Automating CLM for JBoss

JBOSS can be configured on two types of machines: Linux and Windows. Developed by JBOSS, this server can be deployed on both operating systems, providing flexibility and compatibility for various environments.

Prerequisites

  • Ensure that the following packages are installed to facilitate device addition for linux:
    • sudo/dzdo (optional, as per the access elevation selected)
    • timeout
    • base64
  • Ensure that the target IP address is accessible from the cloud connector and the port is open.
  • Make sure that the language setting for the JBoss Server is set to English. Ensure that the sudo prompt string follows the standard Linux format, which is typically "[sudo] password for <your_username>:"
  • Only certifiticates in .pem, .crt, and .cer formats and key files are discovered.
  • SSH private keys cannot be used in conjunction with password-enabled sudo/dzdo settings. Therefore, if an SSH key is used for authentication, ensure that the sudo/dzdo configuration is set to passwordless.
  • Certificates are not identified from the path that does not have the required permission such as 640 for the user. Ensure that the file is the same as configured in device addition; hence, configure the certificates in the config files with accessible path or change file permissions to make the files accessible.
  • Verify that the commands needing sudo or dzdo access have been enabled on the server.
  • Check for the ServerRoot location in the httpd file. Make sure it holds forward slashes(/) as path separator as in other Linux-based file locations. (This might lead to failure in managing JBoss server installed on the Windows machines).

Onboarding JBoss Linux

  1. Go to (Menu) > CERT+ > ADMINISTRATION > Device Management.
    By default, the ADC tab opens.
  2. Click the Server tab.
  3. Click the (Add) icon.
    The Device details page is displayed.
  4. Select JBoss from the Vendors list.
  5. In the Server details section, select/enter the details as follows.
    Table 1. Server Details - Field Description Table
    Fields Description
    *Operating system type Select the Linux radio button.
    *Server name Enter the name of the designated JBoss Linux server.
    Data center Choose the desired data center.
    Onboarding Group Select the onboarding group to assign the device.
    Note: Devices without an assigned group are automatically mapped to the Default group during migration, onboarding, and when edited without existing group mappings.
    Communication mode Select the SSH or SSM protocol to be used for communication between the AppViewX node and the JBoss server. SSH is the preferred communication mode.
    *IP address/FQDN Enter the IP address or the fully qualified domain name (FQDN) of the server that is to be onboarded.
    *SSH Port Retain the value 22; it is the default port used for the SSH communication mode. (The field is not displayed for SSM communication mode.)
    Cert Sync Choose from any of the following:
    • Managed - AppViewX performs the config fetch operations and the certificates are discovered and managed in the inventory. CLM actions (push & bind, rollback etc.) can be performed on them.
    • Monitored - AppViewX performs the config fetch operations and the certificates are downloaded in the inventory in the read-only state. CLM actions cannot be performed on them.
    • Ignored - AppViewX only performs the config fetch operations for the devices. There is no certificate discovery performed.
    *: Mandatory fields
  6. In the Credentials section, select/enter the details as indicated below. The credentials entered in this section are used to authenticate the session between the AppViewX node and the JBoss server device.
    If Communication mode = SSH the fields are as follows:
    Table 2. Credentials - Field Description Table
    Fields Description
    *Credential Type Select the credential type from the dropdown.
    • Manual entry (default)
    • Credential List - Appviewx
    • SSH
    Note:
    • If Credential list - Appviewx is selected, the *Credentials list dropdown field is displayed. Select any of the preconfigured credential values.
    • If SSH is selected, enter the *Username, *Upload key file, and enter the Passphrase for authentication.
    *Username Enter the designated username for authentication.. (field displayed for manual entry and SSH)
    *Password Enter the secure password. (field displayed for manual entry only)
    *: Mandatory fields
    If Communication mode = SSM the fields are as follows:
    Table 3. Credentials - Field Description Table
    Fields Description
    *Credential Type Select the credential type from the dropdown.
    • Manual entry (default)
    • Credential List - cloudAccount
    Note: If Credential list - cloudAccount is selected, the *Account name dropdown field is displayed. Select any of the preconfigured credential values.
    *Access key Enter the access key to login to the EC2 instance of the AWS cloud machine.
    *Secret key Enter the secret key to login to the EC2 instance of the AWS cloud machine.
    *: Mandatory fields
  7. In the Vendor Specific Details section, select/enter the details as indicated below.
    If Communication mode = SSH the fields are as follows:
    Table 4. Vendor Specific Details - Field Description Table
    Fields Description
    Access Elevation By default, application uses none. You can change the command if needed.
    Note: SSH key-based authentication doesn't support password enabled sudo/dzdo.
    If Communication mode = SSM the fields are as follows:
    Table 5. Vendor Specific Details - Field Description Table
    Fields Description
    *Region Enter the geographic region of the AWS instance.

    Example: us-east-2
    *Instance id Enter the unique identifier for an EC2 instance in AWS.

    It is required to perform actions or execute commands on a specific EC2 instance

    Example: i-02573cafcftext
    *SSM document name Enter the name of the SSM document that contains the script or action to be executed on the EC2 instance.

    Example: AWS-RunShellScript is an SSM document that allows you to execute shell scripts on EC2 instances.
    *SSM document version Specify the version of the SSM document to be executed.

    Example: 1
    *S3 bucket name Enter the S3 bucket name used to store command output or logs executed in the EC2 instance.

    Example: avxdiscoverydocument-c2
    Proxy required Select the checkbox to enable the secure proxy service.
  8. Click Save.
    The JBoss Linux device is onboarded successfully.

Onboarding JBoss Windows

  1. Go to (Menu) > CERT+ > ADMINISTRATION > Device Management.
    By default, the ADC tab opens.
  2. Click the Server tab.
  3. Click the (Add) icon.
    The Device details page is displayed.
  4. Select JBoss from the Vendors list.
  5. In the Server details section, select/enter the details as follows.
    Table 6. Server Details - Field Description Table
    Fields Description
    *Operating system type Select the Windows radio button.
    *Server name Enter the name of the designated JBoss Windows server.
    *Hostname Enter the hostname of the windows server that is to be onboarded.
    Communication mode Select the Gateway or SSM protocol to be used for communication between the AppViewX node and the JBoss server. Gateway is the preferred communication mode.
    Data center Choose the desired data center. It holds all the SSL What can you do next? that is to be retrieved from the JBoss server.
    Cert Sync Choose from any of the following:
    • Managed - AppViewX performs the config fetch operations and the certificates are discovered and managed in the inventory. CLM actions (push & bind, rollback etc.) can be performed on them.
    • Monitored - AppViewX performs the config fetch operations and the certificates are downloaded in the inventory in the read-only state. CLM actions cannot be performed on them.
    • Ignored - AppViewX only performs the config fetch operations for the devices. There is no certificate discovery performed.
    *: Mandatory fields
  6. In the Credentials section, select/enter the details as indicated below. The credentials entered in this section are used to authenticate the session between the AppViewX node and the JBoss server device.
    If Communication mode = SSH the fields are as follows:
    Table 7. Credentials - Field Description Table
    Fields Description
    *Credential Type Select the credential type from the dropdown.
    • Manual entry (default)
    • Credential List - Appviewx
    Note: If Credential list - Appviewx is selected, the *Credentials list dropdown field is displayed. Select any of the preconfigured credential values.
    *Username Enter the designated username for authentication.. (field displayed for manual entry and SSH)
    *Password Enter the secure password. (field displayed for manual entry only)
    *: Mandatory fields
    If Communication mode = SSM the fields are as follows:
    Table 8. Credentials - Field Description Table
    Fields Description
    *Credential Type Select the credential type from the dropdown.
    • Manual entry (default)
    • Credential List - cloudAccount
    Note: If Credential list - cloudAccount is selected, the *Account name dropdown field is displayed. Select any of the preconfigured credential values.
    *Access key Enter the access key to login to the EC2 instance of the AWS cloud machine.
    *Secret key Enter the secret key to login to the EC2 instance of the AWS cloud machine.
    *: Mandatory fields
  7. In the Vendor Specific Details section, select/enter the details as indicated below.
    If the Communication mode = Gateway the fields are as follows:
    Table 9. Vendor Specific Details - Field Description Table
    Fields Description
    *Installation directory path Enter the directory/path where the application is installed.

    Example: C:\Tomcat8\JBoss-Tomcat-8.5.35
    *: Mandatory fields
    If the Communication mode = SSM the fields are as follows:
    Table 10. Vendor Specific Details - Field Description Table
    Fields Description
    *Installation directory path Enter the directory/path where the application is installed.

