Automating CLM for Microsoft IIS

1. Turn on the Renew Automatically toggle.

   The *Start Renewing field is displayed.

2. In the Days Before Expiry field, specify how many days prior to a certificate's expiry the renewal process should start.

   Valid range for number of days: 1 to 120

1. Turn on the Regenerate Automatically toggle.

   The *Start Regenerating field is displayed.

2. In the Days Before Expiry field, specify how many days prior to a certificate's expiry the regeneration process should start.

   Valid range for number of days: 1 to 120

   Note: This value can exceed the certificate's validity in case of short-lived certificates.

1. Turn on the Re-enroll Automatically toggle.

   The *Start Re-enrollng field is displayed.

2. In the Days Before Expiry field, specify how many days prior to a certificate's expiry the regeneration process should start.

   Valid range for number of days: 1 to 120

   Note: This value can exceed the certificate's validity in case of short-lived certificates.

From the dropdown list, select the certificate profile with which the certificate must enroll.

For the details of a workflow, you can check them on your CA portal on IDnomic.

From the dropdown list, select the issuer location associated with the CA account.

From the dropdown list, select the issuer name for issuing the certificate.

Select a template name from the dropdown list.

Template Name is editable. The selected template will be displayed in the Template/Profile column of the Server Certificate Inventory irrespective of the Managed/Monitor status. You can also search and filter certificates based on the template name within the CERT+ Inventory.

An issuance policy defines the rules Futurex must follow to process the certificate enrollment request. The selected issuance policy will determine the approval requirements for the certificate, the cryptographic settings, notification triggeres and other configuration parameters.

This is the trusted root certificate authority that anchors the certificate chain. All issued certificates will ultimately chain up to this root.

From the dropdown list, select the extension profile that will be used for the certificate being enrolled.

To read more on and for instructions to create extension profiles, refer the Futurex documentation. For links, see the References section.

From the dropdown list, select the approval group to authorize this enrollment request.

To read more on and for instructions to create and manage approval groups, refer the Futurex documentation. For links, see the References section.

On saving this form, the name entered here will be displayed in the holistic view.

Enter the description in this field.

From the following options, select the required method for generating the CSR:

• AppViewX: Private key and CSR will be created in AppViewX based on CSR parameters given.
  Note: If auto regeneration has been enabled for this cerificate, AppViewX can be enforced as the default CSR generation source (irrespective of any selections made here) every time the certificate is regenerated. To do this, execute the following db script:

  db.cert_metadata.insertOne({"_id":"CERT_AUTO_REGENERATE_DEFAULT_APPVIEWX_CSR", "flag":true})

• Upload CSR: You can upload a file that contains the CSR details. This source file will be used to populate the CSR parameters, which will then be submitted to the CA.
  1. Under CSR Generation, select Upload CSR.

     The Please paste your CSR field is displayed.

  2. From the Please paste your CSR field, select Browse.
  3. Navigate to the location of your CSR file, and click Open.
  4. Click Upload.

     On successful upload of this file, the CSR fields are populated with the corresponding details.

• HSM:
  Note: This option is disabled/not displayed when Certificate Authority = Google, CSC Global, and DigiCert One.
  To generate the private key and the CSR, based on the CSR parameters given in an HSM device:
  1. Under CSR Generation, select HSM.
  2. To enter the configuration details for CSR generation, refer the field descriptions given here.
• End Point:
  Note: This option is disabled when Certificate Authority = Google and CSC Global.
  To generate the private key and the CSR, based on the CSR parameters given in an endpoint device:
  1. Under CSR Generation, select End Point.
  2. To enter the configuration details for CSR generation, refer the field descriptions given here.

• HSM Devices (AppViewX will directly communicate with the HSM device for the CSR generation.)
• ADC Devices (The selected ADC device will interact with the HSM to generate the CSR and subsequently transmit the relevant details to AppViewX.)

From the dropdown list, select the required ADC device vendor.

In the event that multiple HSMs are configured on a system, module number is a unique identifier assigned to each HSM.

