You can assign the custom Administration Server certificate, for example, for better integration with the existing public key infrastructure (PKI) of your enterprise or for custom configuration of the certificate fields. It is useful to replace the certificate immediately after installation of Administration Server and before the Quick Start Wizard finishes.
The maximum validity period for any of the Administration Server certificates must be 397 days or less.
Prerequisites
The new certificate must be created in the PKCS#12 format (for example, by means of the organization's PKI) and must be issued by trusted certification authority (CA). Also, the new certificate must include the entire chain of trust and a private key, which must be stored in the file with the pfx or p12 extension. For the new certificate, the requirements listed below must be met.
Certificate type: Common certificate, common reserve certificate ("C", "CR")
Requirements:
Path Length Constraint value may be an integer different from "None" but not less than 1.
Certificates issued by a public CA do not have the certificate signing permission. To use such certificates, make sure that you installed Network Agent version 13 or later on distribution points or connection gateways in your network. Otherwise, you will not be able to use certificates without the signing permission.
Stages
Specifying the Administration Server certificate proceeds in stages:
Use the command-line klsetsrvcert utility for this purpose.
When the certificate is replaced, all Network Agents that were previously connected to Administration Server through SSL lose their connection and return "Administration Server authentication error." To specify the new certificate and restore the connection, use the command-line klmover utility.
Results
When you finish the scenario, the Administration Server certificate is replaced and the server is authenticated by Network Agents on the managed devices.