    Example: C:\Tomcat8\JBoss-Tomcat-8.5.35
    *Region Enter the geographic region of the AWS instance.

    Example: us-east-2
    *Instance id Enter the unique identifier for an EC2 instance in AWS.

    It is required to perform actions or execute commands on a specific EC2 instance

    Example: i-02573cafcftext
    *SSM document name Enter the name of the SSM document that contains the script or action to be executed on the EC2 instance.

    Example: AWS-RunShellScript is an SSM document that allows you to execute shell scripts on EC2 instances.
    *SSM document version Specify the version of the SSM document to be executed.

    Example: 1
    *S3 bucket name Enter the S3 bucket name used to store command output or logs executed in the EC2 instance.

    Example: avxdiscoverydocument-c2
    Proxy required Select the checkbox to enable the secure proxy service.
    *: Mandatory fields
  8. In the Windows gateway details section, enter the details as indicated below. (This section is not displayed if Communication mode = SSM)
    Table 11. Windows Gateway Details - Field Description Table
    Fields Description
    *Gateway type Select to use the PowerShell or WMI commands as the gateway communication mode.
    *Gateway location The value Remote is selected by default.
    *Select gateway Select the New or Existing gateway to be used. The below fields are enabled/disabled according to the selection.
    *Windows gateway name Enter the new gateway name. (Enabled when New is selected as gateway)
    *Windows gateway URL Enter the URL for the new gateway. (Enabled when New is selected as gateway)
    Client authentication certificate Click Browse and upload the client authentication certificate for the new gateway. (Enabled when New is selected as gateway)
    *Windows gateway Select any of the existing configured gateways from the dropdown list. (Enabled when Existing is selected as gateway)
    *: Mandatory fields
  9. Click Save.
    The JBoss Windows device is onboarded successfully.

Validating the Device

After the device is onboarded successfully, follow the steps to validate the device communication with AppViewX:
  1. Go to ADMINISTRATION > Device Management.
    By default, the ADC tab opens.
  2. Click the Server tab.
    The Server Inventory page is displayed.
  3. Check that the device name appears in the inventory (Name column) with the specified status in the status column.
    The status column will have the value Managed/Monitored/Ignored if the connection is successful or displays Failed/Unresolved in case of failure.
  4. From the Status column, click the Managed/Monitored/Ignored/Failed/Unresolved.
    Device Status Log pop-up is displayed.
  5. Expand each value in the pop-up to know the Device communication, Device Version, Instance Information, and Certificate Discovery From Device.

Discovering Certificates for JBoss

  1. Go to (Menu) > CERT+ > CERTIFICATE DISCOVERY > Discovery > Managed Devices Scan.
    The Discovery : Managed Devices Scan : Add Discovery page is displayed.
  2. To initiate a managed devices scan, enter the Discover Details.
    1. To specify the frequency at which the certificate discovery scan will be triggered, select the Discovery Run Type.
      Table 12. Discovery run type options
      Field Description
      On-demand The certificate discovery scan will be triggered manually by the user as and when required.
      Scheduled The certificate discovery scan will be triggered automatically at the specified time and date.
    2. Enter the details for initiating an on-demand managed devices certificate discovery scan.
      Table 13. Field descriptions for on-demand discovery
      Field Description
      *Discovery Instance Name Enter a name for the discovery instance.
      Description Enter additional details related to the discovery option.
      Note: Character limit: 2000 characters

      OR

      Enter the details for initiating a scheduled managed devices certificate discovery scan.

      Table 14. Field descriptions for scheduled discovery
      Field Description
      *Discovery Instance Name Enter a name for the discovery instance.
      Description Enter additional details related to the discovery option.
      Note: Character limit: 2000 characters
      Time Zone Select your time zone.
      Occurrence Type
      From the dropdown list, from the following options, select an occurrence frequency:
      • Daily
      • Weekly
      • Monthly
      • Yearly
      *Repeat On
      Note: This field is displayed only when Occurrence Type = Weekly.
      Select the checkbox corresponding to the day of the week on which you want the discovery occurrence to repeat.
      *Starts On Click (Calendar widget) to select a date to start the scheduled discovery.
      *Ends From the following options, select when the scheduled discovery is to end:
      • Never: Discovery never stops.
      • After: Discovery stops after the number of occurrences specified in the text field.
      • On: Discovery stops on the date selected using (Calendar widget).
      Summary Displays a summary of the selections made for scheduled discovery
      *: Mandatory fields
  3. In the Discover By section, enter the discovery details.
    Table 15. Instruction for discovering certificates
    Field Description
    *Discovery From From the dropdown list, select Managed Servers.
    Devices window A list of all the managed server devices is displayed in the devices window.

    To select devices for certificate discovery, select the checkbox(es) for the required devices.

    The devices window has the following option:

    • Search: Enter keywords to filter and select the desired vendor or device name from thematching results.
    • Add as Favorites: You can mark your frequently used devices as favorites.
    • All: Select this to see the complete list of devices (unfiltered).
    • Selected: Select this to list only the selected devices.
    • Unselected: Select this to list only the unselected devices.
    • Delete: Delete the required devices from the favorites list.
    Execute Batches Sequentially To execute the discovery operation on the specified batches sequentially, select this checkbox.
    *Interval Between Batches If Execute Batches Sequentially is selected, enter an interval duration (in minutes) in this field. The sequential execution of the batches is spaced according to the interval value entered here.
    *Discovery Type From the following options, select one:
    • All Certificates: Select this to discover all certificates.
    • Certificates in Use: Select this to discover only those certificates that are associated with a service.
    *: Mandatory fields
  4. In the Discovery Rules section, from the Associate Rule dropdown list, select a rule that will be used to filter the discovered certificates.
    A set of filters is combined to create a rule, from the Rules menu. The selection of rules will apply respective filters on discovered certificates.
  5. In the After Discover section, enter the following details:
    Table 16. Field descriptions for the After Discover section
    Field Description
    *Move Certificate to Inventory with Status Select from one of the following options:
    • Do not move: The newly discovered certificates and their objects will not be moved to the inventory.
    • Managed: The newly discovered certificates and their objects will be moved to the inventory with the status set to Managed.
    • Monitored: The newly discovered certificates and their objects will be moved to the inventory with the status set to Monitored.
    Use Access Control Rule To apply the rule configured using Access Control, select this checkbox.
    Note: If this checkbox is enabled, the certificate group will be associated automatically by the rule in access control.
    *Certificate Group From the dropdown list, select a certificate group to which the discovered certificates will be associated.

    Based on the group association, a policy will also be applied to these certificates, which will help ascertain compliance or non-compliance.

    *: Mandatory fields
  6. Click Discover/Schedule to trigger the on-demand/scheduled discovery, respectively.
    The discovered certificates are displayed in the certificate inventory.

Enrolling a Server Certificate

Prerequisites

[For Linux-based vendor] OpenSSL is used to generate a private key and a Certificate Signing Request (CSR) as part of the endpoint enrollment process. Ensure that OpenSSL is installed and properly configured on the system before proceeding.

Enrolling a Server Certificate

Server certificate enrollment refers to the process ofcreating a digital ID for an application/web server hosted in the network. It starts with the generation of a key pair (private and public key) and CSR, and then submitting the CSR to the required CA to procure a certificate. CERT+ supports the generation of keypair on the device, HSM, AppViewX. Users can also upload the CSR for enrolling for a digital certificate.

To enroll a server certificate:

  1. Go to (Menu) > CERT+ > CERTIFICATE ACTION > Enroll Certificate > Server
    The Enroll Server Certificate page is displayed.
  2. In the General Information section, from the dropdown list, select the required Assign Group.
  3. Enter the CA Details.
    Table 17. Field descriptions for the CA Details section
    Field Description
    *Certificate Authority From the dropdown list, select the certificate authority to request the certificate enrollment.
    Note: The IDnomic CA can be used for issuing certificates only in an on-prem deployment. Certificates issued through IDnomic CA can be renewed only if they are enrolled using a Registration Authority workflow.
    *Renew Automatically
    Note:
    To automatically renew this certificate:
    1. Turn on the Renew Automatically toggle.

      The *Start Renewing field is displayed.

    2. In the Days Before Expiry field, specify how many days prior to a certificate's expiry the renewal process should start.

      Valid range for number of days: 1 to 120

    Note: The auto renew settings from the parent certificate will be transferred to the child certificate only if the toggle was enabled; they will not transfer if the certificate was renewed manually. After migration, these settings will be disabled for the parent certificate, so enable them manually if needed.
    *Regenerate Automatically To automatically regenerate this certificate:
    1. Turn on the Regenerate Automatically toggle.

