Automating CLM for Windows Environment

1. Turn on the Renew Automatically toggle.

   The *Start Renewing field is displayed.

2. In the Days Before Expiry field, specify how many days prior to a certificate's expiry the renewal process should start.

   Valid range for number of days: 1 to 120

1. Turn on the Regenerate Automatically toggle.

   The *Start Regenerating field is displayed.

2. In the Days Before Expiry field, specify how many days prior to a certificate's expiry the regeneration process should start.

   Valid range for number of days: 1 to 120

   Note: This value can exceed the certificate's validity in case of short-lived certificates.

1. Turn on the Re-enroll Automatically toggle.

   The *Start Re-enrollng field is displayed.

2. In the Days Before Expiry field, specify how many days prior to a certificate's expiry the regeneration process should start.

   Valid range for number of days: 1 to 120

   Note: This value can exceed the certificate's validity in case of short-lived certificates.

From the dropdown list, select the certificate profile with which the certificate must enroll.

For the details of a workflow, you can check them on your CA portal on IDnomic.

From the dropdown list, select the issuer location associated with the CA account.

From the dropdown list, select the issuer name for issuing the certificate.

Select a template name from the dropdown list.

Template Name is editable. The selected template will be displayed in the Template/Profile column of the Server Certificate Inventory irrespective of the Managed/Monitor status. You can also search and filter certificates based on the template name within the CERT+ Inventory.

An issuance policy defines the rules Futurex must follow to process the certificate enrollment request. The selected issuance policy will determine the approval requirements for the certificate, the cryptographic settings, notification triggeres and other configuration parameters.

This is the trusted root certificate authority that anchors the certificate chain. All issued certificates will ultimately chain up to this root.

From the dropdown list, select the extension profile that will be used for the certificate being enrolled.

To read more on and for instructions to create extension profiles, refer the Futurex documentation. For links, see the References section.

From the dropdown list, select the approval group to authorize this enrollment request.

To read more on and for instructions to create and manage approval groups, refer the Futurex documentation. For links, see the References section.

On saving this form, the name entered here will be displayed in the holistic view.

Enter the description in this field.

From the following options, select the required method for generating the CSR:

• AppViewX: Private key and CSR will be created in AppViewX based on CSR parameters given.
  Note: If auto regeneration has been enabled for this cerificate, AppViewX can be enforced as the default CSR generation source (irrespective of any selections made here) every time the certificate is regenerated. To do this, execute the following db script:

  db.cert_metadata.insertOne({"_id":"CERT_AUTO_REGENERATE_DEFAULT_APPVIEWX_CSR", "flag":true})

• Upload CSR: You can upload a file that contains the CSR details. This source file will be used to populate the CSR parameters, which will then be submitted to the CA.
  1. Under CSR Generation, select Upload CSR.

     The Please paste your CSR field is displayed.

  2. From the Please paste your CSR field, select Browse.
  3. Navigate to the location of your CSR file, and click Open.
  4. Click Upload.

     On successful upload of this file, the CSR fields are populated with the corresponding details.

• HSM:
  Note: This option is disabled/not displayed when Certificate Authority = Google, CSC Global, and DigiCert One.
  To generate the private key and the CSR, based on the CSR parameters given in an HSM device:
  1. Under CSR Generation, select HSM.
  2. To enter the configuration details for CSR generation, refer the field descriptions given here.
• End Point:
  Note: This option is disabled when Certificate Authority = Google and CSC Global.
  To generate the private key and the CSR, based on the CSR parameters given in an endpoint device:
  1. Under CSR Generation, select End Point.
  2. To enter the configuration details for CSR generation, refer the field descriptions given here.

• HSM Devices (AppViewX will directly communicate with the HSM device for the CSR generation.)
• ADC Devices (The selected ADC device will interact with the HSM to generate the CSR and subsequently transmit the relevant details to AppViewX.)

From the dropdown list, select the required ADC device vendor.

In the event that multiple HSMs are configured on a system, module number is a unique identifier assigned to each HSM.

This field is populated based on the Device Type and Vendors selected.

