The Security Checkup Results Viewer allows you to view results generated from policy template runs. For more information about reports and policy templates, see Section 4.0, Auditing Your IT Assets. Based on your Secure Configuration Manager console user account permissions, you can remotely audit your enterprise security by reviewing which assets are in compliance, out of compliance, or have an unknown compliance for each policy template. In addition, you can review details from the Data View tab of the Report Viewer.
To ease implementation of Secure Sockets Layer protocol (SSL) on the Web server, the setup program installs a demo security certificate. While the demo certificate provided allows for the configuration of your server, consider upgrading to a certificate provided by a certificate authority or creating a self-signed certificate. For example, both VeriSign and Thawte can provide valid, secure certificates and are considered certificate authorities.
Secure Configuration Manager provides the same demo certificate in every installation kit. Because the certificate is not unique, other people may share the same key and possibly eavesdrop on your encrypted traffic. If you do not want to immediately purchase a security certificate, create a self-signed certificate to eliminate the certificate uniqueness issue.
Whether you plan to install a purchased security certificate or want to permanently implement a self-signed certificate within your environment, you need to create an RSA key pair and a self-signed certificate. Secure Configuration Manager provides the required tools to complete these tasks.
The following procedure guides you through implementing a self-signed security certificate:
Creating a 2048-bit key pair
Creating a self-signed security certificate
Installing a self-signed security certificate
Secure Configuration Manager provides all the tools you need to quickly create both a 2048-bit key pair and your self-signed security certificate, and then install this certificate. After completing this procedure, you will have a unique and secure HTTPS site. You can then decide whether to purchase a certificate from a certificate authority or continue to use your own, self-signed certificate.
To create and install a server certificate key pair and self-signed certificate:
Log on to the Core Services computer with an administrator account.
Use Windows Explorer to open the etc folder. By default, you can locate the etc folder in:
\Program Files\NetIQ\Secure Configuration Manager\Core Services\web\
Delete the keystore.dat file.
Use Windows Explorer to open the bin folder. By default, you can locate the bin folder in:
Program Files\NetIQ\Secure Configuration Manager\Core Services\
Double‑click sslkey.bat.
Enter all requested information in lower case and refrain from using commas.
Copy the self-signed certificate you created to the etc folder. By default, you can locate the etc folder in:
\Program Files\NetIQ\Secure Configuration Manager\Core Services\web\
On the Core Services computer, start the Core Services Configuration Utility in the NetIQ Secure Configuration Manager program folder.
On the Web Services tab, update the key store and key passwords.
Stop and restart the NetIQ Core Services service.
Secure Configuration Manager can also implement a security certificate provided by a certificate authority. To install a purchased security certificate, complete the steps in the following sections.
NOTE:If you want to use VeriSign as your certificate authority, ensure that you request a Secure Site certificate for ApacheSSL. The Secure Site Pro certificate for ApacheSSL is not compatible with Secure Configuration Manager.
Secure Configuration Manager provides tools to create a certificate signing request that you submit to your certificate authority.
To create a certificate signing request:
Ensure that you have created and installed a self-signed security certificate. For more information, see Creating a Self‑Signed Security Certificate.
Log on to the Core Services computer with an administrator account.
Click Start > Run, and then enter cmd.
Use the cd command to navigate to the bin folder. By default, you can locate the bin folder in:
Program Files\NetIQ\Secure Configuration Manager\Core Services\
Enter sslkey request > request.txt.
When your certificate authority asks you to provide your certificate signing request, open the request.txt file and copy the information into the appropriate form. You can often send the entire file to your certificate authority.
Secure Configuration Manager also provides the tools to import the certificate you receive from your certificate authority. Ensure that you have read and understand the information provided by your certificate authority before installing your certificate.
NOTE:You can download an intermediate CA certificate from VeriSign.
To install the certificate provided by your certificate authority:
Log on to the Core Services computer with an administrator account.
Save a copy of your security certificate to the bin folder. If you received an intermediate CA certificate, save a copy of the intermediate CA certificate to the bin folder. By default, you can locate the bin folder in:
Program Files\NetIQ\Secure Configuration Manager\Core Services\
Click Start > Run, and then enter cmd.
(Conditional) If you have purchased a VeriSign security certificate and received both an intermediate CA certificate and your purchased certificate, complete the following procedure:
Use the cd command to navigate to the Secure Configuration Manager Core Services folder. By default, the Core Services folder is:
Program Files\NetIQ\Secure Configuration Manager\Core Services\
Enter the following command:
Jre\bin\keytool -import -trustcacerts -file bin\IntermediateCACertificate.cer -keystore server\conf\keystore.dat -storepass secure
where IntermediateCACertificate.cer is the name of the intermediate CA certificate.
When prompted whether to trust this certificate, enter y.
(Conditional) If you are unsure whether your certificate is encoded using the X.509 format or you receive an unsupported encoding error when attempting to install your certificate, complete the following procedure:
Use Windows Explorer to open the bin folder. By default, you can locate the bin folder in:
Program Files\NetIQ\Secure Configuration Manager\Core Services\
Double-click the certificate you saved in Step 2.
On the Certificate window, select the General tab, and then click Install Certificate.
Complete the Certificate Import wizard. On the Certificate Store window, ensure that you click Place all certificates in the following store, and then use Browse to select the Other People certificate store.
Start Internet Explorer.
Click Tools > Internet Options.
On the Internet Options window, select the Content tab, and then click Certificates.
On the Certificates window, select the Other People tab and then select the certificate you installed in Step 5.b.
Complete the Certificate Export wizard. On the Export File Format window, ensure that you check DER encoded binary X.509 (.CER).
At the command prompt, use the cd command to navigate to the bin folder. By default, you can locate the bin folder in:
Program Files\NetIQ\Secure Configuration Manager\Core Services\
Enter sslkey import < NameOfCertificateFile.cer.
You can use the sslkey tool provided with Secure Configuration Manager to view your security certificate.
To view your security certificate:
Log on to the Web server with an administrator account.
Click Start > Run, and then enter cmd.
At the command prompt, use the cd command to navigate to the bin folder. By default, you can locate the bin folder in:
Program Files\NetIQ\Secure Configuration Manager\Core Services\
Enter sslkey list.
Review the information displayed and ensure that it is correct.
You can launch the Security Checkup Results Viewer from the Secure Configuration Manager console task pane, or from any computer running Internet Explorer. The task pane provides access to common tasks you might want to perform in the Secure Configuration Manager console. For quick and easy access, add the Security Checkup Results Viewer URL to the Favorites list of your browser. To access the Security Checkup Results Viewer, your console user account needs the Access Security Checkup Results Viewer permission. For more information, see Section 3.6, Managing Permissions.
To log in to the Security Checkup Results Viewer remotely:
Start Internet Explorer.
Specify the following URL, where hostcomputer is the name of the Core Services computer:
https:// hostcomputer :8044
The URL specified uses the default port number. You can configure the Security Checkup Results Viewer to use a different port. For more information, see Section 5.7.1, Configuring Web Services.
Specify the name and password of your console user account.
Click Log In.
Secure Configuration Manager console administrators can filter the Security Checkup Results Viewer to display results from only specified policy templates.
To filter results:
From the Security Checkup Results Summary page, click Filtering.
In the Available list, select the policy templates for which you want to see results.
Click the right arrow to move the templates to the Selected list.
Select Show only Templates Listed under Selected.
Click Save and Close.