      The *Start Regenerating field is displayed.

    2. In the Days Before Expiry field, specify how many days prior to a certificate's expiry the regeneration process should start.

      Valid range for number of days: 1 to 120

      Note: This value can exceed the certificate's validity in case of short-lived certificates.
    Note:
    • This feature can be enabled only for valid certificates (not for revoked/suspended and expired certificates).
    • The auto regenerate settings from the parent certificate will be transferred to the child certificate only if the toggle was enabled; they will not transfer if the certificate was regenerated manually. After migration, these settings will be disabled for the parent certificate, so enable them manually if needed.
    *Re-enroll Automatically To automatically regenerate this certificate:
    1. Turn on the Re-enroll Automatically toggle.

      The *Start Re-enrollng field is displayed.

    2. In the Days Before Expiry field, specify how many days prior to a certificate's expiry the regeneration process should start.

      Valid range for number of days: 1 to 120

      Note: This value can exceed the certificate's validity in case of short-lived certificates.
    Note: User overrides are allowed unless Group Override is active, in which case the group's configuration takes precendence.
    *CA Account From the dropdown list, select the CA account to which the certificate enrollment request will be submitted.
    Certificate Type From the dropdown list, select the required certificate type.
    *Division
    Note: This field is applicable only for Digicert CA.
    From the dropdown list, select the division with which the certificate will be enrolled.
    Certificate Profile
    Note: This field is displayed for only selected CAs. For the IDnomic CA, this field is displayed when only-CA setting is selected from the CA Account dropdown list.

    From the dropdown list, select the certificate profile with which the certificate must enroll.
    *RA Workflow
    Note: This field is displayed when Certificate Authority = IDnomic and a RA setting is selected from the CA Accounts dropdown list.
    From the dropdown list, select the RA workflow that will be used for certificate enrollment.

    For the details of a workflow, you can check them on your CA portal on IDnomic.

    *Issuer Location
    Note: This field is applicable only for Google CA.

    From the dropdown list, select the issuer location associated with the CA account.
    *Issuer Name
    Note: This field is applicable only for Google CA and AppViewX PKIaaS Native.

    From the dropdown list, select the issuer name for issuing the certificate.
    Template Name
    Note: This field will be displayed only when Certificate Authority = AppViewX Native CA.

    Select a template name from the dropdown list.

    Template Name is editable. The selected template will be displayed in the Template/Profile column of the Server Certificate Inventory irrespective of the Managed/Monitor status. You can also search and filter certificates based on the template name within the CERT+ Inventory.
    *Issuance Policy
    Note: This field is applicable only for Futurex.
    From the dropdown list, select the issuing policy for this certificate.

    An issuance policy defines the rules Futurex must follow to process the certificate enrollment request. The selected issuance policy will determine the approval requirements for the certificate, the cryptographic settings, notification triggeres and other configuration parameters.
    *Root CA
    Note: This field is applicable only for Futurex.
    From the dropdown list, select the root CA for the certificate being enrolled.

    This is the trusted root certificate authority that anchors the certificate chain. All issued certificates will ultimately chain up to this root.
    *Signing CA
    Note: This field is applicable only for Futurex.
    From the dropdown list, select the Certificate Authority that will sign the requested certificate.
    *Extension Profiles
    Note: This field is applicable only for Futurex.
    Extension profiles enable you to further modify your certificates with additional field, attributes, and requirements.

    From the dropdown list, select the extension profile that will be used for the certificate being enrolled.

    To read more on and for instructions to create extension profiles, refer the Futurex documentation. For links, see the References section.

    *Approval Group Name
    Note: This field is applicable only for Futurex.
    An approval group is a predefined set of users or roles authorized to approve the certificate enrollment request.

    From the dropdown list, select the approval group to authorize this enrollment request.

    To read more on and for instructions to create and manage approval groups, refer the Futurex documentation. For links, see the References section.
    *Connector Name Enter a friendly name for the CA connector.

    On saving this form, the name entered here will be displayed in the holistic view.
    Description
    Note: Character limit: 2000 characters

    Enter the description in this field.
    *CSR Generation
    Note: This field is applicable for all CAs except Amazon.

    From the following options, select the required method for generating the CSR:

    • AppViewX: Private key and CSR will be created in AppViewX based on CSR parameters given.
      Note: If auto regeneration has been enabled for this cerificate, AppViewX can be enforced as the default CSR generation source (irrespective of any selections made here) every time the certificate is regenerated. To do this, execute the following db script:
      db.cert_metadata.insertOne({"_id":"CERT_AUTO_REGENERATE_DEFAULT_APPVIEWX_CSR", "flag":true})
    • Upload CSR: You can upload a file that contains the CSR details. This source file will be used to populate the CSR parameters, which will then be submitted to the CA.
      1. Under CSR Generation, select Upload CSR.

        The Please paste your CSR field is displayed.

      2. From the Please paste your CSR field, select Browse.
      3. Navigate to the location of your CSR file, and click Open.
      4. Click Upload.

        On successful upload of this file, the CSR fields are populated with the corresponding details.

    • HSM:
      Note: This option is disabled/not displayed when Certificate Authority = Google, CSC Global, and DigiCert One.
      To generate the private key and the CSR, based on the CSR parameters given in an HSM device:
      1. Under CSR Generation, select HSM.
      2. To enter the configuration details for CSR generation, refer the field descriptions given here.
    • End Point:
      Note: This option is disabled when Certificate Authority = Google and CSC Global.
      To generate the private key and the CSR, based on the CSR parameters given in an endpoint device:
      1. Under CSR Generation, select End Point.
      2. To enter the configuration details for CSR generation, refer the field descriptions given here.
    *: Mandatory fields
    Table 18. Field descriptions for using HSM as the CSR generation source
    Field Description
    *Device Type From the dropdown list, from the following options, select the type of device on which the private key and the CSR will be generated:
    • HSM Devices (AppViewX will directly communicate with the HSM device for the CSR generation.)
    • ADC Devices (The selected ADC device will interact with the HSM to generate the CSR and subsequently transmit the relevant details to AppViewX.)
    *Vendors This field is displayed only when Device Type = ADC Devices.

    From the dropdown list, select the required ADC device vendor.
    Module Number This field is displayed when Device Type = ADC Devices and Vendors = Thales.

    In the event that multiple HSMs are configured on a system, module number is a unique identifier assigned to each HSM.

    In this field, enter the module number assigned to the selected Thales device.
    *Devices From the dropdown list, select the required HSM/ADC device.

    This field is populated based on the Device Type and Vendors selected.

    • For Device Type = HSM Devices

      The dropdown list is populated with HSM devices that were enabled for CSR generation at the time of onboarding and have been successfully onboarded. To read more on onboarding HSM devices in AppViewX, click here.

    • For Device Type = ADC Devices

      The dropdown list is populated with F5 devices that are in the Managed state.

      Currently, AppViewX enables HSM key generation only through F5 devices for the following HSM vendors and their respective supported versions:
      • Fortanix (v14 and onwards)
      • Thales (v12 and onwards)
      • Safenet (v12 and onwards)
    *Key Handler Name This field is displayed when Device Type = HSM Devices.

    Key handler name refers to an identifier used to reference a cryptographic key managed by an HSM device.

    Enter the desired handler name in the field.
    *Key Reference Name This field is displayed when Device Type = ADC Devices.

    Key reference name refers to an identifier used to reference a private key that is stored locally on an ADC device or is securely accessible to the device via an external HSM.

    In this field, enter the reference name assigned to the private key stored in/accessible to the selected ADC device.
    Table 19. Field descriptions for using an endpoint device as the CSR generation source
    Field Description
    Category From the following options, select the ADC device category:
    • ADC
    • Cloud
    • Server
    • WAF
    • Firewall
    Note:
    • Run the following script to enable endpoint CSR generation support for GlobalSignAtlas:
      db.getCollection('cert_metadata').insertOne({
    "_id": "CSR_GENERATION_ENDPOINT_SUPPORTED_VENDOR_GLOBALSIGNATLAS",
    "objectMap": {
        "Server": [
            "ABAP",
            "Web Dispatcher"
        ]
    }
});
    • On selecting GlobalSignAtlas CA, Category is automatically populated as Server.
    Vendor The dropdown list for this field is populated based on the Category selected. From the dropdown list, select the vendor for the end point device.
    Note:
    • On selecting GlobalSignAtlas CA, Vendor is populated with ABAP and Web Dispatcher.
    *Devices This field lists the end point devices present in your environment that belong to the above selected Category and Vendor.
    From the dropdown list, select the end point device on which you want to generate the private key and the CSR.
    Note: On selecting Vendor = Fortinet, both Fortigate and FortiManager devices are populated. Auto-regeneration of certificates with FortiManager as endpoint is not supported.
    *Profile This field is applicable only when Category = Server/WAF. Select a profile from the dropdown list.
    Note: On selection of Vendor = Imperva, CSR generation at the endpoint is supported only for SaaS platforms. Profiles will not be displayed for AWS/on-prem deployments.
    *Tenant This field is applicable only when Category = AD. Enter the tenant ID.
    *Service name From the dropdown list, select the cloud service running on the selected cloud Devices.
    CSR Location This field is applicable only when Category = Server.
    *Template Name This field is applicable only when Category = Firewall.

