Certificate Store Type Operations

To create or modify a certificate store type:

1. In the Management Portal, browse to System Settings Icon > Certificate Store Types.
2. On the Certificate Store Types page, click Add to create a new certificate store type, or click Edit from either the top or right-click menu to modify an existing one.

3. In the Certificate Store Types dialog, you will see four tabs. Complete the dialog with appropriate information using the following information:

   Basic Tab

   

   Figure 402: Add New Certificate Store Type: Basic Tab

   • Name: Enter a user friendly recognizable name for the certificate store type.
   • Short Name: Enter a short name identifier for the certificate store type. This value is used by the Keyfactor Universal Orchestrator The Keyfactor Universal Orchestrator, one of Keyfactor's suite of orchestrators, is used to interact with servers and devices for certificate management, run SSL discovery and management tasks, and manage synchronization of certificate authorities in remote forests. With the addition of custom extensions, it can provide certificate management capabilities on a variety of platforms and devices (e.g. Amazon Web Services (AWS) resources, Citrix\NetScaler devices, F5 devices, IIS stores, JKS keystores, PEM stores, and PKCS#12 stores) and execute tasks outside the standard list of certificate management functions. It runs on either Windows or Linux servers or Linux containers. installation and configuration tools to validate the orchestrator capabilities.
   • Custom Capability: If desired, check this box to allow you to define a custom capability name. By default, the Short Name is used as the capability name, and in most cases a separate capability name is not needed. The capability name you set here corresponds to configurations made in the manifest.json file for your custom orchestrator extension.
     Tip:  This box shows as checked only if the value entered in the Custom Capability does not match the value entered in the Short Name. If you check the box, enter a value that matches the short name value, save the record and open it again, the box will show unchecked and the Custom Capability field will show empty since the value matches the Short Name value.
     Note:  The Custom Capability cannot be changed on an edit if an orchestrator has registered with Keyfactor Command, been approved, and included the certificate store type in its capability list. If you change the Short Name in this circumstance, the Custom Capability box will be checked and the value set to the original value of the Short Name.
   • Supported Job Types

     Select the job capabilities required to support the store type.

     • Inventory: Determine what is in the certificate store(s) and report the contents to Keyfactor Command. This capability is required for all store types.
     • Add: Add new certificates to a certificate store.
     • Remove: Remove certificates from a certificate store.
     • Create: Create a new certificate store.
     • Discovery: Determine what certificate stores of this type are on the device.
     • Reenrollment: Generate a keypair on the device and submit a certificate signing request A CSR or certificate signing request is a block of encoded text that is submitted to a CA when enrolling for a certificate. When you generate a CSR within Keyfactor Command, the matching private key for it is stored in Keyfactor Command in encrypted format and will be married with the certificate once returned from the CA. using on-device key generation (ODKG).
   • General Settings
     • Needs Server: Select if server access is required for adding certificate stores to the certificate store type. If selected, a user will be prompted for a username and password to connect to the remote server.
     • Blueprint Allowed: Select whether certificate stores of this type will be included when creating or applying blueprints. For more details, see Generating and Applying Blueprints.
     • Uses PowerShell: Select if the jobs for this store type are implemented by PowerShell instead of a .NET class.
   • Password Settings
     • Requires Store Password: Select to mandate that a password be entered and authenticated when creating stores of this type. This password secures the store as a whole.
     • Supports Entry Password: Select to allow an entry password to be entered and authenticated when adding a certificate to a store. This password secures a single certificate within the store.
   Advanced Tab

   

   Figure 403: Add New Certificate Store Type: Advanced Tab

   • Store Path Type:
     • Freeform: Select if users are required to enter a path defining the store location.
     • Fixed: Select if a store path does not apply, generally one store per device (e.g. IIS).
     • Multiple Choice: Select to allow users to select an option during certificate store creation.

     If Store Path Type is Fixed or Multiple Choice, a value should be provided in the value field. For multiple choice, this should be a comma separated list of values that users will be able to select from when defining a certificate store location.

   • Other Settings
     • Supports Custom Alias:
       • Forbidden: Select if a custom alias should not be allowed to be associated with a certificate in a certificate store. A default alias will be assigned, which will vary depending on the type of store. In many cases, the alias is the thumbprint of the certificate. In some cases, it’s the file name of the certificate file or other reference ID.
         Note:  If this is set to Forbidden, the Alias field will not display on the Add to Certificate Store page unless Overwrite is checked on the page. When Overwrite is selected, the alias you enter is the alias of the certificate you are replacing—so you can identify which certificate to replace—not an alias to associate with the certificate you’re adding to the store.
       • Optional: Select if a custom alias is optional and can be associated with the certificate in the certificate store if desired.
       • Required: Select if a custom alias will be required when a certificate is added to a certificate store.
     • Private Key Handling:
       • Forbidden: Select if a private key Private keys are used in cryptography (symmetric and asymmetric) to encrypt or sign content. In asymmetric cryptography, they are used together in a key pair with a public key. The private or secret key is retained by the key's creator, making it highly secure. is not required; generally, applies to trust stores (e.g. Root CA A certificate authority (CA) is an entity that issues digital certificates. Within Keyfactor Command, a CA may be a Microsoft CA or a Keyfactor gateway to a cloud-based or remote CA. certificates).
       • Optional: Select if the private key is optional; applies to store types that could represent either a Trust Store or End-Entity Store.
       • Required: Select if the private key is required; applies to stores that hold an End-Entity Certificate (server or client authorization).
     • PFX Password Style:
       • Default: Opt to have Keyfactor Command randomly generate a password.
       • Custom: Opt to allow a password to be entered and authenticated when enrolling a certificate through the Keyfactor Command Management Portal when installing a store of this type. The Custom option can be selected only if Allow Custom Password in the Application Settings is equal to True. For more details, see Application Settings: Enrollment Tab.
   Custom Fields Tab

