Deploying SSL Certificates to Target Web Servers

In general, SSL certificates procured from Certificate Authorities (CAs) are stored in a repository and then manually deployed on appropriate target systems. PAM360 deploys the certificates from the repository on the correct target systems automatically. You can use PAM360 to deploy the certificates on the various systems individually, or in bulk, based on your requirements. Also, you can use the Key Manager Plus agent to deploy certificates on servers that reside in demilitarized zones outside of the domain where the PAM360 server is present.

1. Steps to Deploy Certificates on Different Target Systems

   1.1 Deploying certificates to a Windows server

   1.2 Deploying certificates to MS Certificate store

   1.3 Deploying certificates to Internet Information Services (IIS)

   1.4 IIS Binding

   1.5 Deploying certificates to a Linux server

   1.6 Deploying Certificates to a Browser

   1.7 Deploying Certificates to ManageEngine MDM

   1.8 Deploying Certificates to AWS-ACM

   1.9 Deploying Certificates to Load Balancer

   1.10 Deploying Certificates to Fortigate Firewall

1. Steps to Deploy Certificates on Different Target Systems

Using PAM360, you can directly deploy selected SSL certificates onto target servers. To deploy an SSL certificate to a target server:

1. Navigate to Certificates >> Certificates.
2. Select the certificates that you want to deploy to target servers by clicking on the check boxes beside them.
3. Click Deploy.
4. In the Certificate Deployment window that opens, select the server type and provide the required details. The certificates are deployed to the specified servers in the specified path.

   

1.1 Deploying Certificates to a Windows Server

1. To deploy certificates on Windows server, choose the server type as Windows.
2. Select the Deployment Type as Single, Multiple (servers) or Agent as per your need.
   1. For single server deployment, provide the required details: Server Name, User Name, Password, Path, File Type and Certificate File Name. you can optionally enable Certificate to choose the File Type and mention the Certificate File Name or/and enable JKS/PKCS to choose the Keystore Type and mention the Store File Name.

      

   2. If you select the checkbox Use PAM360 service account credentials for authentication, you need not provide the username and password separately, as the service account credentials used for PAM360 will be used here too.

      

   3. If you select the checkbox Use an account stored in PAM360, you need not provide the password as PAM360 will take the user account details directly from the database.
   4. For certificate deployment on Multiple servers, upload a .csv file comprising the following details: Server Name, User Name, Password, Path, Certificate file name (optional), Keystore File Name (optional) and File Type. You can optionally enable Certificate to choose the File Type or/and enable JKS/PKCS to choose the Keystore Type.
   5. If you choose the Deployment Type as Agent, choose the host name of the PAM360 agent from the Select Agent drop-down, enter the destination file path in the agent machine. If a destination path is not mentioned, the agent installation path will be taken as default. You can optionally enable Certificate to choose the File Type and mention the Certificate File Name or/and enable JKS/PKCS to choose the Keystore Type and mention the Store File Name.
   6. Click Save to save the details.

      

3. Now, click Deploy.

The certificate is deployed to the specified server/agent in the specified path.

Note: For file-based deployment, if the Certificate and Keystore file names are not provided, or if multiple certificates are selected for deployment, the Common Name will be used as the file name.

1.2 Deploying Certificates to MS Certificate Store

1. To deploy certificates to MS Certificate store, choose the server type as Microsoft Certificate Store.
2. Select the Deployment Type as Single, Multiple or Agent as per your need.
   1. For Single deployment, provide the required details: Server Name, User Name, Password, Path.

      

   2. If you select the checkbox Use an account stored in PAM360, you need not provide the password as PAM360 will take the user account details directly from the database.

      

   3. If you select the checkbox Use PAM360 service account credentials for authentication, you need not provide the username and password as PAM360 will take the user account details directly from the database.

      

   4. For certificate deployment on Multiple servers, upload a .csv file comprising the following details: Server Name, User Name, Password, Path.
   5. Select Computer and/or User account to deploy the certificate to the selected account.