• For Device Type = HSM Devices

  The dropdown list is populated with HSM devices that were enabled for CSR generation at the time of onboarding and have been successfully onboarded. To read more on onboarding HSM devices in AppViewX, click here.

• For Device Type = ADC Devices

  The dropdown list is populated with F5 devices that are in the Managed state.

  Currently, AppViewX enables HSM key generation only through F5 devices for the following HSM vendors and their respective supported versions:

  • Fortanix (v14 and onwards)
  • Thales (v12 and onwards)
  • Safenet (v12 and onwards)

Key handler name refers to an identifier used to reference a cryptographic key managed by an HSM device.

Key reference name refers to an identifier used to reference a private key that is stored locally on an ADC device or is securely accessible to the device via an external HSM.

• ADC
• Cloud
• Server
• WAF
• Firewall

Select the required template from the dropdown list.

From the options in the dropdown list, select the service.

1. Select the CSR Generation radio button as Endpoint.
2. Select Category as Server, Vendor as ABAP or Web Dispatcher The Profiles dropdown is the only other field displayed below it and is populated with a list of .pse file names.
3. Select the required Profile from the dropdown. Based on the values selected, the fields in the CSR Parameters section are auto-populated.

The Replace PSE File checkbox is disabled by default and the SAN details fields in CSR Parameters section are also disabled. Selecting the checkbox will make the SAN details enabled and allow for values to be updated.

The common name is one of the key values of Certificate Signing Request (CSR) to be present in the certificate. For example, <appviewx>.

In the corresponding field(s) displayed for the selection made, enter the required values.

1. From the first dropdown list, select the number of days/months/years.
2. From the second dropdown list, select the unit of the duration from the following values: Days/Months/Year.
   For example, if the validity of the certificate is 2 months:

   1. From the first dropdown list, select 2.
   2. From the second dropdown list, select Months.

1. Click Upload.
2. Navigate to the location of the document to be uploaded.
3. Select the document to be document and click Open.

   The selected document is uploaded and listed in the table displayed below these fields in the Attachments section.

   Tip: If you have uploaded multiple attachments, use the Search field to find the required one.

If the certificate being pushed was enrolled with CSR generation at endpoint, this field is auto populated with the category selected at the time of certificate enrollment.

If the certificate being pushed was enrolled with CSR generation at endpoint, this field is auto populated with the vendor selected at the time of certificate enrollment.

• File System (a storage location on your computer)
• Certificate Store (a specialized location within the operating system for managing digital certificates)

From the dropdown list, select the source of the access credentials.

The private key associated with a certificate is stored in a key file.

Enter the name of the file that contains the private key associated with the certificate to be pushed.

The file extension .key is automatically populated.

Enter the password that will be required to access the .pfx and the .p12 certificate files.

Enter the password required to access the keystore that contains the JKS certificate to be pushed.

Enter the certificate alias assigned in the CSR generated for requesting/enrolling the certificate.

Enter the password required to decrypt the private key associated with the certificate.

This field is displayed only when Push Root and Intermediate Certificates is enabled.

This field is not displayed for the JKS certificate types.

Enter the alias name of the intermediate certificate file.

This field is displayed only when Push Root and Intermediate Certificates is enabled.

Enter the alias name of the root certificate file.

• For AppViewX CSR generation - certificates which have private key, PKCS#12(*.p12) is the supported certificate format.
• For Endpoint CSR generation PKCS#7(*.p7b) is the supported certificate format.

• For PKCS#7(*.p7b) certificate type, the friendly name is the common name of the certificate specified at the time of Endpoint CSR generation. During the push operation the common name is populated in the friendly name field (it is not editable).
• For PKCS#12(*.p12) it is the user specified input.

• POP
• IIS
• SMTP
• IMAP

To restart the IIS service after the certificate is pushed, to ensure all changes have taken effect as required, select this checkbox.

The script to be run before the certificate is pushed is called a pre-push script and the script to be run after the push is called a post-push script.

From the following options, select the location of the script file(s):

• In AppViewX
• In Device

If this option is enabled, the certificate being pushed will overwrite any existing certificates with the same identifier on the target system. This will also ensure that only the latest version of the certificate is available on the target system.

If it is disabled, the push operation will fail in the event of conflicts with the certificates on the target system.