   Custom fields define unique properties for the given certificate store type. Click Add on this tab to open the Add Custom Field dialog box.

   

   Figure 404: Add New Certificate Store Type: Custom Fields Tab

   • Name: Enter the name submitted to the orchestrator and referenced in the extension module custom code.
   • Display Name: Enter a user-friendly recognizable name.

   • Type: Select whether parameter A parameter or argument is a value that is passed into a function in an application. information is stored as a string, Boolean, multiple choice or secret.

     Note:  This field cannot be modified on an edit.
   • Default Value / Multiple Choice Options: Add a default value that will pre-populate the parameter field in the Add New Certificate Store dialog box. If you select a type of Multiple Choice, populate this field with a comma-separated list of multiple choice options for this parameter. If you select a type of Boolean, you will be given the option of True or False here.
   • Depends On: Check this box if you have another custom field for this certificate store type and want to create a relationship between that one and this one. Then select the custom field on which this custom field depends in the dropdown. This option configures one custom field to display in the certificate store configuration dialog only if another custom field contains a value.
   • Required: Select whether a value for this parameter must be entered before a certificate store can be added to Keyfactor Command.
   Entry Parameters Tab

   Entry parameters define unique properties that are required when performing management jobs on a certificate store of this type. Click Add on this tab to open the Add Entry Parameter dialog box.

   Tip:  What's the difference between custom fields and entry parameters?

   • Custom fields are about the certificate store definition itself and are static. For example, you might use a custom field to define the primary node name of an F5 instance. This node name is the same no matter what inventory or management jobs you do with the F5 device(s). Values for custom fields are entered in the certificate store record when creating or editing the certificate store record.
   • Entry parameters are about the specific certificate within the certificate store. They are used to send additional information related to the certificate to the server or device that hosts the certificate store when running management jobs for that certificate store. Often this is more fluid information that isn't the same for every use of that certificate store. For example, several virtual servers with separate certificates in the same folder may exist on a NetScaler device. When replacing one certificate, updates may need to be made to only the virtual server that is using the certificate. In this case, the authorized user will be prompted to enter the virtual server name based on an entry parameter. Values for entry parameters are entered at the time a management job is initiated (e.g. adding a certificate to a certificate store).

   

   Figure 405: Add New Certificate Store Type: Entry Parameters Tab

   • Name: Enter the name for the entry parameter. This value must be unique.
   • Display Name: Enter a user-friendly recognizable name. This value must be unique.

   • Type: Select whether parameter information is stored as a string, Boolean, multiple choice or secret.

     Note:  This field cannot be modified on an edit.
   • Default Value: Add a default value that will pre-populate the parameter field in the Add New Certificate Store dialog box. If you select a type of Boolean, you will be given the option of True, False, or Not Set here.
   • Multiple Choice Options: Populate this field with a comma-separated list of multiple choice options if you selected a Type of multiple choice. This field will be grayed out if you selected a Type other than multiple choice.
   • Depends On: Check this box if you have another entry parameter for this certificate store type and want to create a relationship between that one and this one. Then select the entry parameter on which this entry parameter depends in the dropdown. This option configures one entry parameter to display in the certificate store configuration dialog only if another entry parameter contains a value.
   • Required When:
     • Entry has a private key: If set to true, a value must be provided for this field when configuring a management job (either add or remove) if the certificate has an associated private key in Keyfactor Command. This would be the case, for example, when doing a PFX A PFX file (personal information exchange format), also known as a PKCS#12 archive, is a single, password-protected certificate archive that contains both the public and matching private key and, optionally, the certificate chain. It is a common format for Windows servers. enrollment and adding the resulting certificate to a certificate store.
     • Adding an entry: If set to true, a value must be provided for this field when configuring an add certificate job.
     • Removing an entry: If set to true, a value must be provided for this field when configuring a remove certificate job.
     • Reenrolling an entry: If set to true, a value must be provided for this field when configuring a reenrollment job.
4. Click Save to save the new certificate store type.
Note:  Built-in certificate store types cannot be edited.

You may delete one store type at a time.

To delete a certificate store type:

1. In the Management Portal, browse to System Settings Icon > Certificate Store Types.
2. On the Certificate Store Types page, highlight the row in the grid of the certificate store type to delete and click Delete at the top of the grid or right-click the type in the grid and choose Delete from the right-click menu.
3. On the Confirm Operation alert, click OK to confirm or Cancel to cancel the operation.