Configuring AppViewX EST Client

This task must be completed on each machine where the EST client installation is required, while the generation of the installer is a one-time process carried out by the admin.

Only if the override_user flag is set to true when generating the EST agent can you modify the certificate section in the config.json file located within the appviewx_est_client_installer > input folder.

To install EST client:

This task must be completed on each machine where the EST client installation is required, while the generation of the installer is a one-time process carried out by the admin.

Only if the override_user flag is set to true when generating the EST agent can you modify the certificate section in the config.json file located within the appviewx_est_client_installer > input folder.

• To perform auto-enrollment or re-enrollment, run:

  appviewx_client est auto 

  This enrolls certificates based on the secure_config and the config files.
• If certificates are already enrolled, then the validity of the certificates are checked against the reenrollment_trigger_before_no_of_days_of_expiry value present in the configuration files. If the certificate's expiry in number of days from today is less than reenrollment_trigger_before_no_of_days_of_expiry value, then re-enrollment will be triggered. Example: If the reenrollment_trigger_before_no_of_days_of_expiry value is 30 and if the certificate is going to expire in the next 20 days, then the re-enrollment will be triggered.

• Manual enrollment and re-enrollment do not come under any certificate type mentioned in the configuration files.
• Manual enrollment is accessed through the following command:
  Example 1:

  appviewx_client est manual-enrollment csr-mode --csr-file <csr-file-complete-path> --est-server-url <est-server-url>

  Example 2:

  appviewx_client est manual-enrollment csr-mode --csr-file <csr-file-complete-path> --est-server-hostname <est-server-hostname> --est-server-pathseg <est-server-pathsegment/agent name>

  The description for every parameter is given in the following table:

  Flags	Input Type	Description
  --csr-file	string	Input CSR filename. For example: /home/user/test.csr
  --est-server-hostname	string	EST server hostname
  --est-server-pathseg	string	EST server name present in the EST server setting (default value: defaultEST)
  --est-server-port	int	EST server port number configured in the EST server settings (default value: 30021)
  --est-server-url	string	EST server URL present in the EST server setting page. (Not required if the hostname, port, and agent name are given.)

• Manual re-enrollment is triggered using two modes:
  • csr-mode

    Ensure that the certificate corresponding to the CSR sent is present in the inventory before triggering re-enrollment.

    Example 1:

    appviewx_client est manual-reenrollment csr-mode --csr-file <csr-file-complete-path> --est-server-url <est-server-url>

    Example 2:

    appviewx_client est manual-reenrollment csr-mode --csr-file <csr-file-complete-path> --est-server-hostname <est-server-hostname> --est-server-pathseg <est-server-pathsegment/agent name>

    Note: See the table in the manual-enrollment, for the description of these parameters.
  • cert-mode

    Similar to the manual re-enrollment using csr-mode, the certificates must be enrolled and must be present in the inventory before triggering re-enrollment.

    Example:

    appviewx_client est manual-reenrollment cert-mode --cert-file <cert-file-complete-path> --cert-file-type <cert-file/extension-type> --est-server-hostname <est-server-hostname> --est-server-pathseg <est-server-pathsegment/agent name> --output-privatekey-file <path-to-store-private-key> --key-size <Key-length>

    Descriptions for the flags/parameters for the manual cert-mode are as follows:

    Table 6. Flags and their description

    Flags	Input Type	Description
    --cert-file	string	Input Certificate filename. For example: /home/user/test.crt
    --cert-file-type	string	Input Certificate file types ( cer, crt, pem, p7b )
    --key-size	int	Key size of the generated private key. If not given, the key size is taken from the old certificate.
    --output-privatekey-file	string	Output private key filename. Example: /home/user/output/hostname.key
    --est-server-hostname	string	EST server hostname
    --est-server-pathseg	string	EST server name present in the server setting (default value: defaultEST)
    --est-server-port	int	EST server port number configured in the EST server settings(default value: 30021)
    --est-server-url	string	EST server URL present in the EST server setting page. (Not required if hostname, port, and agent name are given )

• To view the list of certificates created, run:

  appviewx_client keystore list

  
• To download the certificates based on id specified when using the list command above, run:

  appviewx_client keystore download --id <id> --filepath <path to store the cert with file name and extension>

  Note: To download PFX file, provide the password with --password field

• To access Machine Certificate Type, go to Start > Manage Computer Certificates.
• To access User and Others Certificate Type, go to Start > Manage User Certificates.
• To view the certificates, go to Personal > Certificates.

