Deploying SSL Certificates to Target Web Servers

In general, SSL certificates procured from Certificate Authorities (CAs) are stored in a repository and then manually deployed on appropriate target systems. Password Manager Pro (PMP) deploys the certificates from the repository on the correct target systems automatically. You can use PMP to deploy the certificates on the various systems individually, or in bulk, based on your requirements. Also, you can use the Key Manager Plus agent to deploy certificates on servers that reside in demilitarized zones outside of the domain where the PMP server is present.

  1. Steps to Deploy Certificates on Different Target System

    1.1 Deploying Certificates to a Windows Server

    1.2 Deploying Certificates to MS Certificate Store

    1.3 Deploying Certificates to Internet Information Services (IIS)

    1.4 IIS Binding

    1.5 Deploying Certificates to a Linux Server

(Applicable from PMP version 10404 onwards)
Prerequisite:

PMP performs SSL certificate discovery and SSL certificate deployment by initiating a remote connection to the target machines. To allow PMP to do that, complete the below steps:

1. Download the .zip folder from this link and extract the remcom.exe file from the .zip folder.
2. Copy and paste the remcom.exe file into the <PMP Installation Folder>/bin directory.

1. Steps to Deploy Certificates on Different Target Systems

Using Password Manager Pro (PMP), you can directly deploy selected SSL certificates onto target servers. To deploy an SSL certificate to a target server:

  1. Navigate to Certificates >>Certificates.
  2. Select the certificates that you want to deploy to target servers by clicking on the check boxes beside them.
  3. Click Deploy.
  4. In the Certificate Deployment window that opens, select the server type (Windows, MS Certificate Store, IIS, IIS Binding, Linux) and provide the required details. The certificates are deployed to the specified servers in the specified path.

1.1 Deploying Certificates to a Windows Server

Notes:

  1. For deploying certificates on Windows systems, MS Certificate Store and Internet Information Services (IIS), use your domain administrator account as the service login account of PMP.
  2. If you are using a domain service account to run PMP, ensure you already have it configured in your local admin group.
  1. To deploy certificates on Windows server, choose the server type as Windows.
  2. Select the Deployment Type as Single, Multiple (servers) or Agent as per your need.
    1. For Single server deployment, provide the required details: Server Name, User Name, Password, Path, Certificate file name (optional).
    2. If you select the checkbox Use Password Manager Pro service account credentials for authentication, you need not provide the username and password separately, as the service account credentials used for PMP will be used here too.

    3. If you select the checkbox Use an account stored in Password Manager Pro, you need not provide the password as PMP will take the user account details directly from the database.
    4. For certificate deployment on Multiple servers, upload a .csv file comprising the following details: Server Name, User Name, Password, Path, Certificate file name (optional).
    5. If you choose the Deployment Type as Agent, choose the host name of the PMP agent from the Select Agent drop-down, enter the destination file path in the agent machine. If a destination path is not mentioned, the agent installation path will be taken as default. You can optionally mention the Certificate File Name, or Store File Name, or both, by enabling the Certificate or/and JKS/PKCS checkboxes, respectively and click Save.

  3. Now, click Deploy.

The certificate is deployed to the specified server/agent in the specified path.

1.2 Deploying Certificates to MS Certificate Store

    1. To deploy certificates to MS Certificate store, choose the server type as Microsoft Certificate Store.
    2. Select the Deployment Type as Single, Multiple or Agent as per your need.
      1. For single deployment, provide the required details: Server Name, User Name, Password, Path.

      2. If you select the checkbox Use an account stored in Password Manager Pro, you need not provide the password as PMP will take the user account details directly from the database.

      3. If you select the checkbox Use Password Manager Pro service account credentials for authentication, you need not provide the username and password as PMP will take the user account details directly from the database.

      4. For certificate deployment on Multiple servers, upload a .csv file comprising the following details: Server Name, User Name, Password, Path.
      5. If you choose the Deployment Type as Agent, choose the host name of the PMP agent from the Select Agent drop-down and click Save to save the agent details.


    3. After providing the details, click Deploy.

    The selected certificates are deployed to Personal Certificates.

    1.3 Deploying Certificates to Internet Information Services (IIS)

    1. To deploy certificates to Internet Information Services (IIS), choose the server type as IIS.
    2. Select the Deployment Type as Single, Multiple or Agent as per your need.
      1. For single deployment, provide the required details: Server Name, User Name, Password, Path.

      2. If you select the checkbox Use an account stored in Password Manager Pro, you need not provide the password as PMP will take the user account details directly from the database.

