Skip to content

Create a new Aruba ClearPass machine

Preview feature

This feature is available in Preview and isn't yet generally available (GA). Functionality and behavior can change before GA.

Creating a machine enables Certificate Manager - SaaS to connect directly to Aruba ClearPass Policy Manager over its REST API so certificates can be discovered across ClearPass and provisioned as service and server certificates. After creating the machine, you can provision certificates to it.

Before you begin

  • Hostname or IP address of the Aruba ClearPass node, and the HTTPS port if it is not 443.
  • An API Client registered in Aruba ClearPass using the Client credentials grant type, which provides the API Client ID and API Client Secret. To create one, in ClearPass go to Administration > API Services > API Clients, add a client with Operating Mode ClearPass REST API and Grant Type Client credentials, and note its ID and secret.
  • The API Client's Operator Profile must grant API access and certificate Read (for discovery) and Write (for provisioning) permissions.
  • To provision certificates using the AWS S3 provisioning configuration, you also need an existing S3 bucket and a long-lived AWS IAM user access key (its ID, secret, and region) permitted to PutObject, GetObject, and DeleteObject on that bucket.
  1. In ClearPass Hostname or IP Address, enter the hostname or IP address of the Aruba ClearPass node.
  2. If ClearPass uses a port other than 443, enter it in Port. The default is 443.
  3. In API Client ID, enter the ID of the API Client you registered in ClearPass.

  4. In API Client Secret, enter the secret paired with the API Client ID.

    Warning

    Remember to store your username and password securely when creating a new machine. For security reasons, you will not be able to modify the fields under the "Access" tab without these credentials. This ensures that only authorized individuals can modify these fields.

  5. Leave Verify TLS Certificate enabled to validate the certificate ClearPass presents. Disable it only for lab nodes that present a self-signed or internal certificate.

  6. From Provisioning Configuration, select how certificates are staged for ClearPass to fetch during provisioning:

    • AWS S3 (default) — Enables provisioning. The connector stages a password-protected PKCS#12 file to your AWS S3 bucket using server-side encryption (SSE), then gives ClearPass a temporary presigned URL to download it. The AWS fields below appear when you select this option.
    • Not Needed — Creates a discovery-only machine. The AWS fields are hidden and provisioning attempts fail.

    Note

    Discovery works in all modes. This setting only controls provisioning.

  7. If you selected AWS S3, complete the staging fields:

    • In AWS Access Key ID, enter the access key ID for the AWS account whose S3 bucket stages the PKCS#12 file.

    • In AWS Secret Access Key, enter the secret access key paired with the AWS Access Key ID.

      Warning

      Remember to store your username and password securely when creating a new machine. For security reasons, you will not be able to modify the fields under the "Access" tab without these credentials. This ensures that only authorized individuals can modify these fields.

    • In AWS Region, enter the region of the staging bucket (for example, us-west-1).

    • In Staging S3 Bucket, enter the name of the existing bucket the connector uploads the PKCS#12 file to.

    Note

    The connector uses a long-lived IAM user access key (AKIA...). Temporary or SSO credentials (ASIA...) are not supported. The bucket must already exist, and ClearPass must be able to reach Amazon S3 to download the staged file.

  8. Click Test Access to verify connectivity.

  9. Click Continue. The Continue button is enabled only after the connection test succeeds.

What's next?