Skip to content

Provision certificates to a Common KeyStore

Provision a certificate from Certificate Manager - SaaS to a keystore file on the host of a Common KeyStore machine. Certificate Manager - SaaS writes the certificate, its chain, and its private key as PEM files, into a Java KeyStore (JKS) file, or into a PKCS#12 archive, and can then restart the service that uses them.

Before you begin

  • A Common KeyStore machine that you created and whose status is Verified.
  • The certificate to provision in the Certificate Manager - SaaS inventory, with its private key.
  • The System Administrator or PKI Administrator role, or the Resource Owner role and membership in the machine's owning team.
  • The absolute paths on the host where you want to write the files. Over SSH, the folders must already exist. Over Windows Remote Management (WinRM), Certificate Manager - SaaS creates missing folders.
  • To add the certificate to an existing JKS file, the file itself and its store password.
  • To restart a service after provisioning, the service's name and the access described in Create a Common KeyStore machine.

To provision a certificate to a Common KeyStore

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click the more options button at the end of the machine's row, and then select Provision.

  4. In Search a certificate by name, expiration or fingerprint, enter part of the certificate's name, expiration date, or fingerprint, and then select the certificate from the results. Confirm that it's the right certificate by checking Subject DN, Validity, and Certificate SHA1 Fingerprint.

    The rest of the Provision a certificate dialog appears after you select a certificate.

  5. Under Certificate Information, for KeyStore Type, choose PEM, JKS, or PKCS#12. Then complete the fields for that type.

    Every path is an absolute path that includes the file name, in Windows form (C:\path\to\file) or Unix-like form (/path/to/file).

  6. If you chose PEM, under PEM Settings, enter the paths to write the files to:

    • In Certificate Path (including filename), enter the path of the certificate file.
    • In Private Key Path (including filename), replace /change-me/private-key.pem with the path of the private key file. The pre-filled value is a placeholder.
    • In Certificate Chain Path (including filename), enter the path of the chain file. To write the certificate and its chain to one file, enter the same path as Certificate Path (including filename).

  7. If you chose PEM, (Optional) in Key Password, enter a password to encrypt the private key. Certificate Manager - SaaS then writes the key as an encrypted PKCS#8 key. If you leave it empty, the key isn't encrypted.

  8. If you chose JKS, under JKS Settings, in KeyStore Path (including filename), enter the path of the JKS file.
  9. If you chose JKS, (Optional) to add the certificate to an existing JKS file instead of replacing the file, enable Append to JKS. It's disabled by default. When it's enabled, the file must already exist, or provisioning fails. If the alias already exists in the file, its entry is replaced.
  10. If you chose JKS, in Alias, enter the alias for the certificate's entry in the keystore.
  11. If you chose JKS, in Store Password, enter the keystore's password. If you enabled Append to JKS, enter the existing file's store password.
  12. If you chose JKS, (Optional) in Key Password, enter a separate password for the entry's private key. If you leave it empty, Certificate Manager - SaaS uses the store password.

  13. If you chose PKCS#12, under PKCS#12 Settings, in KeyStore Path (including filename), enter the path of the archive, and in Store Password, enter the password that protects it.

  14. (Optional) Under Installation Endpoint, in Service Name, enter the name of the service to restart after Certificate Manager - SaaS writes the files. If you leave it empty, no service restarts.

    • Over SSH, Certificate Manager - SaaS runs sudo systemctl restart <service>.
    • Over WinRM, Certificate Manager - SaaS stops the named Windows service and starts it again. Enter the service name, not its display name.

    Tip

    Over SSH, you can limit the account's sudo rights to the restart command with a sudoers rule such as <user> ALL=(ALL) NOPASSWD: /bin/systemctl restart <service>. Use the path of systemctl on your host.

  15. (Optional) To save the installation without pushing the certificate now, disable Push certificate on save.

  16. Click Save. To save and then provision another certificate, click Save & New.

After you save, Certificate Manager - SaaS writes the files to the host. If a file already exists at a path, Certificate Manager - SaaS first backs it up as <path>.VaaS.bak, replacing any earlier backup. This happens for every keystore type. Over SSH, Certificate Manager - SaaS sets the permissions of each file it writes to 0640. Certificate Manager - SaaS then restarts the service, if you named one, and an installation appears on the machine's Installations tab. To provision on a schedule instead of right away, set up a machine provisioning schedule.