separate lines. Enter the ports to scan on each server separated by a space, entered on separate lines as illustrated below:

0.0.0.0 6565
test-username-10 443
192.168.20.20 7272

If you do not specify any port, SSL certificates using the default port 443 will be discovered.

Click the Discover button.When you click the Discover button, you will be redirected to the Discovery Status page where the status of the current discovery instance is updated.

Discovery

Discover SSL Certificates Automatically Through Schedules

SSL Certificate discovery can also be scheduled to occur at periodic intervals.

You will get a message confirming addition of a new schedule.

The result of the schedule execution will get updated in the Schedule audit and the Discovery audit tabs.

Discover certificates mapped to user accounts in Active Directory

Key Manager Plus helps you discover and manage the certificates mapped to user accounts in Active Directory.

To perform AD user certificate discovery,

ad-user-cert

Manage certificates from MS certificate store and Local CA

Key Manager Plus helps you request, acquire, discover, consolidate, track and manage certificates from MS Certificate Store and those issued by Local certificate authority. To begin managing certificates from Microsoft Certificate Store and Local Certificate Authority, start Key Manager Plus service using your domain administrator account. If you use a domain service account to run Key Manager Plus, make sure you have configured the account in your local admin group beforehand.

To import certificates from Microsoft Certificate Store and certificates issued by Local CA,

ms-cert-store

Discover certificates from SMTP servers

You can discover SSL certificates used by mail servers present in your network and consolidate them in Key Manager Plus' centralized certificate repository. To perform mail server certificate discovery,

Discover SSL certificates deployed to load balancers

Key Manager Plus also allows you to discover SSL certificates deployed to load balancers within your network and consolidate them in its secure, centralized repository. Key Manager Plus currently supports certificate discovery from Linux based load balancers only (i.e., Nginx, F5 etc.,) and the process is tunnelled via SSH. To perform load balancer certificate discovery,

Discover SSL certificates using KMP agents

Key Manager Plus provides IT administrators the option to discover SSL certificates deployed across their network through agents. This functionality enables them to download and deploy Key Manager Plus agents to target systems, discover, and import certificates from those systems into a centralized certificate repository directly from the Key Manager Plus web interface. The connection between the Key Manager Plus server and the server(s) in which the agent is deployed is over HTTPS and is completely secure. Currently, Key Manager Plus agents are available only for Windows servers.

Performing certificate discovery through agents is helpful in the following scenarios:

Downloading the Key Manager Plus agent

The agent used to perform certificate management operations on remote machines is dynamically created by the Key Manager Plus server. To download Key Manager Plus agent,

Agent installation

Once you have downloaded the agent from Key Manager Plus' web interface, follow the instructions below to install it in the target servers. The downloaded package already contains the necessary configurations needed to perform the required operations. Just make sure the account in the server in which the agent is installed has sufficient privileges to perform certificate discovery.

To install Key Manager Plus agent as a Windows service,

To start the agent as a Windows service,

To stop the agent,

To perform SSL certificate discovery through Key Manager Plus agent,

Managing Agents

Key Manager Plus provides administrators insights about agent activity and allows management of agents installed on various target resources. To manage Key Manager Plus agents,

 

Discover SSL certificates hosted on AWS (ACM & IAM)

Key Manager Plus enables you to discover, import, and configure expiry notifications for SSL certificates hosted in the following Amazon Web Services: AWS Certificate Manager (ACM) and AWS Identity and Access Management (IAM).

Follow the steps below to discover and import SSL certificates from ACM / IAM into Key Manager Plus.

Step 1: Configure AWS credentials in Key Manager Plus

Step 2: Discovery and Import

The centralized certificate repository

All the discovered SSL certificates, those that are discovered manually as well as those discovered through scheduled discovery operations are automatically added to the centralized repository of Key Manager Plus. You can view these certificates from the SSL → Certificates tab in the user interface.

Export private key / keystore file

Key Manager Plus allows you to identify and export the private keys / keystore files of SSL certificates stored in the certificate repository, provided you're managing their private keys / keystore files using Key Manager Plus. You can see the Keystore icon ( keystore ) enabled beside the certificates for which the private keys are managed using Key Manager Plus. To export the private key / keystore file,

Track and manage various certificate versions

Sometimes, there occurs situations where you have to use different certificates on different end-servers for the same domain. Under such circumstances, it is necessary for you to track the usage and expiry of all these certificates individually even though they represent a common domain. Monitoring various such certificate versions manually is daunting and error-prone. Key Manager Plus helps you simultaneously track and manage the usage and expiry of various certificate versions from a single window.

