Skip to content

Create an Aruba ClearPass machine

Preview feature

This feature is available in Preview and isn't yet generally available (GA). Functionality and behavior can change before GA.

Create an Aruba ClearPass machine so Certificate Manager - SaaS can discover the certificates on a ClearPass Policy Manager node and provision certificates to it over the ClearPass REST API. Certificate Manager - SaaS stages each certificate in an Amazon S3 bucket that you own, and ClearPass downloads it from there.

Before you begin

  • The System Administrator, PKI Administrator, or Resource Owner role. If you have the Resource Owner role, you must own or belong to at least one team.
  • An active VSatellite that can reach the ClearPass node on the REST API port.
  • The hostname or IP address of the ClearPass node, and the HTTPS port of its REST API if it isn't 443.
  • An API client registered in ClearPass. To create one, in ClearPass, select Administration > API Services > API Clients, and then add a client with the operating mode ClearPass REST API and the grant type Client credentials. Note its client ID and client secret.
  • An operator profile for the API client that allows API access and grants Read access to certificates for discovery and Write access to certificates for provisioning.
  • To provision certificates, an existing Amazon S3 bucket and the access key of a long-lived AWS Identity and Access Management (IAM) user, with its ID, secret, and the bucket's region. The user needs the s3:PutObject, s3:GetObject, and s3:DeleteObject permissions on the bucket. Temporary or single sign-on (SSO) credentials don't work. ClearPass must be able to reach Amazon S3 to download the staged file.

To create an Aruba ClearPass machine

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click New, and then select Aruba ClearPass (Preview).
  4. On the Properties step, in Name, enter a name for the machine.
  5. For Owning Team, choose the team that owns the machine. System Administrators and PKI Administrators can choose any team. Resource Owners can choose only a team they own or belong to.

  6. For VSatellite, choose a VSatellite that can reach the machine. A VSatellite that's the primary of a high availability group shows its number of active replicas, and Certificate Manager - SaaS can run the machine's operations on any healthy VSatellite in the group.

  7. In ClearPass Hostname or IP Address, enter the hostname or IP address of the ClearPass node.

  8. (Optional) In Port, replace the default, 443, if the ClearPass REST API listens on a different port.
  9. In API Client ID, enter the client ID of the API client you registered in ClearPass.

  10. In API Client Secret, enter the client secret of the API client.

    Note

    Certificate Manager - SaaS encrypts the credentials you enter and doesn't display them again. On the machine's Properties tab, they appear masked. To keep a stored credential when you edit the machine, leave its masked value unchanged. Keep your own secure record of the credentials in case you need them again.

  11. (Optional) To connect without verifying the certificate that ClearPass presents, disable Verify TLS Certificate. It's enabled by default. Disable it only if ClearPass presents a self-signed or internal certificate. The connection is still encrypted.

  12. For Provisioning Configuration, choose how Certificate Manager - SaaS stages certificates for ClearPass to download:

    • AWS S3 to stage each certificate in your Amazon S3 bucket. This is the default, and it's required for provisioning.
    • Not Needed to create a machine that only discovers certificates. Provisioning to the machine fails.

    Note

    Discovery works with either setting. This setting controls only provisioning.

  13. If you chose AWS S3, in AWS Access Key ID, enter the access key ID of the IAM user.

  14. In AWS Secret Access Key, enter the secret access key that belongs to the access key ID.
  15. In AWS Region, enter the region of the staging bucket, for example us-west-1.
  16. In Staging S3 Bucket, enter the name of the existing bucket.

  17. Click Test Access. After the connection succeeds, click Continue. The Discovery step opens.

    Note

    A successful test confirms that Certificate Manager - SaaS can reach ClearPass, that ClearPass accepts the API client credentials, and that the API client can read server certificates. It doesn't check write access or the AWS S3 settings.

  18. (Optional) For Discovery Types, choose the kinds of certificates to discover. If you don't choose any, Certificate Manager - SaaS discovers all three.

    • service-certs: the certificates in the ClearPass service certificate store.
    • server-certs: the certificates in the server certificate slots of the node you connect to, such as HTTPS, RADIUS, RadSec, and Database.
    • certificates: the entries in the ClearPass certificate store.

  19. (Optional) To discover certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).

  20. Click Continue. The Provisioning step opens.

  21. (Optional) To provision certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).

    Scheduled provisioning pushes only certificates that are queued for deployment, such as renewed certificates, so renewals install during the window you choose.

  22. Click Finish.

What's next?

After you create the machine, provision a certificate to it. You can also run discovery on the machine at any time to track the certificates on ClearPass.