Certificate Store Operations

To select a single row in the certificate store grid, click to highlight it and then select an operation from either the top of the grid or the right-click menu. The delete, schedule inventory and assign container operations can be done on multiple certificate stores at once. To select multiple rows, click the checkbox for each row on which you would like to perform an operation. Then select an operation from the top of the grid. The selected stores must all be of the same category (e.g. PEMClosed A PEM format certificate file is a base64-encoded certificate. Since it's presented in ASCII, you can open it in any text editor. PEM certificates always begin and end with entries like ---- BEGIN CERTIFICATE---- and ----END CERTIFICATE----. PEM certificates can contain a single certificate or a full certifiate chain and may contain a private key. Usually, extensions of .cer and .crt are certificate files with no private key, .key is a separate private key file, and .pem is both a certificate and private key. or Java) to perform the assign container operation. The right-click menu supports operations on only one store at a time.

Before creating a certificate store in Keyfactor Command, you must approve an orchestratorClosed Keyfactor orchestrators perform a variety of functions, including managing certificate stores and SSH key stores. to handle the store (see Approving or Disapproving Orchestrators).

Tip:  The following permissions (see Security Roles and Claims) are required to use this feature:

Agents > Management > Read
Certificate Stores > Read
Certificate Stores > Modify

Permissions for certificate stores can be set at either the global or certificate store container level. See Container Permissions for more information about global vs container permissions.

Certificate stores can be added manually or, for some types of stores, automatically using a discover process (see Certificate Store Discovery).

Note:  A user with the appropriate permissions may create more than one certificate store in a given location provided the stores are of different categories/types. Stores of the same type should still fail to be saved using the same target.

To define a new certificate store location manually or edit an existing one:

  1. In the Management Portal, browse to Locations > Certificate Stores.
  2. On the Certificate Stores page, select the Certificate Stores tab (the default when you first visit the page).
  3. On the Certificate Stores tab, click Add to create a new store location, or click Edit from either the top or right-click menu to modify an existing one.

  4. In the Certificate Stores dialog, select the type of certificate store in the Category dropdown. The values that appear here are the display names for the built-in certificate store types and any custom certificate store types you entered to match your custom extensions. Examples of Keyfactor-provided custom-built extensions on GitHub include:

    Note:  This field cannot be modified on an edit.

    Figure 237: Add a Remote JKS Certificate Store

  5. In the Container field, select a container into which to place the store for organization from your previously defined list, if desired. This field is optional. If no container matching the type of certificate store you are adding exists, no containers will be available in the dropdown (see Certificate Store Container Operations). Leave blank if you do not wish the certificate store to be associated with a specific store container.

  6. The remaining fields on the dialog will vary depending on the configuration of your custom certificate store type. Common fields include:

    The dialog may present additional fields depending on the configuration of the Custom Fields for the certificate store type. Some additional fields that you may find for common Keyfactor custom-built extensions include:

    • For F5 certificates stores, in the Primary Node field, enter the fully qualified domain name of the F5 device that acts as the primary node in a highly available F5 implementation. If you're using a single F5 device, this will often be the same value you entered in the Client Machine field.

      Tip:  Configuration of the primary node is necessary to allow management jobs that update certificates on the F5 device to wait until the primary node is available before making their update. Inventory jobs are carried out against any available node.
    • For F5 certificates stores, in the Primary Node Check Retry Wait Seconds field, either accept the default value of 120 seconds or enter a new value. This value represents the number of seconds the orchestrator will wait after a pending management job cannot be completed because the primary node cannot be contacted before trying to contact the primary node again to retry the job.
    • For F5 certificates stores, in the Primary Node Check Retry Maximum field, either accept the default value of 3 retry attempts or enter a new value. This value represents the number of times the orchestrator will retry a pending management job that is failing because the primary node cannot be contacted before declaring the job failed.

    • For F5 certificates stores, in the Version of F5 dropdown, select the version of F5 this server is running. The F5 REST API is supported on version 13 and up.

      Tip:  Select v15 for version 15 and above.

    • For IIS bound and Windows certificate stores, in the WinRm Protocol field, select http to communicate between the orchestrator and the target over a non-secured WinRM channel or https to communicate over a secured channel WinRM channel. Using HTTPS for WinRM requires that the target has been configured to support HTTPS and has been configured with an SSL certificate for WinRM. For example:

      https://learn.microsoft.com/en-us/troubleshoot/windows-client/system-management-components/configure-winrm-for-https

    • For IIS bound and Windows certificate stores, in the WinRm Port field, accept the default of port 5986 for HTTPS, enter port 5985 for the default HTTP WinRM port, or enter an alternate port if your WinRM configuration is using an alternate port.

