need to issue certificate for an internal application

We are using an SSO product. It supports "self service" password reset from the SSO level layer.

For trusted access it is asking for a valid security certicate for the vault, the installed cert must have the follow characteristics:

The certificate must be issued by a Certification Authority (CA) that is trusted by end users.
The certificate must be in PEM format, a text-based Base64 encoding of the binary DER format.
The certificate file must include an unencrypted private key.
The certificate includes the VIP as the subjectAltName field in the Certificate Signing Request to the CA.
The vault needs to be restarted for the certificate to take effect in Password Reset Operations.


I don't know much about certs except for the ones I've purchased from our ISP for our exchange system to work and another system that uses https:...

this system in question is a totally internal system which cannot be seen from the outside. I have a DC with CA running on it... is that a start?

I have no idea how to have one issued, or how to "request" one.

I've included a screenshot of the Sentillion "install cert" page and of our CA on one of our DC's.

Thanks. server 2003 The current status of the CA windows on the one DC that has this service running
BryceRichertAsked:
Who is Participating?
 
edster9999Connect With a Mentor Commented:
You have two options.
1. You can buy a real cert from ay of the providers.  You will need to renew this each time it runs out (you can get them for 1 year or longer periods like 2 or 5 years)
This will work staight away on all machines.
If you want to go this route, google SSL CERT or talk to the ISP you already used.

2. You can issu a self sign cert.  This is where you make a cert yourself.  You will then need to install the cert above it (the signing company (which is you in this case)) on all pcs.
If you want to go this way Google "HOW TO SELF SIGN CERT".
Easiest way is to install OpenSSL and follow instructions posted a million times on the Internet.

0
 
BryceRichertAuthor Commented:
do I need a high assurity cert or can I just find the cheapest place?

I have lots of stuff at godaddy.. is this good enough?
0
 
edster9999Connect With a Mentor Commented:
cheapest one.  As long as the CA signer (the signing company) is recognised by all browsers.  Some of the cheaper ones are not.  
Go Daddy is fine.  It is cheap yet still recognised by all (important) browsers
0
 
busplannerConnect With a Mentor Commented:
Here's another: http://www.rapidssl.com/  that has worked well for me
0
 
BryceRichertAuthor Commented:
thanks.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.