Solved

need to issue certificate for an internal application

Posted on 2011-03-25
5
395 Views
Last Modified: 2012-05-11
We are using an SSO product. It supports "self service" password reset from the SSO level layer.

For trusted access it is asking for a valid security certicate for the vault, the installed cert must have the follow characteristics:

The certificate must be issued by a Certification Authority (CA) that is trusted by end users.
The certificate must be in PEM format, a text-based Base64 encoding of the binary DER format.
The certificate file must include an unencrypted private key.
The certificate includes the VIP as the subjectAltName field in the Certificate Signing Request to the CA.
The vault needs to be restarted for the certificate to take effect in Password Reset Operations.


I don't know much about certs except for the ones I've purchased from our ISP for our exchange system to work and another system that uses https:...

this system in question is a totally internal system which cannot be seen from the outside. I have a DC with CA running on it... is that a start?

I have no idea how to have one issued, or how to "request" one.

I've included a screenshot of the Sentillion "install cert" page and of our CA on one of our DC's.

Thanks. server 2003 The current status of the CA windows on the one DC that has this service running
0
Comment
Question by:BryceRichert
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 20

Accepted Solution

by:
edster9999 earned 333 total points
ID: 35219237
You have two options.
1. You can buy a real cert from ay of the providers.  You will need to renew this each time it runs out (you can get them for 1 year or longer periods like 2 or 5 years)
This will work staight away on all machines.
If you want to go this route, google SSL CERT or talk to the ISP you already used.

2. You can issu a self sign cert.  This is where you make a cert yourself.  You will then need to install the cert above it (the signing company (which is you in this case)) on all pcs.
If you want to go this way Google "HOW TO SELF SIGN CERT".
Easiest way is to install OpenSSL and follow instructions posted a million times on the Internet.

0
 

Author Comment

by:BryceRichert
ID: 35219326
do I need a high assurity cert or can I just find the cheapest place?

I have lots of stuff at godaddy.. is this good enough?
0
 
LVL 20

Assisted Solution

by:edster9999
edster9999 earned 333 total points
ID: 35219371
cheapest one.  As long as the CA signer (the signing company) is recognised by all browsers.  Some of the cheaper ones are not.  
Go Daddy is fine.  It is cheap yet still recognised by all (important) browsers
0
 

Assisted Solution

by:busplanner
busplanner earned 167 total points
ID: 35219431
Here's another: http://www.rapidssl.com/  that has worked well for me
0
 

Author Closing Comment

by:BryceRichert
ID: 35252542
thanks.
0

Featured Post

MIM Survival Guide for Service Desk Managers

Major incidents can send mastered service desk processes into disorder. Systems and tools produce the data needed to resolve these incidents, but your challenge is getting that information to the right people fast. Check out the Survival Guide and begin bringing order to chaos.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

There is a lot to be said for protecting yourself and your accounts with 2 factor authentication.  I found to my own chagrin, that there is a big downside as well.
In this blog we highlight approaches to managed security as a service.  We also look into ConnectWise’s value in aiding MSPs’ security management and indicate why critical alerting is a necessary integration.
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

688 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question