      Note: For Agent deployment, the latest version of PAM360 agent(5900) should run in the user account to which the certificates are to be deployed.

   6. If you choose the Deployment Type as Agent, choose the host name of the PAM360 agent from the Select Agent drop-down.

      

   7. Now, select Enable PrivateKey Export from MS Store after deployment to export private key from the certificate store.
   8. Click Save to save the agent details. After providing the details, click Deploy.
The selected certificates are deployed to Personal Certificates.

1.3 Deploying Certificates to Internet Information Services (IIS)

Follow the below steps to deploy a certificate on the IIS server. However, this procedure will only deploy the certificate to the server; IIS binding must be done separately.

1. To deploy certificates to Internet Information Services (IIS), choose the server type as IIS.
2. Select the Deployment Type as Single, Multiple or Agent as per your need.
   1. For Single deployment, provide the required details: Server Name, User Name, Password, Path.

      

   2. If you select the checkbox Use an account stored in PAM360, you need not provide the password as PAM360 will take the user account details directly from the database.

      

   3. If you select the checkbox Use PAM360 service account credentials for authentication, you need not provide the username and password as PAM360 will take the user account details directly from the database.

      

   4. For certificate deployment on Multiple servers, upload a .csv file comprising the following details: Server Name, User Name, Password, Path.
   5.  If you choose the Deployment Type as Agent, choose the host name of the PAM360 agent from the Select Agent drop-down and click Save to save the agent details.
   6. After providing the details, click Deploy.

      

The certificate(s) are deployed to Server certificates of the specified server(s).

1.4 IIS Binding

Follow the below steps to deploy a certificate to the IIS server and bind the certificate to a site running in that server.

1. To deploy certificates on a Microsoft IIS server and perform IIS binding, choose the server type as IIS Binding.
2. Select the Deployment Type as Single or Agent as per your need.
   1. If you choose the deployment type as Single, enter the required details: Server Name, User Name, Password, Path, Site Name.
      
   2. Specify the name of a valid IIS server to which the certificate needs to be deployed, and provide the user account credentials.
   3. Specify a path in the server where the certificate must be placed.
   4. If you select the checkbox Use an account stored in PAM360, you need not provide the password as PAM360 will take the user account details directly from the database.
   5. If you select the checkbox Use PAM360 service account credentials for authentication, you need not provide the username and password as PAM360 will take the user account details directly from the database.
      
   6. If you choose the Deployment Type as Multiple (Server), click Browse to upload a file and click Update Binding.
      
   1. You can login using three different ways: with Credentials, using Service Authentication, or using Agent. Upload the file with the content in the following format: 
      1. For Single certificate selection, 
         <servername>, <CREDENTIALS>, <site name>, <binding information>, <server credentials>, <temp path>
         (and/or) 
         <servername>, <SERVICE_AUTH>, <site name>, <binding information>, <temp path>
         (and/or)   
         <servername>, <AGENT>, <site name>, <binding information>
      2. For Multiple certificate selection, include <domain name> in the above format
         Example: testServer,CREDENTIALS,test.com,Default Web Site,*:443:myhost,testUSer,testPwd,C:\
      3. For Multiple certificates with same common name, include <domain name> along with the <serial number> in the above format.
         Example: testServer,SERVICE_AUTH,test.com,se123245d,Default Web Site,*:443:myhost,C:\ 
   7. If the IIS Server resides in a demilitarized zone, choose the Deployment Type as Agent. Select an agent from the drop-down. Click Get Sites And Bindings to list all sites and their respective bindings available in the selected server. Enter the name of a site in the Site Name field, click Get Bindings to list all the bindings available for that site.
      
   8. Here, to add new bindings, click Add New Bindings and enter attributes such as Host Name, Port, IP Address, and select a certificate. Select the checkbox to Require Server Name Indication while configuring and updating IIS Binding. The newly added bindings will be visible under Admin >> SSH/SSL Config >> IIS Binding. The new site bindings added in PAM360 will not reflect in the IIS server until they are deployed to the server using the Deploy and Bind option.
      