To track certificate versions,

Track-and-manage

Update servers with latest certificate versions

In case of wildcard certificates or single SSL certificate deployed to multiple servers, it is necessary to keep track of servers in which the certificate is deployed and also check if the latest certificate version is in use. Key Manager Plus helps you ensure this.

  1. Navigate to SSL --> Certificates tab
  2. Click the Certificate History icon ( cert-history-icon ) corresponding to the required certificate
  3. A window opens listing the various versions of the certificate. Ensure that the latest version of the certificate is set as the main certificate. If not, click the ( ) icon beside the required version to set that version of certificate as main certificate in the Key Manager Plus repository.
  4. Then again, navigate to SSL --> Certificates tab and click multiple servers icon ( multiple-server ) corresponding to the required certificate.
  5. A window opens listing the servers in which the certificate is deployed along with other information such as IP address, port and certificate validity.
  6. If any of the servers listed has an older / expired version of the certificate, update it with the latest version immediately. Select the server and then click Deploy. Refer to the detailed deployment procedure here.

multiple-servers

Also, you can edit details pertaining to a particular certificate or delete irrelevant certificates by selecting the certificate and clicking the More dropdown.

 

2.Create Self-signed certificates

Key Manager Plus allows administrators to create their own self-signed certificates using Java keytool. These certificates are automatically imported into the Key Manager Plus repository on successful creation.

To create a self-signed certificate using Key manager plus:

  1. Navigate to the SSL → Certificate tab in the GUI.
  2. Click the Create button.
  3. Enter the details of the organization and certificate validity, and select the key algorithm and length, signature algorithm, and enter a keystore password in the Create certificate tab.
  4. Choose the Validity Type as Days and specify the number of days for which the certificate will be valid.

  5. To create an ephemeral certificate with limited validity period, choose the Validity Type as Hours or Minutes and provide the validity period. The certificate will expire after the specified time (this option is applicable from build 5850 onwards).

  6. Click the Create button. You will be redirected to the certificate window where the certificate content is displayed.
  7. You can copy the certificate content, or export the certificate to required email or system.
    • Email – Select this check box to send the certificate file via email to the specified mail id.
    • Export – Select this check box to export the file to your system.
  8. Both the options take effect once you click the Save button.
  9. You can denominate the certificate to be generated as a root certificate by enabling the Generate root certificate check-box. 
  10. Click the Save button to save the certificate in the Key Manager Plus repository, and export the certificate file, if opted in earlier step.

 

3.Generate CSRs

To generate a CSR using Java keytool from Key Manager Plus:

Besides generating CSRs from Key Manager Plus, you can also upload CSRs generated from outside the application and track their statuses from Key Manager Plus using the Import option in the top menu.

Generate CSR

4.Certificate Signing

Key Manager Plus provides the option to sign and issue certificates to all clients in your network either from your Microsoft Certificate Authority or using a custom root CA certificate that is trusted within your environment.

Microsoft CA certificate signing

To request and acquire certificates from Local CA from Key Manager Plus, you have to initially generate a certificate signing request, then get it signed from the local certificate authority using the steps mentioned below. 

  1. Navigate to SSL → Create Csr tab. Click Create.
  2. In the Create Csr window that opens, fill in the domain details, organization details, choose the key algorithm, key size, signature algorithm, keystore type and specify the validity (days) and keystore password. Click Create. If you want to generate a CSR from an already existing key, choose 'Create CSR from keystore' option and specify the key location, password and click Create.
  3. The CSR is generated and you can view it from SSL → Create Csr tab.

You can get the CSR signed from Microsoft Certificate Authority from Key Manager Plus.

  1. Navigate to SSL → Create Csr tab, select the required CSR and click Sign from the top menu. 
  2. In the pop-up that opens, provide the name of the server that runs the internal certificate authority, CA name and choose the certificate template based on your requirement. Click Sign Certificate.
  3. The CSR is signed and the issued certificate can be viewed from SSL → Certificates tab.

Certificates issued by Local CA can be renewed automatically from Key Manager Plus. To enable auto-renewal of Local CA certificates,

  1. Navigate to Settings → SSL → Microsoft CA Auto Renewal
  2. Enable MS CA auto renewal task and specify the recurring time. Certificates that have already expired and certificates due expiry in 10 days or less, are automatically renewed and updated in the certificate repository.

ssl-ms-ca-cert-signing

Note :

  1. Start Key Manager Plus using your domain administrator account to begin management of certificates from Microsoft Certificate Store and those issued by your Local CA. If you use a domain service account to run Key Manager Plus, make sure that you have configured it in your local admin group beforehand.
  2. During MS Certificate Store discovery, Get Stores option will list all stores available in the local host if the Server Name field is left empty.
  3. For MS CA auto-renewal to take effect, the certificate(s) need to be of type Microsoft CA. For manually added certificates, the certificate type needs to be changed to Microsoft CA using Edit option from More top menu.