    Select the required template from the dropdown list.

    Note:
    • This field will be enabled when the Platform = Panorama while onboading PaloAlto device at Menu > CERT+ > Device Management > Inventory> Firewall > Add.
    • Templates and partitions are used to enroll certificates at the template level. To enroll a certificate at the Panorama level, set the template to None.
    Partition This field is applicable only when Category = Firewall.
    *CSR File Name Enter the name of the file that contains the CSR parameters.
    Note:
    • As the extension is already included in the field, ensure that you enter the file name without the file extension.
    • Starting v2023.1.0 FP2, for enrolling Apache server certificates, this field is labeled as CSR File Location.
    *Key File Name Enter the name of the file that contains the private key details.
    Note:
    • As the extension is already included in the field, ensure that you enter the file name without the file extension.
    • Starting v2023.1.0 FP2, for enrolling Apache server certificates, this field is labeled as Key File Location.
    *Certificate File Name This field is displayed only when Category = Cloud. Enter the certificate file name.
    *Key vault This field is displayed only when Category = Cloud, Vendor = Azure, and Service name = Key Vault (Azure).
    *Service
    Note: This field is displayed when Category = Server and Vendor = Microsoft Server.
    This dropdown list is populated based on the Device selected.

    From the options in the dropdown list, select the service.
    *Exchange Server
    Note: This field is displayed when Category = Server and Vendor = Microsoft Server.
    From the dropdown list, select the name of the MS Exchange server for which the certificate is being enrolled.
  4. For the EJBCA certificate authority, enter the vendor details.
    Table 20. Field descriptions for the EJBCA Vendor Specific Details section
    Field Description
    * End Entity Profile Name From the dropdown list, select the end entity profile name.
    End entity user name Enter the name of the end user entity.
    * Issuer Common Name From the dropdown list, select the issuer common name.
    *Certificate Profile Name From the dropdown list, select the certificate profile name.
    *: Mandatory fields
    Note: When generating a new private key on an endpoint, existing keys (including .txt encrypted key files) are not overwritten immediately.
    • For non–password-protected certificate types (PEM-.crt, PEM-.cer, PEM-.pem, DER-.der, DER-.cer, PKCS7-.p7b, PKCS7-.p7c), the .txt file is decrypted into the original key filename (keyfile.key) during the push. If a key with the same name already exists, it will be replaced.
    • For password-protected certificate types (Default JKS-.jks, JKS-.keystore, PKCS12-.p12, PKCS12-.pfx):
      • During the push , the encrypted .txt file is decrypted into a temporary, timestamped key file (keyfile_.key).
      • This decrypted key is then combined with the certificate to create the final bundled output (e.g., .pfx, .jks).
      • After bundling, the temporary timestamped key file is deleted; Because the decrypted key file is temporary and timestamped, no key replacement occurs, and no existing key files are overwritten.
    This is currently applicable for:
    • Linux vendors - Generic Linux, Apache Linux, Tomcat Linux, and Nginx Linux.
    • Windows vendors - Windows Apache, Windows Tomcat, and Microsoft SQL.
  5. For the certificate being enrolled, enter the CSR Parameters.
    Note: For DigiCert One, all CSR parameters that are assigned static values in the certificate profile will be auto-populated and disabled for editing.
    Table 21. Field descriptions for the CSR Parameters
    Field Description
    Replace PSE File The Replace PSE File checkbox enables users to generate the CSR or private key in the Server. This checkbox is displayed only in the case described below:
    1. Select the CSR Generation radio button as Endpoint.
    2. Select Category as Server, Vendor as ABAP or Web Dispatcher The Profiles dropdown is the only other field displayed below it and is populated with a list of .pse file names.
    3. Select the required Profile from the dropdown. Based on the values selected, the fields in the CSR Parameters section are auto-populated.

    The Replace PSE File checkbox is disabled by default and the SAN details fields in CSR Parameters section are also disabled. Selecting the checkbox will make the SAN details enabled and allow for values to be updated.
    *Common Name Enter the certificate's common name.

    The common name is one of the key values of Certificate Signing Request (CSR) to be present in the certificate. For example, <appviewx>.

    Note: Constraints:
    • Character limit: 64 characters
    • No special characters allowed except en dash (_) and hyphen (-).
    • For VMware vCenter, enter the device's FQDN to avoid certificates being rejected. If left blank, the FQDN will be auto-detected and populated.
    Subject Alternative Name From the dropdown list, select the Subject Alternative Name category for the certificate being enrolled.

    In the corresponding field(s) displayed for the selection made, enter the required values.

    Note:
    • Multiple values must be separated by a comma.
    • After enrollment, the cumulative count of SANs is displayed in the certificate property pop-up window from the holistic view.
    • For VMWare vCenter, enter the device's FQDN to avoid certificates being rejected. If left blank, the FQDN will be auto-detected and populated.
    DNS Mutiple SAN values must be separated by a comma (,).
    Organization The organization name is one of the CSR parameters to be present in the certificate. This field will be auto-filled and editable based on the configuration in the selected group’s policy.
    Note: For VMWare vCenter, this is a mandatory field.
    Organization Unit Organization Unit name is one of the CSR parameters to be present in the certificate. This field will be auto-filled and editable based on the configuration in the selected group’s policy.
    Note: For VMWare vCenter, this is a mandatory field.
    Locality The locality name is one of the CSR parameters to be present in the certificate. This field will be auto-filled and editable based on the configuration in the selected group’s policy.
    Note: For VMWare vCenter, this is a mandatory field.
    State The state name is one of the CSR parameters to be present in the certificate. This field will be auto-filled and editable based on the configuration in the selected group’s policy.
    Note: For VMWare vCenter, this is a mandatory field.
    Country Country name is one of the CSR parameters to be present in the certificate. This field will be auto-filled and editable based on configuration. It must be a 2-letter country code (for example, US, and so on).
    Note:
    • For renewal of the certificate being enrolled, country name is required.
    • For VMWare vCenter, this is a mandatory field.
    Email Address Enter a valid email address of the person responsible for maintaining the certificate.
    Note: For VMWare vCenter, this is a mandatory field.
    *Validity To specify the validity of the certificate being enrolled:
    1. From the first dropdown list, select the number of days/months/years.
    2. From the second dropdown list, select the unit of the duration from the following values: Days/Months/Year.
      For example, if the validity of the certificate is 2 months:
      1. From the first dropdown list, select 2.
      2. From the second dropdown list, select Months.
    Note: The uploaded certificate validity for Globalsign MSSL is set to 365 days.
    Challenge Password Challenge password is one of the CSR parameters to be present in the certificate. Password must contain at least one alphabet (uppercase and lowercase), one number, and one special character.
    Confirm Password Re-enter the password entered in the Challenge Password field.
    *Hash Function The Hash function with which the CSR has to be signed. Any information specific to any CA or vendor has to be covered in the Note section. This field will be auto-filled and editable based on the configuration in the selected group’s policy.
    Note: For Certificate Authority = HydrantID, irrespective of the hash function selected, by default, the CA returns a certificate with SHA256. Therefore, admins must restrict users from creating a certificate with a hash function other than SHA256. To accomplish this, create policy with a single hash value (SHA256).
    *Key Type The key type is used while creating a private and public key pair. This field will be auto-filled and editable based on the configuration in the selected group’s policy.
    Note:
    • FortiManager supports only RSA key type of 512, 1024, 1536, 2048, 3072, 4096 bits.
    • VMWare supports only RSA of 2048, 3072, 4096, 7680, 8192 bits and EC key type.
    *Bit Length The bit length is used while creating a private and public key pair. This field will be auto-filled and editable based on the configuration in the selected group’s policy.
    *: Mandatory fields
  6. In the Attachments section, upload any additional documents that are relevant to the enrollment of the certificate (for example, approval emails).
    Table 22. Field descriptions for the Attachments section
    Field Description
    Name Enter a name for the document. This need not be the actual name of the document; it can be an alternate name that will be used for reference only.
    Comments Enter any details relevant to the document being attached.
    Note: Character limit: 2000 characters
    Upload File To upload an attachment:
    1. Click Upload.
    2. Navigate to the location of the document to be uploaded.
    3. Select the document to be document and click Open.