    • For IIS bound and Windows certificate stores, in the SPN with Port field, accept the default of false unless you’re aware that the -IncludePortwithSPN switch is required for remote PowerShell connections in your environment.

    • For Java keystores, PEM stores, and PKCS12 stores on Linux targets when creating a new certificate store (see Create Certificate Store) using the Remote File extension, in the Linux File Permissions on Store Creation field, set the file permissions that should be granted to the new certificate store given in numeric format (e.g. 644). The default is 600.

    • For Java keystores, PEM stores, and PKCS12 stores on Linux targets when creating a new certificate store (see Create Certificate Store) using the Remote File extension, in the Linux File Owner on Store Creation field, set the file ownership that should be granted to the new certificate store given as a Linux username. The default is the user configured to authenticate to the server (see Server Username).

    • For PEM stores, in the Separate Private Key File Location field, enter the full path to the private keyClosed Private keys are used in cryptography (symmetric and asymmetric) to encrypt or sign content. In asymmetric cryptography, they are used together in a key pair with a public key. The private or secret key is retained by the key's creator, making it highly secure. on the machine, including the file name. Paths and filenames entered for Linux/UNIX machines are case sensitive.
    • For PEM stores using the Remote File extension, in the Trust Store field, a value of True indicates the target store is a trust store and as such should only contain public keys. If a store is marked as a trust store and a job is run that attempts to add a private key for a certificate to the store, an error will occur indicating a problem. A value of False indicates the store can contain a single certificate with private key and chain. The default is False.
    • For PEM stores using the Remote File extension, in the Store Includes Chain field, a value of True causes the full chain for the certificate to be delivered to the store. A value of False indicates that only the certificate and private key should be delivered to the store. The certificates are always placed in the store in the order of : End Entity, Issuing CA, Root CA. The default is False. The field is ignored if Trust Store is True.
    • For PEM stores using the Remote File extension, in the Is RSA Private Key field, a value of True indicates the private key for the certificate store is a PKCS#1 RSA formatted key (it will be headed with a line that reads “BEGIN RSA PRIVATE KEY”). A value of False indicates the private key for the certificate store is either an encrypted or non-encrypted PKCS#8 formatted key (it will be headed with a line that reads either “BEGIN PRIVATE KEY” or “BEGIN ENCRYPTED PRIVATE KEY”). If set to True, the Store Password must be set to No Value. The default is False. The field is ignored if Trust Store is True.
  7. In the Inventory Schedule fields, select an inventory schedule for the store, if desired. You can choose to run the inventory Daily, on an Interval, Immediately, Exactly Once, or set inventorying to Off.
    • If you select Daily, you can set the time of day when the inventory should begin every day.
    • If you select Interval, you can select a scan frequency of anywhere from every 1 minute to every 12 hours.
    • If you select Immediate, the inventory will run within a few minutes of saving the record and will run only once. After this, the inventory schedule will be cleared.
    • If you select Exactly Once, you can select a date and time at which to run the inventory job. After the job has run, the inventory schedule will be cleared.
    • Select Off to disable the inventory job.

    If you are using Certificate Store Containers (see Certificate Store Containers) to manage your stores and their schedules you do not need to set an inventory schedule here.

  8. Click Save to save the new or edited certificate store location.
Tip:  The following permissions (see Security Roles and Claims) are required to use this feature:

Certificate Stores > Read
Certificate Stores > Modify

Permissions for certificate stores can be set at either the global or certificate store container level. See Container Permissions for more information about global vs container permissions.

To delete a certificate store:

  1. In the Management Portal, browse to Locations > Certificate Stores.
  2. On the Certificate Stores page, select the Certificate Stores tab (the default when you first visit the page).
  3. On the Certificate Stores tab, highlight the row(s) in the certificate store grid of the store(s) to delete and click Delete at the top of the grid or right-click the store location in the grid and choose Delete from the right-click menu. The right-click menu supports operations on only one store at a time.
  4. On the Confirm Operation alert, click OK to confirm or Cancel to cancel the operation.
Note:  This doesn't delete the actual certificate store on the target server, just the Keyfactor Command definition of it.

Users without modify permissions to certificate stores will see a View option instead of an Edit option on the Certificate Stores page to allow them to see a read-only view of the certificate store configuration details.

Tip:  The following permissions (see Security Roles and Claims) are required to use this feature:

Agents > Management > Read
Certificate Stores > Read

Permissions for certificate stores can be set at either the global or certificate store container level. See Container Permissions for more information about global vs container permissions.

To view the details of a certificate store:

  1. In the Management Portal, browse to Locations > Certificate Stores.
  2. On the Certificate Stores page, select the Certificate Stores tab (the default when you first visit the page).
  3. On the Certificate Stores tab, highlight the row in the certificate store grid of the store for which to view certificate store details and click View at the top of the grid or right-click the store location in the grid and choose View from the right-click menu.

