Skip to main content

Change the Connection Certificate and Use Your Own Certificates

Marcus Bohn
Updated

Goal

You replace the connection certificate of the Password Secure Application Server, for example when moving from setup to production. The self-signed certificate issued by Password Secure is intended for setup only. In production, replace it with a certificate from your own CA.

Prerequisites

  • Access to the login window of the Server Manager.
  • If you use a certificate from your local CA, it must meet these requirements:
    • Hostname of the server in the certificate (mandatory): The certificate must contain the hostname used to reach the server as a DNS entry in the SAN. If it is missing, the automatic detection of the certification mode fails, and logging in to the Server Manager is not possible.
    • DNS names only, no IP addresses: Do not include IP addresses in the certificate. Modern web browsers increasingly reject certificates with IP addresses. IP addresses can also change, for example through DHCP, load balancers, or network reconfiguration. Certificates validate hostnames, which are consistent and resolvable identifiers.
    • Common Name (CN): The fully qualified hostname of the server, for example server-passwordsecure.myorg.intern.
    • Subject Alternative Name (SAN): Every name over which a connection is to be established must be listed under SAN. The SAN extension must include at least the entry DNS: server-passwordsecure.myorg.intern, and the first SAN entry must be identical to the CN. You can optionally add further entries, for example DNS: server-passwordsecure and DNS: passwordsecure.
    • If a web server is running, also use the hostname instead of the IP address in its configuration.

Note: Self-signed certificates issued by Password Secure are valid for 9999 years and effectively do not expire. They can be reissued at any time, but for security reasons we always recommend a certificate from your own CA with a shorter validity period. Security takes priority over convenience.

Steps

  1. In the login window of the Server Manager, open the Basic Configuration.

    1.png

  2. In the Basic Configuration, activate Expert Mode.

    2.png

  3. Click the icon to create a new certificate. To use a certificate from your local CA instead, select that certificate here. Before you do, check that the hostname of the server is included as a DNS entry in the SAN.

    3.png

  4. Make sure the clients trust the new certificate. For a certificate from your own CA, install the root CA certificate (and any intermediate certificates) in the Trusted Root Certification Authorities certificate store of the clients. For many clients, distribute it via GPO or Intune. For a newly created self-signed certificate, install that certificate on the individual clients.

Related articles