Your suggested change has been received. Thank you.

close

Suggest A Change

https://thales.na.market.dpondemand.io/docs/dpod/services/kmo….

Thales Logo

All

  • All
back

CipherTrust Transparent Encryption (CTE)

How to Change Local CA or External CA for CTE

search

Please Note:

How to Change Local CA or External CA for CTE

How to Change Local CA

The CipherTrust Manager allows you to renew the local CA certificates in the certificate chain when they are about to expire.

When a local CA in the certificate chain expires, the entire certificate chain validation fails.

In such scenarios, the user has to create a new CA and renew the client/server certificates or both using the new CA.

When to Renew

To avoid any service downtime, it is recommended to prepare the new Local CA certificate chain in advance before the CA expiration. During the overlapping period, the new server certificate chain as described in the below section should be downloaded and added to the trust store in the client's setup.

How to Renew on the Web Console UI

The CA certificate chain renewal process contains the following steps:

  1. Create a new local CA using the same attributes as an existing CA.

  2. Renew server certificates issued by the original local CA.

Create a New Local CA Using the Same Attributes as Existing CA

  1. Log on to CipherTrust Manager as a user in the Admins group, such as admin.

  2. Navigate to CA > Local.

  3. In the Local Certificate Authorities table, find the local CA to copy attributes from. Click the corresponding overflow icon (ellipsis) and select Renew.

A CSR with the same attributes as the local CA is present in the Pending CAs table.

Sign the CSR to Make the New Local CA Active

  • Self-sign:

    1. Find the desired CSR in the Pending CAs table.

    2. Click the overflow icon and select Self-sign.

    3. Set a Duration (days). Default is 365.

      Caution

      When a CA expires, all the certificates it has issued also expire. If you use a Local CA for client and server certificates that access CipherTrust Manager, you must replace the certificate chain across multiple interfaces and clients before the Local CA expires to maintain communication. When setting the CA duration, consider how often your organization is prepared to perform this maintenance.

    4. Click Save. The new Local CA appears in the table.

  • Sign with an Existing Local CA:

    1. Find the desired CSR in the Pending CAs table.

    2. Copy or download the CSR.

      1. Click the overflow icon.

      2. Select either of the following:

        • Copy CSR to copy the CSR contents to the clipboard.

        • Download CSR to download the CSR as a file.

    3. In the Local Certificate Authorities table, find the signing CA and click its name.

    4. Click Upload CSR and:

      1. Specify the Display name for the new CA.

      2. In the CSR field, paste CSR text.

      3. Choose CA as Certificate Purpose.

    5. Set the Duration in days before the new CA will expire.

      Caution

      When a CA expires, all the certificates it has issued also expire. If you use a Local CA for client and server certificates that access CipherTrust Manager, you must replace the certificate chain across multiple interfaces and clients before the Local CA expires to maintain communication. When setting the CA duration, consider how often your organization is prepared to perform this maintenance.

    6. Click Issue Certificate.

    7. Copy or download the new CA certificate.

      1. Find the new CA certificate in the Certificates issued by table.

      2. Click the corresponding overflow icon.

      3. Select either Copy to copy the CA certificate contents to the clipboard, or Download to download the CA certificate as a file.

    8. Return to CA > Local, locate the CSR in the Pending CAs table, click the corresponding overflow icon, and select Install.

    9. Choose Local CA as Parent CA Type.

    10. From the Select Local Parent CA drop-down, select the local CA that signed the CA certificate.

    11. Paste certificate text in the Certificate field.

    12. Click Save.

  • Sign with an External CA:

    1. Make sure the external CA is added via CA > External. An external CA must exist on this page. If no external CA exists, add one.

    2. Navigate to CA > Local.

    3. Find the desired CSR in the Pending CAs table.

    4. Copy or download the CSR.

      1. Click the overflow icon.

      2. Select either of the following:

        • Copy CSR to copy the CSR contents to the clipboard.

        • Download CSR to download the CSR as a file.

    5. Sign the CSR externally, then retain the signed certificate.

      Caution

      When a CA expires, all the certificates it has issued also expire. If you use a Local CA for client and server certificates that access CipherTrust Manager, you must replace the certificate chain across multiple interfaces and clients before the Local CA expires to maintain communication. When setting the CA duration, consider how often your organization is prepared to perform this maintenance.

    6. Return to CA > Local, find the CSR in the Pending CAs table, click the corresponding overflow icon, and select Install.

    7. Choose External CA as Parent CA Type.

    8. From the Select External Parent CA drop-down, select the external CA that signed the CA certificate.

    9. Paste certificate text in the Certificate field.

    10. Click Save.

The new local CA is now created and visible in the Local Certificate Authorities table. Note down the CA's name for renewing certificates.

Renew Server Certificate Using New Local CA

  1. Issue a new server certificate from the new CA. See Issuing Certificate Signed by Local CA for details.

  2. Create a certificate chain in PEM or PKCS12 format with the following in the given order:

    1. Server certificate

    2. Intermediate CAs (in hierarchy order). Start with the intermediate CA that issued the server certificate. Next, add the issuer of the intermediate CA, if any. Continue adding any intermediate CAs higher up the hierarchy, each time adding the issuer of the last certificate you uploaded.

    3. Intermediate CAs, ordered from the one that signed the server certificate up to the one signed by the root CA.

    4. Root CA

      Note

      In PEM format, include the server certificate's private key first. In PKCS#12 format, include it last.

  3. Upload the chain on CipherTrust Manager's interface associated with the clients.

    1. Log on to CipherTrust Manager as a user in the Admins group, such as admin.

    2. Go to Admin Settings > Interfaces.

    3. In the table, find the interface associated with the clients.

      • Most clients authenticate to the web interface.

      • NAE clients authenticate to the original nae interface, or additional NAE interfaces created later.

      • KMIP clients authenticate to the original kmip interface, or additional KMIP interfaces created later.

    4. Upload the renewal certificate. See Upload renewal server certificate for details.

      For clients, the uploaded certificate chain is available for download.

  4. Add the downloaded certificate to the client trust store.

    Now, the clients can use this new chain to set up their environment.

  5. (Optional) After the clients have been updated with the new certificate chain, apply the new certificate chain on CipherTrust Manager. This immediately replaces the existing server certificates with the newly generated server certificates.

    If not applied manually, the new certificate chain will auto-apply when the CA expires.

See Renewing Local CA certificate for details.

How to Change External CA

To use an external CA as a trusted entity:

  1. Log on to CipherTrust Manager as a user in the Admins group, such as admin.

  2. Navigate to CA > External.

  3. Click + Add External CA.

  4. Specify a Display Name.

  5. Specify a certificate (upload or paste).

    • Upload: Select File Upload > Upload Certificate to upload the certificate file.

    • Paste: Select Text and paste the certificate content in the text field.

  6. Click Add External CA.

See Adding an External CA for details.

How to Renew the Client Certificates

Renewing the Local CA

Client certificates are automatically renewed starting 60 days before expiration. The agent retries daily until successful.

You can also renew the client certificates manually:

  • Linux: ./vmutil -a vmd renewcerts

  • Windows: vmutil -a vmd renewcerts (vmutil is located at C:\Program Files\Vormetric\DataSecurityExpert\agent\vmd\bin)

Renewing the External CA

Client certificates from an external CA are not automatically renewed. To renew:

  1. Place the new certificate and key files in the designated folder on the client.

  2. Run the following command:

    • Linux: ./vmutil -a vmd updatecerts

    • Windows: vmutil -a vmd updatecerts (C:\Program Files\Vormetric\DataSecurityExpert\agent\vmd\bin)

References

On this page