Agent requires To manage agents, create the following certificates to operate properly:
- Axidian CertiFlow CM Agent CA is – a root root certificate used required to issue certificates for to user workstations where Agents will be are deployed.
- Axidian CertiFlow Agent SSL is CM Agent SSL – an authentication certificate signed by root certificate. Agent SSL This certificate is required to establish a two-way secure connection between the CertiFlow server and a the workstation with where Agent installedis deployed.
- Workstation certificate – a certificate, which is issued automatically upon Agent registration. When sending a request to the server, the client workstation provides its certificate and the CertiFlow server verifies if the certificate is authentic. Then the server marks this Agent as trusted and is ready to assign tasks.
Agent certificates are created with IndeedCM.Agent.Cert.Generator.exe utility from the Axidian CertiFlow installation package.
- when a client agent is registered. To be able to assign tasks to a workstation, the CertiFlow server verifies the authenticity of a workstation certificate. Once the certificate is verified, the server adds this workstation to the trusted list.
To create agent certificates:
- Run the CmRun the IndeedCM.Agent.Cert.Generator.exe from the command line utility on the Axidian CertiFlow server. Use
- Generate root and SSL certificates with the following parameters:
/
root /csn /installToStore.root – generates a root certificate.
/rootKeySize (optional) – sets a private key length for root certificate. Default value is 4096 bits, other supported values are from 512 to 8192 bits.
/sn <DNS server name> – generates an SSL certificate for the specified DNS server name.
/csn – generates an SSL certificate for the server where the utility is running.
/sslKeySize (optional) – sets a private key length for an SSL certificate. Default value is 2048 bits by default, other supported values are from 512 to 4096 bits.
/pwd (optional)– sets a password for an SSL certificate.
/installToStore (optional)–publishes issued certificates to the server's certificate storages:
The /installToStore publishes the certificates issued by the utility to the server certificate storage:
Axidian CertiFlow- CM Agent CA certificate is
- published to Trusted Root Certification Authorities.
- CM Agent SSL certificate is
- published to the Personal certificates storage of the workstation
- where Axidian CertiFlow server
2. Axidian CertiFlow Agent CA.key file will appear in the utility folder. The file contains the Axidian CertiFlow Agent CA certificate image and certificate key value.
3. Place the Axidian CertiFlow Agent CA certificate to Trusted Root Certification Authorities on all user workstations.
| Scroll Pagebreak |
|---|
| Info |
|---|
You can use the Active Directory Group Policy engine to distribute the certificate to user workstations. |
4. Set up a secure connection to Agent site:
- Switch to IIS Manager.
- Select Axidian CertiFlow Agent Site, go to Bindings.
- Select binding to 3003 port and click Edit.
| Warning |
|---|
3003 port is set by default. If you use another port, you will need to create and configure a new binding for it. Make sure that the port is open for incoming connections in firewall. |
- Define Axidian CertiFlow Agent SSL as SSL certificate and click OK.
- is deployed.
You can also generate an SSL certificate via existing root certificate. Use the following parameters:
/rootKey – sets the path to the root certificate file.
/ssl – generates an SSL certificate.
/sn <DNS server name> – generates an SSL certificate for the specified DNS server name.
/csn – generates an SSL certificate for the server where the utility is running.
/pwd (optional) – sets a password for SSL certificate.
/sslKeySize (optional) – sets a private key length for SSL certificate. Default value is 2048 bits, other supported values are from 512 to 4096 bits.
/installToStore (optional) – publishes issued SSL certificates to the Personal certificates storage of the workstation where Axidian CertiFlow server is deployed.
| Code Block | ||||
|---|---|---|---|---|
| ||||
Cm.Agent.Cert.Generator.exe /root /csn /installToStore |
The following files should appear in the utility directory:
- agent_root_ca.json – root certificate with private key in JSON format.
- agent_root_ca.cer – agent root certificate.
- agent_root_ca.key – private key of agent root certificate.
- agent_ssl_cert.cer – agent SSL certificate.
- agent_ssl_cert.key – private key of agent SSL certificate.
- agent_ssl_cert.pfx – SSL certificate with private key in PFX format.
If you have multiple Axidian CertiFlow servers with Agents, each server must have a specific SSL certificate. To issue an SSL certificate, use the CM Agent CA root certificate. Root certificate must be the same for all servers.
To create an SSL certificate for
additional server, copy the folder withanother server or to renew an expired certificate:
- Transfer the directory with Cm
- .Agent.Cert.Generator
- utility and
- the agent_root_ca.json file to the server.
- Run the following command:
| Code Block | ||
|---|---|---|
| ||
CmIndeedCM.Agent.Cert.Generator.exe /ssl /csn /rootKey <path to folder containing root certificate key>agent_root_ca.json file> /ssl /sn <DNS server name Axidian CertiFlow> /installToStore | ||
| Code Block | ||
|
Configuring secure connection to the agent services site
- Open the IIS Manager, select Axidian CertiFlow Agent Site and go to Bindings...
- Select binding to 3003 port and click Edit...
- Define CM Agent SSL as SSL certificate and click OK.
| Note |
|---|
3003 port is set by default. If you use another port, create and configure a new binding for this port. The port must be open to incoming connections in the firewall. SSL/TLS certificate can be an RSA certificate issued by any trusted CA for Axidian CertiFlow server:
|