   9. To populate the list of sites associated with the IIS server, click Get Site Names and choose a site from the drop-down. To enter a site name manually in the SiteName field, click Hide List, type in the site name and click the Get Bindings option.
   10. Enter the Host Name, IP Address and Port of the site manually.
   11. Select the Restart Site option to restart the site automatically.
   12. Click Add Binding/Update Binding to deploy the certificate at the path specified in your IIS server and complete IIS site binding.
   13. To update multiple bindings, select the required bindings from the list, click Save. Go to Admin >> SSH/SSL >> IIS Binding, select the bindings and click Deploy and Bind.
       
   14. To save the specified details and deploy the certificate later, click Save. The server details and the respective site details will be available under Admin >> SSH/SSL >> IIS Binding.
   15. To edit the binding details, click the Edit icon beside a server. In the window that opens, modify any of the given details and click Save. Now, select the server name and click Deploy And Bind from the top bar. The selected certificate will be deployed on the servers and the IIS binding will be updated in the IIS server.
   16. Details of sites and IIS bindings displayed in the IIS Binding table above are local to PAM360. To update the binding entries here with the entries from IIS server, select the required entries and click Update Binding.
       
   17. Deleting entries from the above table will not remove any data from the IIS server.

1.5 Deploying Certificates to a Linux Server

1. To deploy certificates to a Linux server, choose the server type as Linux.
2. Select the Deployment Type as Single or Multiple as per your need.
   1. For Single server deployment, provide  the required details: Server Name, Port (port 22 is assigned by default), User Name, Password, Path. You can optionally enable Certificate to choose the File Type and mention the Certificate File Name or/and enable JKS/PKCS to choose the Keystore Type and mention the Store File Name.

      

   2. You can opt for a key-based authentication for password-less servers by choosing the Import Key credential type. Upload the private key associated with the required user account in the target server and provide the key passphrase.

      

   3. If you select the checkbox Use an account stored in PAM360, you need not provide the password as PAM360 will take the user account details directly from the database.

      

   4. For certificate deployment on Multiple servers, upload a .csv file comprising the following details: Server Name, User Name, Password, Path, Certificate file name (optional), Keystore File Name(optional). You can optionally enable Certificate to choose the File Type or/and enable JKS/PKCS to choose the Keystore Type.
   5. You can also opt for a key-based authentication for password-less servers by choosing the Import Key credential type. Upload the Private Key associated with the required user account in the target system and provide the key Passphrase.
3. After providing the details, click Deploy.

The certificate is deployed to the specified server in the specified path.

1.6 Deploying Certificates to a Browser

1. To deploy certificates on a browser, choose the deploy type as Browser.
2. Select the Server Type as Windows, Linux or Mac OS as per your need.
3. If you select the checkbox Use an account stored in PAM360, you need not provide the password as PAM360 will take the user account details directly from the database.

   

4. If the server type is Windows, 
   1. Mention the Server Name, User Name, Password and Path.

      

   2. If you select the checkbox Use PAM360 service account credentials for authentication, you need not provide the User Name and Password separately, as the service account credentials used for PAM360 will be used here too.

      
      

5. If the server type is Linux,
   1. Enter the  Server Name, Port, User Name, Password and Path.

      

   2. Select the required Browser(s) (Firefox or/and Chrome) where the certificate is to be deployed.
   3. If you select Firefox, mention the Profile name. Click Get Profiles to choose from available profiles.
      
      

      Note: 

      Get Profiles option gets all profiles path from profiles.ini file from the following location: 
      Windows: APPDATA\Mozilla\Firefox\profiles.ini
      Linux: $HOME/.mozilla/firefox/profiles.ini
      Mac: $HOME/Library/Application Support/Firefox/profiles.ini

   4. Mention the NSS Tools Path.

      Notes:
      

      1. In Linux, Chrome and Firefox use NSS shared DB to manage the certificates. This NSS tool can be installed using the following command: sudo apt-get install libnss3-tools.
         