      The selected document is uploaded and listed in the table displayed below these fields in the Attachments section.

      Tip: If you have uploaded multiple attachments, use the Search field to find the required one.
    *: Mandatory fields
  7. In the Certificate Attributes section, enter organization-specific values, for the certificate attributes and custom attributes for the issuing CA, that need to be mentioned along with the CSR.
    These values will not be a part of the certificate but will be available in the AppViewX inventory. For example, cost center.
    Note: This additional information can be used to filter certificate details in the inventory.
  8. Enter the relevant details in the Generic Fields. These are default fields for maintaining the IP address and device information, if required.
    Table 23. Field descriptions for the Generic Fields
    Field Description
    Device Name Enter the name of the device.
    Application IP Address Enter the IP address of the application.
    Tracking ID A free-form business alpha-numerical identifier, included in the audit logs, that may be used to correlate audit log entries (typically enrollment and revocation events)
    Certificate holder Email
    Note: For the IDnomic CA, this field is displayed only when the selected CA account has been configured using a Registration Authority (RA).
    An email address that may be used to send notifications to certificate holder depending on the notification policies configured for the requested workflow
    First name
    Note: For the IDnomic CA, this field is displayed only when the selected CA account has been configured using a Registration Authority (RA).
    First name (as a metadata) associated with the certificate to be enrolled
    Last name
    Note: For the IDnomic CA, this field is displayed only when the selected CA account has been configured using a Registration Authority (RA).
    Last name (as a metadata) associated with the certificate to be enrolled
    Organization
    Note: For the IDnomic CA, this field is displayed only when the selected CA account has been configured using a Registration Authority (RA).
    Organization name (as a metadata) associated with the certificate to be enrolled
    Comment
    Note: For the IDnomic CA, this field is displayed only when the selected CA account has been configured using a Registration Authority (RA).
    Additional information (as a metadata) associated with the certificate to be enrolled
    UUID
    Note: For the IDnomic CA, this field is displayed only when the selected CA account has been configured using a Registration Authority (RA).
    Universal Unique Identifier, or UUID, (as a metadata) associated with the certificate to be enrolled
  9. In the Vendor-Specific Details section, enter the CA-specific details. Some of the CAs will expect additional details other than CSR parameters as meta data for their operational purposes. Details common to all CAs will be taken from the AppViewX user information of the logged in user.
    Table 24. Field descriptions for the common vendor specific details
    Field Description
    Certificate ID The Certificate ID is auto-populated based on the value entered in the Common Name field (in the CSR Parameters section).
    • The Certificate ID can be modified by the user.
    • If the user edits the Certificate ID, any change to the Common Name will not reflect in the Certificate ID.
    • If the user deletes the Certificate ID, the value of the Certificate ID field is set to the Common Name suffixed with the timestamp.
    Table 25. Field descriptions for the CSC Global CA vendor specific details
    Field Description
    *Server Type From the dropdown list, select the server on which the application that requires the requested certificate is hosted.
    *Business Unit Enter the name of the business unit that is requesting the certificate.
    *Organization Contact Enter the email address of the contact in the organization requesting the certificate.
    *Phone Number Enter the phone number of the Organization Contact in the followung format: +<country code>-<phone number>.
    Note: For CSC Global, the phone number is not fetched from the AppViewX user information because of the difference in format.
    *Domain Control Validation Type From the following options in the dropdown list, select the method CSC Global will use for authentication before issuing a certificate:
    • EMAIL: CSC Global will send an approval/confirmation request to the registered email ID. Certificate issuance happens only after approval is received.
    • CNAME: On requesting certificate issuance, CSC Global will provide you with a dynamic string. Add a CNAME record with this string to your DNS settings. CSC will issue the certificate requested only after validating this CNAME record.
    Note: CSC Global will perform domain validation for all CLM actions.
    *: Mandatory fields
    Table 26. Field descriptions for the Custom CA vendor specific details
    Field Description
    *CRL and OCSP required To control the inclusion of CRL and OCSP settings, turn this toggle button on/off as required.
    *: Mandatory fields
    Table 27. Field descriptions for the DigiCert CA vendor specific details
    Field Description
    *Server Type From the dropdown list, select the server on which the application that requires the requested certificate is hosted.
    *Payment Method From the dropdown list, select one from the following payment methods:
    • Bill To Account Balance: This option allows you to pay for the DigiCert certificate using the available balance in your DigiCert account.
      Note: Ensure that the option to bill to account balance is enabled for the account and the account has sufficient balance.
    • Bill To Default Credit Card: This option will charge the cost of the DigiCert certificate to the credit card set as the default payment method in your DigiCert account.
      Note: Ensure that a credit card is configured as the default payment method for your account.
    Additional Email Enter email addresses that will receive notifications for renewals, reissues, and duplicates for the specified order.
    Renewal Message Enter a custom message that will be sent with the renewal notifications.
    Notes Enter a custom note that will be sent with the order.
    *: Mandatory fields
    Table 28. Field descriptions for the DigiCert One CA vendor specific details
    Field Description
    Seat ID Enter the seat ID that will be assigned to the certificate being enrolled.
    Seat ID is a unique user-defined value assigned to identify an entity in the DigiCert One account. The seat ID for a certificate is used for certificate enrollment, renewal, and regeneration.
    Note: The Seat ID field is displayed only if the Allow Seat ID during enrollment option is selected for the CA account. In this case, the value entered in the Seat ID field is now a unique identifier for the certificate being enrolled. Otherwise, a common seat ID is assigned to all certificates enrolled for the selected CA account
    Table 29. Field descriptions for the GlobalSign MSSL CA vendor specific details
    Field Description
    *Profile name A profile name is defined at the time of creating an account on the GlobalSign MSSL portal. AppViewX retrieves all your profile names from the GlobalSign MSSL portal and populates them in this dropdown list.

    From the dropdown list, select the profile name the enrolled certificate should be mapped to.
    *: Mandatory fields
    Table 30. Field descriptions for the Hydrant ID CA vendor specific details
    Field Description
    Expiry Emails Enter a comma-separated list of email addresses that will receive the certificate expiry notification from HydrantID.
    Note: HydrantID CA does not accept updates to these email addresses during the renewal process.
    Table 31. Field descriptions for the Nexus CA vendor specific details
    Field Description
    Procedures The Procedures dropdown list will display only the procedures mapped to the server and the default procedure. From the dropdown list, select the required procedure.
    Table 32. Field descriptions for the LetsEncrypt CA vendor specific details
    Field Description
    *Challenge Type Specifies the method for verifying domain ownership. Select the required domain for the validation. The available challenge types are:
    • HTTP
    • DNS.
    Challenge Verify Determines how the DNS challenge will be verified. Select the required verification process. The available challenge verifies are:
    • Manual
    • Automatic.
    The value Automatic suggests that the system will automatically handle the verification process without manual intervention.
    Note: This field appears when the challenge type is selected as DNS.
    Vendor Indicates the DNS provider responsible for managing DNS records. The available DNS service providers are:
    • Cloudflare
    • Azure.
    Note: This field appears when the challenge verify is selected as Automatic.
    *Settings Allows for additional configuration settings related to the DNS challenge. The selected value None implies that no extra settings are applied.
    Note: This field appears when the challenge verify is selected as Automatic.
    Note:
    • Make sure that you have enabled LetsEncrypt DNS Automation from the workflow.
    • To add new vendors for the integration and configuration, refer to Integration topic in the Automation Guide.
    *: Mandatory fields
  10. Click Add.
    Once the details are added, you will be redirected to a page where the CSR and CA details are added as a connector. This page is called the holistic view and from here, any action on the certificate can be performed including provisioning the certificate to a server.
  11. On the holistic view, click the Submit button to trigger the request.
    The submit action is triggered and the Submit dialog box is displayed.
  12. Enter your comments in the text field and click Yes.
    If the approval required option is enabled in the CA policy, the request is moved to the Approve and Implementation stages.
  13. Click Approve to proceed.
    The Approve dialog box is displayed.
  14. Enter your comments in the text field.
    Note: If the workflow request has to be approved automatically in the future, click the Schedule later button .
  15. Click Yes.
    Once the approval process is complete, the Implement option is displayed in the holistic view.
  16. Click Implement.
    The Implement dialog box is displayed.
  17. Enter your comments in the text field.
    If the workflow request has to be implemented automatically in the future, click Schedule later .
  18. Click Yes.
    CSR Submission to CA is in progress.Once the CSR submission is successful, the request state will be changed to Submit certificate - retrieval in progress state.

