Skip to content

Provision certificates to Aruba ClearPass

Preview feature

This feature is available in Preview and isn't yet generally available (GA). Functionality and behavior can change before GA.

Provision a certificate from Certificate Manager - SaaS to Aruba ClearPass Policy Manager. Certificate Manager - SaaS stages the certificate in your Amazon S3 bucket, and ClearPass downloads and installs it.

Before you begin

  • An Aruba ClearPass machine that you created with Provisioning Configuration set to AWS S3, and whose status is Verified.
  • The certificate to provision in the Certificate Manager - SaaS inventory, with its private key.
  • The System Administrator or PKI Administrator role, or the Resource Owner role and membership in the machine's owning team.
  • Network access from ClearPass to Amazon S3, so ClearPass can download the staged certificate.

To provision a certificate to Aruba ClearPass

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click the more options button at the end of the machine's row, and then select Provision.

  4. In Search a certificate by name, expiration or fingerprint, enter part of the certificate's name, expiration date, or fingerprint, and then select the certificate from the results. Confirm that it's the right certificate by checking Subject DN, Validity, and Certificate SHA1 Fingerprint.

    The rest of the Provision a certificate dialog appears after you select a certificate.

  5. Under Certificate Information, for Certificate Type, choose where ClearPass installs the certificate:

    • Service Certificate (RADIUS/EAP, API) adds the certificate to the ClearPass service certificate store. Choose this to provision a certificate from this dialog.
    • Server Certificate Slot (HTTPS, RadSec, Database) replaces the certificate in a server certificate slot of the node you connect to. It works only for installations that discovery created, because the slot name comes from discovery. Provisioning to it from this dialog fails.
    • Certificate Store Entry is for discovered certificates only. Provisioning to it fails, because the ClearPass certificate store is read-only through the REST API.

  6. In Certificate Name, enter a name for the certificate, such as its subject or common name. The name identifies the installation in Certificate Manager - SaaS and distinguishes service certificates on the same machine. ClearPass doesn't receive it.

  7. Under Installation Endpoint, for Service Usage, choose a label for the installation: RADIUS/EAP, HTTPS, Onboard, RadSec, Database, or Unbound. The default is Unbound.

    Note

    Service Usage only labels the installation in Certificate Manager - SaaS. It doesn't bind the certificate to a ClearPass service.

  8. (Optional) To save the installation without pushing the certificate now, disable Push certificate on save.

  9. Click Save. To save and then provision another certificate, click Save & New.

After you save, an installation appears on the machine's Installations tab. Certificate Manager - SaaS builds a password-protected PKCS#12 file from the certificate, uploads it to your S3 bucket with server-side encryption, and gives ClearPass a download URL that expires after 60 seconds. Certificate Manager - SaaS then deletes the staged file. When a service certificate is renewed, Certificate Manager - SaaS also deletes the previous one from ClearPass. To provision on a schedule instead of right away, set up a machine provisioning schedule.