The fields are the same as those described for adding or editing a certificate store (see Adding or Modifying a Certificate Store), but none of the fields are editable when using the View option.

Figure 239: View Details for a Certificate Store

The Reenrollment option is available for select built-in and custom-built extensions provided by Keyfactor on GitHub or can be included in your fully custom extension. Examples of built-in and Keyfactor custom-built extensions that support reenrollment include:

Tip:  The following permissions (see Security Roles and Claims) are required to use this feature:

Certificates > Enrollment > CSR
Certificate Stores > Read
Certificate Stores > Modify

Permissions for certificate stores can be set at either the global or certificate store container level. See Container Permissions for more information about global vs container permissions.

In addition, either the user scheduling the reenrollment job or the user configured to provide authentication to the CA (see Authorization Methods Tab) must have enrollmentClosed Certificate enrollment refers to the process by which a user requests a digital certificate. The user must submit the request to a certificate authority (CA). permissions configured on the CA and templateClosed A certificate template defines the policies and rules that a CA uses when a request for a certificate is received..

To begin a reenrollment:

  1. In the Management Portal, browse to Locations > Certificate Stores.
  2. On the Certificate Stores page, select the Certificate Stores tab (the default when you first visit the page).
  3. On the Certificate Stores tab, highlight the row in the certificate store grid of the store to reenroll and click Reenrollment at the top of the grid or right-click the store location in the grid and choose Reenrollment from the right-click menu.
  4. On the Reenrollment dialog, enter a Subject Name for the new certificate using X.500 format and populate any additional fields as required by the certificate store type (on the Entry Parameters tab; see Adding or Editing a Certificate Store Type).

  5. If desired, select a Certificate Authority to direct the enrollment request to and/or Template for the request. In the Template dropdown, only templates that are available for enrollment from the selected certificate authorityClosed A certificate authority (CA) is an entity that issues digital certificates. Within Keyfactor Command, a CA may be a Microsoft CA or a Keyfactor gateway to a cloud-based or remote CA. will appear.

    Note:  If you don't select a template or CA for reenrollment, the values configured for the Template For Submitted CSRs and/or Certificate Authority For Submitted CSRs application setting(s) (see Application Settings: Agents Tab) will be used.
    Tip:  If an expected template does not appear in the Template dropdown, confirm that it is available for enrollment from the selected CA, has been configured for CSRClosed A CSR or certificate signing request is a block of encoded text that is submitted to a CA when enrolling for a certificate. When you generate a CSR within Keyfactor Command, the matching private key for it is stored in Keyfactor Command in encrypted format and will be married with the certificate once returned from the CA. enrollment in Keyfactor Command, and has appropriate enrollment permissions at the Keyfactor Command, CA and template level for the user making the reenrollment request or relevant service account depending on the authorization method for enrollment (see Grant the Keyfactor Command Users and Service Account(s) Permissions on the CAs in the Keyfactor Command Server Installation Guide).
  6. Click Done to submit the request.

The reenrollment job will be scheduled to run immediately. Visit the Orchestrator Jobs page to check on the progress of the job (see Orchestrator Job Status).

Figure 240: Enter a Information for Reenrollment

The option to reset the password on a certificate store updates the data for the certificate store as stored in the Keyfactor Command database but does not make any modifications to the certificate store itself. This option is available from the right-click menu only.

Tip:  The following permissions (see Security Roles and Claims) are required to use this feature:

Certificate Stores > Read
Certificate Stores > Modify

Permissions for certificate stores can be set at either the global or certificate store container level. See Container Permissions for more information about global vs container permissions.

To reset the password for a certificate store:

  1. In the Management Portal, browse to Locations > Certificate Stores.
  2. On the Certificate Stores page, select the Certificate Stores tab (the default when you first visit the page).
  3. On the Certificate Stores tab, highlight the row in the certificate store grid of the store to update and choose Set New Password from the right-click menu.
  4. Enter and confirm the new password and click Save.

Before assigning a certificate store to a container, you need to create the container (see Certificate Store Containers). If you select multiple certificate stores to assign to a container at once, they must all be stores of the same type (e.g. PEM).

Tip:  The following permissions (see Security Roles and Claims) are required to use this feature:

Certificate Stores > Read
Certificate Stores > Modify

Permissions for certificate stores can be set at either the global or certificate store container level. See Container Permissions for more information about global vs container permissions.