    If the enrollment request is compliant with conditions defined and auto-approval enabled in the targeted CA, the certificate will be fetched in a few seconds.

    If auto-approval disabled in the targeted CA, you will have to be logged into the CA and approve the request.

    Once the certificate is issued successfully, the certificate will be retrieved into AppViewX. You can now push the enrolled certificate(s) to the required endpoint.

Adding and Pushing Certificates to JBoss Device

Important: Refer to the pre- and post-push script usage instructions here.

Adding an Application Connector for JBoss

  1. On the certificate holistic view, click Add Connector.
  2. Enter the General Information for the connector.
    Table 33. Field descriptions for the connector General Information
    Field Description
    *Category From the dropdown list, select Server.

    If the certificate being pushed was enrolled with CSR generation at endpoint, this field is auto populated with the category selected at the time of certificate enrollment.
    *Vendor From the dropdown list, select JBoss.

    If the certificate being pushed was enrolled with CSR generation at endpoint, this field is auto populated with the vendor selected at the time of certificate enrollment.
    *Connector Name Enter a name for this connector, to be able to identify it later.
    Tip: AppViewX recommends naming connectors according to use cases so they are easily distinguishable.
    Description Enter any additional details you want to record for this connector.
    Based on the information entered here, the SSL templates section is populated with the list of available JBoss devices already onboarded in AppViewX.
  3. To select the device(s) to which the certificate will be pushed, under SSL templates, from the list of Available Devices, click .
    The Selected devices list is updated automatically.
  4. Enter the Certificate Details.
    Table 34. Field descriptions for the Certificate Details
    Field Description
    Use Existing Configuration If the Use Existing Configuration option is enabled,the existing server.xml file is used to create the application connector. (By default, this option is selected.)

    If it is disabled, the server configuration XML file will be overwritten with the values specified in the fields below (displayed only if this option is disabled).
    Certificate Type This field is displayed when Use Existing Configuration is enabled.

    From the dropdown list, select the file type of the certificate to be pushed.
    *KeyStore Location This field is displayed when Use Existing Configuration is enabled and Certificate Type = JKS (*.jks).

    For JKS certificates, a keystore is a repository used for storing private keys and certificates.

    In the KeyStore Location field, enter the path to the location on your local system where the JKS keystore file, for the certificate to be pushed, is stored.
    *Password This field is displayed when Use Existing Configuration is enabled and Certificate Type = JKS (*.jks).

    Enter the password required to access the keystore file for the JKS certificate to be pushed.

    *Alias Name This field is displayed when Use Existing Configuration is enabled and Certificate Type = Default JKS (*.jks) or JKS (*.jks).

    Enter the certificate alias assigned in the CSR generated for requesting/enrolling the certificate.

    Private Key in Device If the private key associated with the certificate being pushed has been stored on a hardware device, select this checkbox.
  5. Enter the Push Details.
    Table 35. Field descriptions for the Push Details
    Field Description
    *Script Location Script files are commonly used to perform certain tasks required to be completed before and/or after a certificate is pushed to the target system.

    The script to be run before the certificate is pushed is called a pre-push script and the script to be run after the push is called a post-push script.

    From the following options, select the location of the script file(s):

    • In AppViewX
    • In Device
    Pre - Push Script File Name Enter the file name of the pre-push script.
    Important: Read the pre and push script usage instructions here.
    Pre - Push Script File Path This field is displayed when Script Location = In Device.
    Enter the location on your local system where the pre-push script file is stored.
    Important: Read the pre and push script usage instructions here.
    Post - Push Script File Name Enter the file name of the post push script.
    Important: Read the pre and push script usage instructions here.
    Post - Push Script File Path This field is displayed when Script Location = In Device.
    Enter the location on your local system where the post-push script file is stored.
    Important: Read the pre and push script usage instructions here.
    Push Automatically To automatically push the certificate after it is renewed/reissued to the target system, enable this checkbox.
    Note: The auto push feature for a certificate works only if enabled for the certificate application connector as well the associated certificate group. To enable this feature at the certificate group level, refer the instructions here.
  6. Click Save.
    The connector is displayed on the certificate holistic view.

Pushing a Server Certificate to a Device

  1. Go to (Menu) > CERT+ > CERTIFICATE ACTION > Push to Device > Server.
    The Server Certificate page is displayed.
  2. To push a certificate, under Common Name, click the required certificate.
    The certificate topology view is displayed.
  3. Click Push to Device. The Push to Device option will be shown if the app connector is already added to the certificate otherwise add the app connector and then proceed.
    Note:
    • Only server certificates that include their private keys will be eligible for push operations to cloud connectors.

      After push, during subsequent discovery, when the CC machine is healthy and discovery returns the pushed certificate, the pushed AppConnector should be in Sync status, else the associated AppConnector must be transitioned to an Out of Sync status.

      If a new certificate is pushed to the gateway while the old certificate for the AppConnector still exists in the inventory, then after the next discovery, the AppConnector must move to Out of Sync status for the old certificate.

    • Endpoint CSR generation is not supported for cloud connectors.
    • The Push to Device option is displayed only after an app connector is added to certificate.
    The Confirmation dialog box is displayed.
  4. Enter your comments, if required, in the text field.
  5. Click OK.
    • The approval process is triggered. The current flow is based on the default policy of two-level approvals.
    • A request ID and work order ID are generated automatically and the work order status is displayed alongside the connector in the certificate topology view.
  6. To approve the push request, from the certificate topology view, click Approve.
  7. In the Confirmation dialog box:
    1. In the Manual Implementation field, to choose the mode of implementation, use the On/Off toggle.
    2. If you select Off, set the date and time to schedule the certificate push.
    3. Enter your comments in the text field and click Yes.
    The work order status displayed beside the connector updates to Push-Review In Progress.
  8. To implement the push request, from the certificate topology view, click Implement.
  9. In the Confirmation dialog box:
    1. In the Manual Implementation field, to choose the mode of implementation, use the On/Off toggle.
    2. If you select Off, set the date and time to schedule the certificate push.
    3. Enter your comments in the text field and click Yes.
    The push action is triggered. After the push action is completed, the status updates to Completed.
    To refresh the certificate topology view, from the top-right corner of the screen, click Refresh.
    An automatic HTTPS-based verification job is run at regular intervals to validate that certificates are correctly installed after the push operations triggered between the intervals; the system compares served certificates with the expected ones across all associated IP:ports. The data gathered by this job is used to create the Push Validation Report that highlights the proportion of successful versus failed push operations, providing a quick view of overall push reliability.

Enabling Auto Renewal of Certificates

To enable auto renewal of certificates, you need to enable the corresponding option for the group to which the certificate in question belongs, as well as the connector created for pushing that certificate.
Note: While you can enable auto push for all types of certificates, for clarity, in this section, we'll look at the instructions for enabling auto push for a server certificate.
  1. To enable auto renewal for the certificate group:
    1. Go to Menu > CERT+ > Groups & Policies > Groups.
      The Group page is displayed.
    2. From the Name field, select the required certificate group.
      The Group : Modify : <group name> page is displayed.
    3. From the Other Details section of this certificate group, turn on the Renew Automatically toggle button.
    4. Click Update.
  2. To enable auto renewal for the certificate connector:
    1. Go to Menu > CERT+ > Certificate Inventory > Server.
      The Server Certificate inventory is displayed.
    2. From the inventory, for the certificate you want to enable auto renew for, click the common name.
      The holistic view of the selected certificate is displayed.
    3. For an existing CA connector for the certificate, hover over .
    4. From the menu displayed, click Edit.
      The certificate details are displayed.
    5. Under CA Details, turn on the Renew Automatically toggle.
    6. In the Start Renewing field, enter the number of days before expiration when the certificate should be renewed.
    7. Click Update.
      The holistic view of the selected certificate is displayed.
      Note: For the auto renewal process to take effect, set the auto push in the application connector. For instructions, refer to the Enabling Auto Push section.

