17.1 Managing Certificate Authority

By default, the Certificate Server installation process creates the Organizational Certificate Authority (CA) for you. You are prompted to specify an Organizational CA name. When you click Finish, the Organizational CA is created with the default parameters and placed in the Security container.If you want more control over the creation of the Organizational CA, you can create the Organizational CA manually by using OpenText Identity Console portal. Also, if you delete the Organizational CA, you need to re-create it.

Using the Certificate Authority Module, you can perform the following tasks:

17.1.1 Creating an Organizational CA Certificates

To create an Organizational CA object, perform the following steps:

  1. Click Certificate Management > CA Management options from the landing page.

  2. If no Organizational Certificate Authority object exists, this opens the Create an Organizational Certificate Authority Object dialog box and the corresponding wizard that creates the object. Follow the prompts to create the object.

    NOTE:Ensure that the CRL file path which is specified here, is in respect with the OpenText eDirectory installation path.

  3. After you have finished creating the Certificate Authority, we recommend that you make a backup of the CA’s public/private key pair and store this in a safe and secure place. For more information, see Backing Up Organizational CA Certificates.

17.1.2 Backing Up Organizational CA Certificates

We recommend you to back up your Organizational CA's private key and certificates in case the Organizational CA's host server has an unrecoverable failure. If a failure occurs, you can use the backup file to restore your Organizational CA to any server in the tree.

NOTE:The ability to back up an Organizational CA is available only for Organizational CAs created with Certificate Server version 9.0 at a minimum. In previous versions of Certificate Server, the Organizational CA's private key was created in a way that made exporting it impossible.

The backup file contains the CA's private key, self-signed certificate, public key certificate, and several other certificates necessary for it to operate. This information is stored in PKCS #12 format (also known as PFX).

The Organizational CA should be backed up when it is working properly.

To back up the Organizational CA, perform the following steps:

  1. Click Certificate Management > CA Management options from the landing page.

  2. Click Certificates tab.

  3. Select either the Self Signed Certificate or the Public Key Certificate. Both certificates are written to the file during the backup operation. We recommend that you select the Self Signed Certificate for RSA and ECDSA certificates separately.

  4. Click the icon.

  5. Choose to export the private key, specify a password with 6 or more alphanumeric characters to use in encrypting the PFX file and select PKCS12 as export format, then click OK.

  6. The encrypted backup file is written to the location specified. It is now ready to be stored in a secure location for emergency use.

17.1.3 Restoring an Organizational CA

If the Organizational CA object is deleted, corrupted, or if the Organizational CA’s host server has suffered an unrecoverable failure, you can restore the Organizational CA using a backup file. To know more about how to backup CA certificates, refer Backing Up Organizational CA Certificates.

To restore the Organizational CA, perform the following steps:

  1. Click Certificate Management > CA Management options from the landing page.

  2. Click the at the top of the screen (next to Certificate Authority Management) to delete the existing Organizational CA.

  3. You will now be prompted to configure a new Organizational CA. This opens the Create an Organizational Certificate Authority Object dialog box and the corresponding wizard that creates the object.

  4. In the creation dialog box, specify the server that should host the Organizational CA and the name of the Organizational CA object.

  5. Select Import.

  6. Select both RSA and ECDSA certificates. The Certificate Server requires that both certificates have the same subject name. However, the Certificate Server does not support importing external self-signed CA certificates. However, it allows you to import subordinate CA certificates.

  7. In the subsequent screens, browse and select the name of the file for RSA and ECDSA.

  8. Enter the password used to encrypt the file when the backup was made and click OK.

  9. The Organizational CA’s private key and certificates have now been restored and the CA is fully functional. The file can now be stored again for future use.

17.1.4 Validating the Organizational CA's Certificates

If you suspect a problem with a certificate or it is no longer valid, you can easily validate the certificate using OpenText Identity Console. Any certificate in the OpenText eDirectory tree can be validated, including certificates issued by external CAs.

The certificate validation process includes several checks of the data in the certificate as well as the data in the certificate chain. A certificate chain is composed of a root CA certificate and, optionally, the certificates of one or more intermediate CAs.

To validate a certificate:

  1. Click Certificate Management > CA Management options from the landing page.

  2. Click Certificates tab.

  3. Select either the Self Signed Certificate or the Public Key Certificate.

  4. Click the to validate the selected CA certificates.

17.1.5 Replacing the Organizational CA’s Certificates

If the certificates become corrupt or invalid for some reason, or if you just want to replace the existing certificates, perform the following steps:

  1. Click Certificate Management > CA Management options from the landing page.

  2. Click Certificates tab.

  3. Select either the Self Signed Certificate or the Public Key Certificate.

  4. Click the to replace the selected CA certificate.

  5. Import a CA certificate in .pfx or .p12 format and specify a password to encrypt the private key.

  6. Click OK.

NOTE:OpenText Identity Console starts alerting you of the CA certificate expiry 60 days prior to the expiry due date. This message gets displayed once you login to OpenText Identity Console.

17.1.6 Revoking the Organizational CA’s Certificates

To revoke a certificate:

  1. Click Certificate Management > CA Management options from the landing page.

  2. Click Certificates tab.

  3. Select either the Self Signed Certificate or the Public Key Certificate.

  4. Click the icon.

  5. Read and understand the risk involved with revoking server certificates.

  6. Select a valid reason for revocation from the drop-down list, select the invalidity date and specify any other comment.

  7. Click OK to finish the revocation.