1. Check whether the IP address and the port number are correctly configured in the secure_config.json file located in the AppViewX_EST_Windows_Client > Generator > Input folder.
2. Verify if the firewall policies permit the connection between the EST client and the server.

1. Ensure the client sends the authentication certificate (try enrollment request from curl using the same client certificates).
2. Check the trusted CA added in the EST agent settings to validate whether the client authentication certificate is signed by the same CA.
3. If the client authentication certificate is signed by a CA other than AppViewX, make sure it is added in the trusted CA list from the CLI.
4. Do a TCP dump and analyze the TLS transactions between server and client to make sure the client receives the Distinguished Name of the Trusted CA.
5. In the TCP dump, make sure the client sends the Authentication Certificate in the Certificate Response field.

1. Make sure EST service is running on the AppViewX server.
2. Check the EST server status. (Refer section: Verify EST Server Status (Enabled/Disabled).)
3. Check the EST enrollment using curl. (Refer section: Testing EST Enrollment by using CURL.)

• Custom PowerShell scripts can be added to the AppViewX_Installer/Resources folder before installing the EST Client. After installation, all files from this package are copied to the C:\appviewx_est folder.
• After certificate enrollment, the specified PowerShell scripts are automatically executed to bind the enrolled certificate to the service defined within each script.
• The certificate_type can be machine, user, or others. Based on the certificate_type, the corresponding enrolled certificate is used to bind to the appropriate Remote Desktop (RD) service.
• Multiple scripts can be configured to run for a single certificate type.
• To enable post-enrollment script execution, add a post_certificate_creation section to the config.json file located in C:\appviewx_est. This ensures the designated PowerShell scripts run immediately after certificate creation.

  "post_certificate_creation": [
  {
  "certificate_type": "machine",
  "script_path": "C:\\appviewx_est\\RDSCertBindWithRestart.ps1",
  "script_type": "powershell"
  },
  {
  "certificate_type": "machine",
  "script_path": "C:\\appviewx_est\\UploadCAChain.ps1",
  "script_type": "powershell"
  }
  ]

  Note:

  • The EST Linux Client automatically downloads the certificate and key to the appviewx_est/Certificates folder and provides these paths as input parameters. Scripts can use these paths to bind the certificates to Apache or other services.
  • When the post_certificate_creation option is used to execute a script, the parameters newCertThumbprint and newCertSerialNumber can be provided as input arguments to the script. (Applicable to both Windows and Linux).
  Attention: Limitations - Installation and enrollment of the EST Linux Client must be performed using the root user, as certificate binding requires root privileges.
• The following powershell scripts have been validated from AppViewX:
  • Certificate binding to RD Services
  • Uploading enrolled certificate’ intermediate and root to the client machine's trust store.

• Automated Machine Scheduler: The Machine scheduler in the EST Windows Client now triggers automatically one minute after installation and subsequently every 12 hours, without requiring a machine logout or login. Refer the script triggerJobSystem.ps1.
• Windows 11 24H2 Compatibility: Issues related to deprecated WMIC commands in Windows 11 24H2 have been resolved by removing all instances where these commands were used.
• Certificate Re-enrollment Logic: If an enrolled certificate is removed from the Windows Keystore, the EST Client will now enroll the certificate during its next execution.

• Windows 10
• Windows 11 23H2
• Windows 11 24H2
• Windows Server 2019 and 2022