Enabling Auto Regeneration of Certificates

Enabling Auto Regeneration for a Certificate Group

You can enable and configure the auto regeneration feature at the certificate group level, which will apply to all certificates assigned to that group.

For details and instructions to enable auto regeneration at the certificate group level, click here.

Enabling Auto Regeneration at the Certificate Level

Enabling Auto Regenerate for Certificate Enrollment

While you can enable auto regenerate for all types of certificates, for clarity, in this section, we'll look at the instructions for enabling auto regenerate for a server certificate.

For details and instructions to enable auto regeneration at the time of server certificate enrollment, click here.

Enabling Auto Regenerate for Discovered Certificates

While you can enable auto regenerate for all types of certificates, for clarity, in this section, we'll look at the instructions for enabling auto regenerate for a server certificate.
  1. Go to Menu > CERT+ > Certificate Inventory > Server.
    The Server Certificate inventory is displayed.
  2. From the inventory, for the certificate you want to enable auto push for, click the common name.
    The holistic view of the selected certificate is displayed.
  3. For an existing CA connector for the certificate, hover over .
  4. From the menu displayed, click Edit.
    The certificate details are displayed.
  5. Under CA Details, turn on the Regenerate Automatically toggle.
  6. In the Start Regenerating field, enter the number of days before expiration when the certificate should be regenerated.
  7. Click Update.
    The holistic view of the selected certificate is displayed.
    Note: For the auto regenerate process to take effect, set the auto push in the application connector. Refer to the Enabling Auto Push section.

Enabling Auto Push of Certificates to Endpoints

After setting the auto renew/regenerate in the CA connector, you must now enable the auto push in the application connector to ensure the renewed/regenerated certificates are pushed to the end device.

To enable auto push of certificates, you need to enable the corresponding option for the group to which the certificate in question belongs, as well as the connector created for that certificate.

  1. To enable auto push for the certificate group:
    1. Go to Menu > CERT+ > Groups & Policies > Groups.
      The Group page is displayed.
    2. From the Name field, select the required certificate group.
      The Group : Modify : <group name> page is displayed.
    3. From the Other Details section of this certificate group, turn on the Push Certificate Automatically toggle button.
    4. Click Update.
  2. To enable auto push for the certificate connector:
    1. From the holistic view, for an existing application connector for the certificate, hover over (More) icon.
      To add an application connector, follow the instructions given here.
    2. From the menu displayed, click Edit.
      The Edit Application Connector pop-up is displayed.
    3. Select the Push automatically checkbox.
      Important: The auto-push feature works only when it is enabled at the connector level and disabled at the group level. If enabled at the group level but disabled at the connector level, the feature will not function.
    4. Click Save.
      The holistic view of the selected certificate is displayed.
      Note: An Auto Renew Certificates job is scheduled to run every 6 hours. It auto renews the configured certificates based on the number of days before expiry. AppViewX will disable the push automatically option in the Parent certificate application connector and enable it in the renewed certificate application connector.
      Note: An Auto Regenerate Certificates job is scheduled every day. It auto regenerates the configured certificates based on the number of days before expiry.

Troubleshooting Linux JBoss Server

This section helps you troubleshoot the common problems that you might encounter when using certificate server functionalities.This guide will give more troubleshooting processes on server addition, deletion, import, export, push, bind, rollback, and other actions associated with Linux JBoss server.

Issues in Linux JBoss Server Addition using AppViewX UI

Error Message Possible Cause Possible Solution
Device Name already exists. A device with the same name already exists in inventory. Check the Device name, it should be unique.
Details incorrect Some of the mandatory fields might be missing or might be invalid. Add all the valid information in the mandatory section.

Issues in Communicating to Linux JBoss Server

Error Message Possible Cause Possible Solution
Device name cannot be null or empty. Device name is either null or empty. Provide device name as it is a mandatory field.
Invalid device name. Device Name is not valid. The Device name can only contain alphanumeric characters, '-' , '_' , '.' , '*' , '|' , '!' and spaces.
Device IP/FQDN cannot be null or empty. Device IP/FQDN is empty. Provide device IP/FQDN as it is a mandatory field.
Invalid device IP/FQDN address. IP/FQDN address is not valid. Provide valid IP/FQDN address.

Communication to <ip/fqdn> has failed.

Caused by: java.io.IOException: Unable to authenticate with password, keyboard-interactive and publickey methods

Possible Remediations:

1. Kindly check the credentials provided.

 Password of the device added might be wrong. Click on the device name in the Inventory Page. Update the correct password and click Save.

Communication to <ip/fqdn> has failed.

Caused by: java.net.SocketException: Network is unreachable (connect failed)

 IP/FQDN provided is not reachable Check manually by establishing an SSH session to the target device with the provided IP/FQDN.

Communication to <IP/FQDN> has failed.

Caused by: java.net.ConnectException: Connection refused (Connection refused)

Possible Remediations:

1. Kindly check the SSH Port configurations.

2. Kindly check the firewall settings

 Problem with port configuration Check if the configured port in the device addition page is correct.

Communication to <IP/FQDN> has failed.

Caused by: java.io.IOException: Key exchange was not finished, connection is closed.

 Problem with SSH key handshake Request to check the ciphers, key and HMACs configured in the target device and ensure AppViewX SSH-plugin supports the same
<IP/FQDN> has 0 JBoss instance(s) No JBoss server running in the target device,

Login via SSH to the target device and execute the below command to check the status of the JBoss server

“ps -ef | grep jboss”.

Issues in Accessing the Server

Access Issues might be reproduced when communicating with servers while discovering or fetching configuration files. These errors can be collected either from logs, API responses, or in the status field for the particular server.
Error Message Possible Cause Possible Solution
Sudo Access failure Linux Commands execution with sudo fails. Verify if the system has the correct sudo setup.
dzdo Access failure Linux Commands execution with dzdo fails. Verify if the system has the correct dzdo setup.
Permission denied for file/location.

File might not be present in the avx environment.

User might not have permission to read in the given source location.

Device communication might not be established when service has started.

Check whether someone deleted the file from AppViewX environment. Verify if read permission is given for the location.

Verify the device connection and restart the service.

Issues in Credential List

Error Message Possible Cause Possible Solution
Invalid details Mandatory credential details are missing. Provide all the mandatory details to store the credential.
credentials already exist. Credential List with the same name already exists. Provide a unique name to each credential list.
Invalid file format. Accepted formats are .pem and .txt The Identity Key file uploaded is not having the correct format. Provide key file with correct format (.pem or .txt)

Issues in Managed Server

Error Message Possible Cause Possible Solution
The selected devices are managed. The operation cannot be performed. Device cannot be managed because it is already in the managed state. Unmanage the device(s) in the managed state before performing action.
Device with inprogress status cannot be updated Update action cannot be performed on a device in an in-progress state. Wait for the device to be resolved to a state before performing action.

Issues in Unmanaged Server

Error Message Possible Cause Possible Solution
The selected devices are already unmanaged. The operation cannot be performed. Device cannot be unmanaged because it is already in the unmanaged state. Manage the device(s) in an unmanaged state before performing action.
Fetch config not allowed for Unmanaged devices Fetch config operation is only allowed on the devices which are in managed state. Manage the device(s) in an unmanaged/in-progress state before performing action.
Device with inprogress status cannot be updated Update action cannot be performed on a device in an in-progress state. Wait for the device to be resolved to a state before performing action.

Issues in Import Server

Error Message Possible Cause Possible Solution
Invalid file type. Please select a valid file format (csv / xlsx / xls). File type uploaded is not in expected format. Supported file types are CSV/Xls/xlsx only. Check for the extension of the uploaded file.
Maximum five files allowed, please delete any completed file. Maximum of 5 files can be maintained in file history of import page. Delete any of the parsed/completed files to upload a new one.

Issues in Export Server

Error Message Possible Cause Possible Solution
Exception while exporting

General failure - Unable to create file on the local system due to permission issue.

Unable to fetch device list from the database.

Provide access to be able to create the file on the local system. (e.g. check the directory where it is trying to export and give access to AppViewX for that directory)

Make sure the database is running and has correct data.

Issues in Config Fetch

Error Message Possible Cause Possible Solution
Communication to <IP/FQDN> has failed. Device communication has failed due to invalid credentials / SSH Port Verify the input details and check device status error messages in the Issues in Communicating to Linux JBoss Server section.

Issues in Certificate Discovery

Error Message Possible Cause Possible Solution
Please provide information as required

  1. Discovery name is not given or length is less than 2 characters.

  2. Interval between batches info. is missing when execution type is sequential.

  1. Enter a valid name with a minimum of 2 characters.

  2. Provide a time interval between batches in minutes.
Please select a device No device is selected in the “Discover By” section. Select at least one device to discover certificates from.