To assign a certificate store to a container:

  1. In the Management Portal, browse to Locations > Certificate Stores.
  2. On the Certificate Stores page, select the Certificate Stores tab (the default when you first visit the page).
  3. On the Certificate Stores tab, highlight the row(s) in the certificate store grid of the store(s) to be assigned to the container and click Assign Container at the top of the grid or right-click the store location in the grid and choose Assign Container from the right-click menu. The right-click menu supports operations on only one store at a time.
  4. Select a certificate store container in the Container Name field and click Save.

Once at least one inventory job has been completed for a given certificate store, you can view the certificates imported from the store.

Tip:  The following permissions (see Security Roles and Claims) are required to use this feature:

PAM > Read
Certificate Stores > Read
Certificate > Collections > Read

Permissions for certificate stores can be set at either the global or certificate store container level. See Container Permissions for more information about global vs container permissions.

To view the inventoried certificates for a store:

  1. In the Management Portal, browse to Locations > Certificate Stores.
  2. On the Certificate Stores page, select the Certificate Stores tab (the default when you first visit the page).
  3. On the Certificate Stores tab, highlight the row in the certificate store grid of the store for which to view inventory and click View Inventory at the top of the grid or right-click the store location in the grid and choose View Inventory from the right-click menu.

On the left of the inventory viewing dialog you can select a certificate from the store to view. On the right of the dialog you can see details about that certificate, including the metadataClosed Metadata provides information about a piece of data. It is used to summarize basic information about data, which can make working with the data easier. In the context of Keyfactor Command, the certificate metadata feature allows you to create custom metadata fields that allow you to tag certificates with tracking information about certificates. associated with the certificate. In the Certificate Selection area of the screen, you can select between the chain certificates for the selected certificate and the end entity certificate, for certificates stored with a chain.

At the bottom of the inventory viewing dialog, click Query Certificate, after selecting the certificate to view, to open a new browser tab to the certificate search page with the search criteria specifying only the certificate you selected. The Revoked and Expired check boxes will automatically be included if either condition is true for that certificate.

Figure 241: View Inventoried Certificates for a Certificate Store

Scheduling inventory for a certificate store allows Keyfactor Command to inspect the certificates inside a given store and add them to the Keyfactor Command database.

Tip:  The following permissions (see Security Roles and Claims) are required to use this feature:

Certificate Stores > Read
Certificate Stores > Schedule

Permissions for certificate stores can be set at either the global or certificate store container level. See Container Permissions for more information about global vs container permissions.

To schedule inventory:

  1. In the Management Portal, browse to Locations > Certificate Stores.
  2. On the Certificate Stores page, select the Certificate Stores tab (the default when you first visit the page).
  3. On the Certificate Stores tab, highlight the row(s) in the certificate store grid of the store(s) for which you want to schedule inventory and click Schedule Inventory at the top of the grid, or choose Schedule Inventory from the right-click menu. The right-click menu supports operations on only one store at a time.
  4. In the Certificate Store Inventory Schedule dialog, select a schedule for the store(s). You can choose to run the inventory Daily, on an Interval, Immediately, Exactly Once, or set inventorying to Off.
    • If you select Daily, you can set the time of day when the inventory should begin every day.
    • If you select Interval, you can select a scan frequency of anywhere from every 1 minute to every 12 hours.
    • If you select Immediate, the inventory will run within a few minutes of saving the record and will run only once. After this, the inventory schedule will be cleared.
    • If you select Exactly Once, you can select a date and time at which to run the inventory job. After the job has run, the inventory schedule will be cleared.
    • Select Off to disable the inventory job.

You have the option to not schedule inventory on a store-by-store basis and instead create containers and set inventory schedules that will apply to all the stores added to each container. See Certificate Store Containers for information on creating containers.

Figure 242: Schedule Inventory for a Certificate Store Location

The Query Certificate Store option allows you to open a new browser tab with an instance of the Management Portal open to the certificate search page pre-populated with search criteria to locate the certificates found in that certificate store.

Tip:  The following permissions (see Security Roles and Claims) are required to use this feature:

Certificate Stores > Modify
Certificate Stores > Read

Permissions for certificates and certificate stores can be set at either the global or certificate collectionClosed The certificate search function allows you to query the Keyfactor Command database for certificates from any available source based on any criteria of the certificates and save the results as a collection that will be availble in other places in the Management Portal (e.g. expiration alerts and certain reports). and certificate store container level. You can use a mixture with, for example, global certificate permissions and container-level certificate store permissions. See Certificate Collection Permissions and Container Permissions for more information about global vs collection and container permissions.

To use the query certificate store option:

  1. In the Management Portal, browse to Locations > Certificate Stores.
  2. On the Certificate Stores page, select the Certificate Stores tab (the default when you first visit the page).
  3. On the Certificate Stores tab, highlight the row in the certificate store grid of the store for which you want to query certificates and click Query Certificate Store at the top of the grid, or choose Query Certificate Store from the right-click menu.