You can assign the custom Administration Server certificate, for example, for better integration with the existing public key infrastructure (PKI) of your enterprise or for custom configuration of the certificate fields. It is useful to replace the certificate immediately after installation of Administration Server and before the quick start wizard finishes.
The maximum validity period for any of the Administration Server certificates must be 397 days or less.
Prerequisites
The new certificate must be created in the PKCS#12 format (for example, by means of the organization's PKI) and must be issued by trusted certification authority (CA). Also, the new certificate must include the entire chain of trust and a private key, which must be stored in the file with the pfx or p12 extension. For the new certificate, the requirements listed in the table below must be met.
Requirements for the Administration Server certificates
Certificate type |
Requirements |
---|---|
Common certificate, common reserve certificate ("C", "CR") |
Minimum key length: 2048. Basic constraints:
Key Usage:
Extended Key Usage (EKU): server authentication and client authentication. The EKU is optional, but if your certificate contains it, the server and client authentication data must be specified in the EKU. |
Mobile certificate, mobile reserve certificate ("M", "MR") |
Minimum key length: 2048. Basic constraints:
Key Usage:
Extended Key Usage (EKU): server authentication. The EKU is optional, but if your certificate contains it, the server authentication data must be specified in the EKU. |
Certificate CA for auto-generated user certificates ("MCA") |
Minimum key length: 2048. Basic constraints:
Key Usage:
Extended Key Usage (EKU): client authentication. The EKU is optional, but if your certificate contains it, the client authentication data must be specified in the EKU. |
Certificates issued by a public CA do not have the certificate signing permission. To use such certificates, make sure that you installed Network Agent version 13 or later on distribution points or connection gateways in your network. Otherwise, you will not be able to use certificates without the signing permission.
Stages
Specifying the Administration Server certificate proceeds in stages:
Use the command-line klsetsrvcert utility for this purpose.
When the certificate is replaced, all Network Agents that were previously connected to Administration Server through SSL lose their connection and return "Administration Server authentication error." To specify the new certificate and restore the connection, use the command-line klmover utility.
After you replace the certificate, specify it in the settings of Kaspersky Security Center Web Console. Otherwise, Kaspersky Security Center Web Console will not be able to connect to the Administration Server.
Results
When you finish the scenario, the Administration Server certificate is replaced and the server is authenticated by Network Agents on the managed devices.