This field is populated based on the Device Type and Vendors selected.

• For Device Type = HSM Devices

  The dropdown list is populated with HSM devices that were enabled for CSR generation at the time of onboarding and have been successfully onboarded. To read more on onboarding HSM devices in AppViewX, click here.

• For Device Type = ADC Devices

  The dropdown list is populated with F5 devices that are in the Managed state.

  Currently, AppViewX enables HSM key generation only through F5 devices for the following HSM vendors and their respective supported versions:

  • Fortanix (v14 and onwards)
  • Thales (v12 and onwards)
  • Safenet (v12 and onwards)

Key handler name refers to an identifier used to reference a cryptographic key managed by an HSM device.

Key reference name refers to an identifier used to reference a private key that is stored locally on an ADC device or is securely accessible to the device via an external HSM.

• ADC
• Cloud
• Server
• WAF
• Firewall

Select the required template from the dropdown list.

From the options in the dropdown list, select the service.

1. Select the CSR Generation radio button as Endpoint.
2. Select Category as Server, Vendor as ABAP or Web Dispatcher The Profiles dropdown is the only other field displayed below it and is populated with a list of .pse file names.
3. Select the required Profile from the dropdown. Based on the values selected, the fields in the CSR Parameters section are auto-populated.

The Replace PSE File checkbox is disabled by default and the SAN details fields in CSR Parameters section are also disabled. Selecting the checkbox will make the SAN details enabled and allow for values to be updated.

The common name is one of the key values of Certificate Signing Request (CSR) to be present in the certificate. For example, <appviewx>.

In the corresponding field(s) displayed for the selection made, enter the required values.

1. From the first dropdown list, select the number of days/months/years.
2. From the second dropdown list, select the unit of the duration from the following values: Days/Months/Year.
   For example, if the validity of the certificate is 2 months:

   1. From the first dropdown list, select 2.
   2. From the second dropdown list, select Months.

1. Click Upload.
2. Navigate to the location of the document to be uploaded.
3. Select the document to be document and click Open.

   The selected document is uploaded and listed in the table displayed below these fields in the Attachments section.

   Tip: If you have uploaded multiple attachments, use the Search field to find the required one.

If the certificate being pushed was enrolled with CSR generation at endpoint, this field is auto populated with the category selected at the time of certificate enrollment.

If the certificate being pushed was enrolled with CSR generation at endpoint, this field is auto populated with the vendor selected at the time of certificate enrollment.

• Push Certificate

  You can only push certificates to the Certificate store or Centralized File System.

• Push and Bind Certificate

  You can push a certificate to the Certificate store and bind it to the IIS site.

• Certificate Store: A repository that stores certificates and their associated keys
• Centralized file system: A file server that stores certificate files

Within the certificate store, select the location where the certificates are stored from the following options:

• Personal store: A location where user-specific certificates, such as those used for encryption and authentication, are stored
• Web hosting store: A location where certificates used for web server configurations are stored

To manage the SSL/TLS certificates for websites, select a bind type from the following options:

• Update Certificate Only: Update the SSL/TLS certificate used by an existing site binding on the web server. It replaces the current certificate with a new one without modifying any other settings associated with the site binding (such as the hostname or port).
• Update Site Binding: Update the SSL/TLS settings for an existing site binding on the web server. It allows you to update not only the certificate but also other settings associated with the site binding, such as the hostname, port, and SSL/TLS protocol settings.
• Create New Site Binding: Create a new site binding on the web server for the specified hostname, port, and IP address (if applicable) and associates it with the specified SSL/TLS certificate. This is typically used when you want to add a new website or domain to the web server and configure SSL/TLS settings for it.

The script to be run before the certificate is pushed is called a pre-push script and the script to be run after the push is called a post-push script.

From the following options, select the location of the script file(s):

• In AppViewX
• In Device

If this option is enabled, the certificate being pushed will overwrite any existing certificates with the same identifier on the target system. This will also ensure that only the latest version of the certificate is available on the target system.

If it is disabled, the push operation will fail in the event of conflicts with the certificates on the target system.