Sign certificates with custom root CA

Key Manager Plus provides the option to sign and issue certificates to all clients in your network either from your Microsoft Certificate Authority or using a custom root CA certificate that is trusted within your environment.

  1. Create a custom root CA
  2. Sign certificates with the custom root CA
  3. Deploy the signed certificates to target systems

1.Create a custom root CA

To sign locally generated certificate requests with the root CA certificate, you have to initially create a custom root CA.

  1. Navigate to SSL → Certificates tab.
  2. Select a certificate and click Mark as Root from the More top menu.
  3. The chosen certificate is successfully denominated as a root CA certificate and is listed under the Root Certificate tab. You can then use this certificate to sign locally generated certificate requests.

Note :

You can also generate new root CA certificates from Key Manager Plus by enabling Generate root certificate check-box while creating a certificate from SSL → Certificates → Create option.

2.Sign certificates with the custom root CA

To sign certificates with the custom root CA, generate a certificate signing request (CSR) and then sign it using the root certificate.

  1. Navigate to SSL → Create CSR tab.
  2. Click Create.
  3. In the window that opens, enter all the required details and click Create.
  4. The CSR is created and is listed under the Create CSR tab.
  5. Select the CSR and click Sign from the top menu.
  6. Select the Sign Type as Sign with Root, select the root certificate and specify the validity in days. Click Sign.
  7. The certificate is signed based on the selected root certificate and is listed under SSL → Certificates tab.

Also, you can use the root CA certificate to simultaneously generate and sign certificates to user groups in bulk directly from Key Manager Plus.

3.Deploy the signed certificate to target systems

After signing the certificate requests and obtaining the certificate, you have to deploy them to the necessary end-servers. Refer to this section of help for step-by-step explanation on certificate deployment.

Note :

When signing certificates with custom root CA for web-applications, make sure all the browsers in your network are configured to trust the root CA certificate in order to avoid security error messages.

 

5.Import Certificates

To import the certificates in your network:

 

6. Delete certificates

You can delete the certificates that are currently not in use. To delete a certificate from Key Manager Plus repository:

 

7. Certificate Requests

The certificate request workflow is as follows:

Add Certificate Request

To add requests for new certificates or addition of sub-domains to existing certificates, in Key Manager Plus:

Add request

Certificate request status

A certificate request is in either of the following statuses.

When a certificate request is raised, it is automatically elevated to the Open state. The request details can be viewed from the SSL → Certificate request tab, on clicking the domain name of the request.

Close Certificate Request

To terminate the certificate request life-cycle:

Close request

 

8. Control expiry notification schedule

You can customize the periodicity of notifications you receive when a certificate is about to expire. To customize the notifications:

Note : You will receive notifications every day after the selected date before the expiry of a certificate. For instance, if a certificate is about to expire in the last week of a month, and you select the Notify if SSL certificates are expiring within 7 days option, then, you will receive a notification that your certificate is about to expire every day of the week before the expiry of the certificate.

9. Track Domain Expiration through WHOIS Lookup

Apart from tracking certificate expiration, Key Manager Plus also helps administrators keep a tab on their expiring domain names through an automated WHOIS look up. The domain expiration details fetched through the lookup are displayed in SSL → Certificates tab against its corresponding SSL certificate. Also, administrators can choose to receive timely email notifications of their expiring domains by configuring it in Settings → Notification tab.

How does the WHOIS lookup work?

Fetching domain expiration details requires a two-stage lookup to WHOIS servers from Key Manager Plus. The first lookup provides the details of the WHOIS server with which the domain was registered by its domain registrar. The second lookup provides information about the domain such as owner details, expiration date etc., All these operations are automated the from Key Manager Plus' interface.

Note : Connection to WHOIS servers requires the use of Port 43. Ensure that port 43 is open in your environment, else the connection would fail and Domain Expiration will be marked Not Available (NA) in the Certificates tab.

10. SSL certificate group

Key Manager Plus allows you to organize SSL certificates into various logical groups and execute actions in bulk on the groups.

Create certificate groups

To create a certificate group,

Note : If you choose to group certificates based on criteria, the conditions will be applied to certificates discovered in the future and they will automatically be added to groups that match the criteria.

SSL-certificate-group

Edit certificate groups

To make changes to existing certificate groups,

Note : The certificate group name cannot be modified. However, you can add or modify the list of certificates in a group or the description.

SSL-certificate-group

Delete certificate groups

To delete a certificate group,