      3. If you select the checkbox Use Password Manager Pro service account credentials for authentication, you need not provide the username and password as PMP will take the user account details directly from the database.

      4. For certificate deployment on Multiple servers, upload a .csv file comprising the following details: Server Name, User Name, Password, Path.
      5.  If you choose the Deployment Type as  Agent, choose the host name of the PMP agent from the Select Agent drop-down and click Save to save the agent details.
    3. After providing the details, click Deploy.

    The certificate(s) are deployed to Server certificates of the specified server(s).

    1.4 IIS Binding

    Follow the below steps to deploy a certificate to the IIS server and bind the certificate to a site running in that server.

    Note: IIS Binding for the Deployment Type Single works only if the IIS server and PMP are in the same domain. However, if an IIS Server resides in a demilitarized zone, choose the Deployment Type as Agent and proceed with the steps for the same given below.

    1. To deploy certificates on a Microsoft IIS server and perform IIS binding, choose the server type as IIS Binding.
    2. Select the Deployment Type as Single or Agent as per your need.
      1. If you choose the deployment type as Single, enter the required details: Server Name, User Name, Password, Path, Site Name.

      2. Specify the name of a valid IIS server to which the certificate needs to be deployed, and provide the user account credentials.
      3. Specify a path in the server where the certificate must be placed.
      4. If you select the checkbox Use an account stored in Password Manager Pro, you need not provide the password as PMP will take the user account details directly from the database.
      5. If you select the checkbox Use Password Manager Pro service account credentials for authentication, you need not provide the username and password as PMP will take the user account details directly from the database.

      6. If the IIS Server resides in a demilitarized zone, choose the Deployment Type as Agent. Select an agent from the drop-down. Click Get Sites And Bindings to list all sites and their respective bindings available in the selected server. Enter the name of a site in the Site Name field, click Get Bindings to list all the bindings available for that site.

      7. Here, to add new bindings, click Add New Bindings and enter attributes such as Host Name, Port, IP Address, and select a certificate. The newly added bindings will be visible under Admin >> SSL Certificates >> IIS Binding. The new site bindings added in PMP will not reflect in the IIS server until they are deployed to the server using the Deploy and Bind option.
      8. To populate the list of sites associated with the IIS server, click Get Site Names and choose a site from the drop-down. To enter a site name manually in the SiteName field, click Hide List, type in the site name and click the Get Bindings option.
      9. Enter the Host NameIP Address and Port of the site manually.
      10. Select the Restart Site option to restart the site automatically.
      11. Click Add Binding/Update Binding to deploy the certificate at the path specified in your IIS server and complete IIS site binding.
      12. To update multiple bindings, select the required bindings from the list, click Save. Go to Admin >>SSL Certificates >> IIS Binding, select the bindings and click Deploy and Bind.

      13. To save the specified details and deploy the certificate later, click Save. The server details and the respective site details will be available under Admin >>SSL Certificates >> IIS Binding.
      14. To edit the binding details, click the Edit icon beside a server. In the window that opens, modify any of the given details and click Save. Now, select the server name and click Deploy And Bind from the top bar. The selected certificate will be deployed on the servers and the IIS binding will be updated in the IIS server.
      15. Details of sites and IIS bindings displayed in the IIS Binding table above are local to PMP. To update the binding entries here with the entries from IIS server, select the required entries and click Update Binding.

      16. Deleting entries from the above table will not remove any data from the IIS server.

    1.5 Deploying Certificates to a Linux Server

    1. To deploy certificates to a Linux server, choose the server type as Linux.
    2. Select the Deployment Type as Single or Multiple as per your need.
      1. For Single server deployment, provide  the required details: Server Name, Port (port 22 is assigned by default), User Name, Password, Path, Certificate File Name (optional), Keystore File Name (optional).
      2. You can opt for a key-based authentication for password-less servers by choosing the Import Key credential type. Upload the private key associated with the required user account in the target server and provide the key passphrase.
      3. If you select the checkbox Use an account stored in Password Manager Pro, you need not provide the password as PMP will take the user account details directly from the database.
      4. For certificate deployment on Multiple servers, upload a .csv file comprising the following details: Server Name, User Name, Password, Path, Certificate file name (optional).
    3. After providing the details, click Deploy.

    The certificate is deployed to the specified server in the specified path.

    Note: Key-based authentication option is available for single deployment type only.The private key uploaded during key-based authentication is for one-time use only and is not stored anywhere in the Password Manager Pro database. If you wish to add it to the Password Manager Pro repository, use the Import Keys option from the SSH Keys tab to do it manually.

     

©2014, ZOHO Corp. All Rights Reserved.

Top