Issues in CSR generation

Error Message Possible Cause Possible Solution
Problem while generating csr on target server

General Failure -

SSH/SFTP communication failure

 Provide correct credentials and make sure device communication is successful.
Invalid key type specified in the request Given key type might not be supported by open SSL in the target machine. Provide valid key type.
Problem while generating csr on the target server. Location might not have the required permission. Check the permission and provide it.
CSR and Private key has been failed Open SSL configuration might be wrong in the target machine. Check and correct open SSL configuration in the device.
CSR generation got failed User has restricted access to the path configured for the “CSR FileName” and “Key File name” Kindly ensure the user configured for device addition has read/write access to the path configured.

Issues in Push and Rollback

Error Message Possible Cause Possible Solution
Unable to initiate request.

  1. Pushing to device when certificate is unavailable, i.e, in a new state.

  2. Previous work order is in progress and not completed.

  3. AppConnector might not be in sync.

  1. Push to device after certificate has been retrieved from CA.

  2. Initiate push after previous work order is finished.

  3. Synchronize the AppConnector and retry.
Unable to initiate request, template is in disabled state Given workflow is not in enabled state Enable the push/rollback workflow from the Workflow section.
User is not authorized User does not have required permissions to push to the device. Retry after getting the access for required action.
Private key content is unavailable. Private key content is not available for the certificate. Private key is mandatory for the certificate to be pushed.
Application connector(s) not found Application connector info was not found. Provide the correct “connectorId” if not pushing using AppViewX UI.
Request associated with the application connector is in progress Previous work order is in progress and not completed. Initiate this request after the previous work order is finished.
Push not triggered or succeeded or No existing data available for backup process. Rollback couldn’t proceed because push was not successful. Only successfully pushed certificates can be rolled back.
Certificate not found. Pushing to device when certificate is unavailable, i.e, in a new state. Push to device after certificate has been retrieved from CA.
Certificate Push failed User has restricted access to the path configured to push the certificate in the application connector Kindly ensure the user is configured while device addition has the read/write access to the path configured in application connector to certificate push.
PrivateKey in device push invalid “Private key in Device” is enabled in application connector, but key is not available in device. Ensure to enable “Private key in Device” attribute in application connector, if the certificate does not have the key and the certificate is generated using CSR generate option from Device.

Troubleshooting Windows JBoss Server

This section helps you troubleshoot the common problems that you might encounter when using certificate server functionalities. Effective troubleshooting documents depend on the availability of useful, detailed information. This guide will give more troubleshooting processes on server addition, deletion, import, export, push, bind, rollback, and other actions associated with Windows JBoss server.

Issues in Windows JBoss Server Addition using AppViewX GUI

Error Message Possible Cause Possible Solution
Device Name already exists. A device with the same name already exists in inventory. Check the Device name, it should be unique.
Details incorrect Some of the mandatory fields might be missing or might be invalid. Add all the valid information in the mandatory section.

Issues in Communicating to Windows JBoss Server

Error Message Possible Cause Possible Solution
Device name cannot be null or empty. Device name is empty. Provide device name as it is a mandatory field.
Invalid device name. Device Name is not valid. The Device name can only contain alphanumeric characters, '-' , '_' , '.' , '*' , '|' , '!' and spaces.
Communication to <hostname> has failed

Hostname / Username /

Password of the device added might be wrong.

 Click on the device name in the Inventory Page. Update the correct details and click Save.
Communication to <Hostname> has failed due to Error while communicating via windows agent service Windows agent provided is not reachable Check Windows agent is Up and running and update the valid agent in the device addition page.
Error on fetching JBoss instance, config fetch process failed due to No configuration file found. Check installation directory path. Provided installation directory path does not have JBoss configuration files like server.xml /standalone.xml Login manually into the windows server and find the installation directory path which has the JBoss configuration files ( server.xml or standalone.xml) and provide the same directory path in JBoss device addition page.
Error on fetching JBoss instance, config fetch process failed due to df9cbf67-e1af-4d8c-8a7c-fe88bb83e0b3: PowerShell ScriptExecution Error in PTPLD178 : Cannot find path 'C:\tmp_1615504487924.tmp' because it does not exist. Invalid installation directory path Login manually into the windows server and find the installation directory path which has the JBoss configuration files ( server.xml or standalone.xml) and provide the same directory path in JBoss device addition page.
JBoss version fetch is failed No JBoss server running in the target device / something wrong in the JBoss installation

Login manually into the windows server and find the

JBoss server bin directory and run the below command to validate the JBoss version

For JBoss 4.0.5

<JBoss_server_Directory>/bin/run.bat -V

For JBoss 6.4 and 7.0

<JBoss_server_Directory>/bin/standalone.bat -V

Currently only JBoss 4.0.5, 6.4 and 7.0 versions are supported in AppViewX.

Issues in Accessing Server

Access Issues might be reproduced when communicating with servers while discovering or fetching configuration files. These errors can be collected either from logs, API responses, or in the status field for the particular server.
Error Message Possible Cause Possible Solution
Permission denied for file/location.

  1. File might not be present in the environment.

  2. User might not have permission to read in the given source location.

  3. Device communication might not be established when service has started.

  1. Check whether someone deleted the file from the environment.

  2. Verify if read permission is given for the location.

  3. Verify the device connection and restart the service.

Issues in Config Fetch

Error Message Possible Cause Possible Solution
Communication to <hostname> has failed

Hostname / Username /

Password of the device added might be wrong.

 Verify the input details and check for device status error messages in the Issues in Communicating to Windows JBoss Server section.

Issues in Certificate Discovery

Error Message Possible Cause Possible Solution
Please provide information as required

  1. Discovery name is not given or length is less than 2 characters.

  2. Interval between batches info. is missing when execution type is sequential.

  1. Enter a valid name with a minimum of 2 characters.

  2. Provide a time interval between batches in minutes.
Please select a device No device is selected in the “Discover By” section. Select at least one device to discover certificates from.

Issues in CSR generation

Error Message Possible Cause Possible Solution
Problem while generating csr on target server

General Failure -

SSH/SFTP communication failure

 Provide correct credentials and make sure device communication is successful.
Invalid key type specified in the request Given key type might not be supported by open SSL in the target machine. Provide valid key type.
Problem while generating csr on the target server. Location might not have permission. Check the permission and provide it.
CSR and Private key has been failed Open SSL configuration might be wrong in the target machine. Check and correct open SSL configuration in the device.
CSR generation got failed User has restricted access to the path configured for the “CSR FileName” and “Key File name” Kindly ensure the user configured for device addition has read/write access to the path configured.

Issues in Push and Rollback

Error Message Possible Cause Possible Solution
Unable to initiate request.

  1. Pushing to device when certificate is unavailable, i.e, in a new state.

  2. Previous work order is in progress and not completed.

  3. AppConnector might not be in sync.

  1. Push to device after certificate has been retrieved from CA.

  2. Initiate push after previous work order is finished.

  3. Synchronize the AppConnector and retry.
Unable to initiate request, template is in disabled state Given workflow is not in enabled state Enable the push/rollback workflow from the Workflow section.
User is not authorized User does not have required permissions to push to the device. Retry after getting the access for required action.
Private key content is unavailable. Private key content is not available for the certificate. Private key is mandatory for the certificate to be pushed.
Application connector(s) not found Application connector info was not found. Provide the correct connectorId if not pushing using AppViewX UI.
Request associated with the application connector is in progress Previous work order is in progress and not completed. Initiate this request after the previous work order is finished.
Push not triggered or succeeded or No existing data available for backup process. Rollback couldn’t proceed because push was not successful. Only successfully pushed certificates can be rolled back.
Certificate not found. Pushing to device when certificate is unavailable, i.e, in a new state. Push to device after certificate has been retrieved from CA.
Certificate Push failed User has restricted access to the path configured to push the certificate in the application connector Kindly ensure the user is configured while device addition has the read/write access to the path configured in application connector to certificate push.
Certificate push failed due to Private key In device configured. But key content is available with the certificate from appview pushRequest So failing push request. “Private key in Device” is enabled in application connector and also private key is available in the certificate Ensure to uncheck “Private key in Device” attribute in application connector
PrivateKey in device push invalid “Private key in Device” is enabled in application connector, but key is not available in device. Ensure to enable “Private key in Device” attribute in application connector, if the certificate does not have the key and the certificate is generated using CSR gen option from Device.