      2. For Chrome, the certificate is deployed in NSS DB in the following path: $HOME/.pki/nssdb.
      3. For Firefox, Profiles folder contains the NSS DB to manage certificates.
   5. You can also opt for a key-based authentication for password-less servers by choosing the Import Key credential type. Upload the User PrivateKey associated with the required user account in the target system and provide the key passphrase.

      

6. If the server type is Mac OS,
1. Enter the  Server Name, Port, User Name, Password and Path.
2. Select the required Browser(s) (Firefox or/and Safari/Chrome) where the certificate is to be deployed.
3. If you select Firefox, mention the Profile name and NSS Tools Path. Click Get Profiles to choose from available profiles.
4. If you select Safari/Chrome you can choose to Use the login password for Keychain login or mention the Login Keychain Password. 
   
   

   Note: For Safari and Chrome, Mac OS uses System Keychain to manage certificates. For Firefox, NSS DB from profiles manages the certificates. To install NSS utils, use the following command: brew install nss.


7. Click Deploy.

Now, you have successfully deployed the certificate to the selected browsers.

1.7 Deploying Certificates to ManageEngine MDM

To learn about deploying certificates to ManageEngine MDM, click here.

1.8 Deploying Certificates to AWS-ACM

To learn about deploying certificates to AWS-ACM, click here.

1.9 Deploying Certificates to Load Balancer

1. To deploy certificates on a LoadBalancer, choose the deploy type as Load Balancer.
2. In the pop-up that appears, select the Citrix ADC as the Load Balancer Type.
3. Select the required Citrix Credential List from the dropdown.
   
4. Click Manage Credentials to add or delete a credential.
   1. In the pop-up that appears, click to Add and mention the Credential Name, Server Name, Citrix Username and Citrix Password.
   2. Click Test Login to test the credential and click Save Credentials.
   3. To Delete a credential, select a credential you want to delete and click Delete and in the pop-up that appears click Ok.
   
5. Enter the Citrix Password and a Passphrase. You can also use the Generate Password icon to generate a secure passphrase.
6. During Citrix load balancer discovery using REST API, you can choose to bypass your proxy server settings by selecting the Bypass Proxy Settings checkbox. This option is allows you to bypass the proxy server you have enabled under Admin settings directly perform Citrix load balancer discovery through the internet.
7. Select Service Deploy. In the pop-up that appears, select the services to deploy the load balancer and click Select Services.
8. Select Virtual Server Deploy. In the pop-up that appears, select the virtual servers to deploy the load balancer and click Select Virtual Servers.
   
9. Click Deploy.

Now, you have successfully deployed the certificate to the selected LoadBalancer.

1.10 Deploying Certificates to Fortigate Firewall

1. Select a certificate and click Load Balancer from the Deploy dropdown.
2. In the pop-up that appears, select the FortiGate Firewall under the Load Balancer Type.
3. Select the required FortiGate Credential from the FortiGate Credentials List dropdown.

4. Click Manage Credentials to add or delete a credential. In the pop-up that appears:
1. To add a credential, click Add and enter the Credential Name, Server IP, and API Key.
2. Click Save Credentials to add a new FortiGate Firewall credential.
3. To delete a credential, select a credential that you want to delete and click Delete.
4. In the pop-up that appears, click OK to delete the selected credential.
5. If the certificate has a keystore file, select the Upload Type as Regular. Else, select the Upload Type as Remote.
6. In addition, you can bypass your proxy server settings by enabling the Bypass Proxy Settings checkbox. This option allows you to bypass the proxy server that you have enabled under Admin settings directly, to deploy the certificate to the FortiGate Firewall through the Internet.
7. Click Deploy to deploy the selected certificate to the FortiGate Firewall.