Kaspersky Security Center uses the following types of certificates to enable a secure interaction between the application components:
By default, Kaspersky Security Center uses self-signed certificates (that is, issued by Kaspersky Security Center itself), but you can replace them with custom certificates to better meet the requirements of your organization's network and comply with the security standards. After Administration Server verifies whether a custom certificate meets all applicable requirements, this certificate assumes the same functional scope as a self-signed certificate. The only difference is that a custom certificate is not reissued automatically upon expiration. You replace certificates with custom ones by means of the klsetsrvcert utility or through the Administration Server properties section in Kaspersky Security Center 13 Web Console, depending on the certificate type. The indexes of the certificate types described below are based on the possible values of the -t certtype parameter in the klsetsrvcert utility:
The maximum validity period for any of the Administration Server certificates must be 397 days or less.
Administration Server certificates
An Administration Server certificate is required for the following purposes:
The Administration Server certificate is created automatically during installation of the Administration Server component and it is stored in the /var/opt/kaspersky/klnagent_srv/1093/cert/ folder. You specify the Administration Server certificate when you create a response file to install Kaspersky Security Center 13 Web Console. This certificate is called common ("C").
The Administration Server certificate is valid for 397 days. Kaspersky Security Center automatically generates a common reserve ("CR") certificate 90 days before the expiration of the common certificate. The common reserve certificate is subsequently used for seamless replacement of the Administration Server certificate. When the common certificate is about to expire, the common reserve certificate is used to maintain the connection with Network Agent instances installed on managed devices. With this purpose, the common reserve certificate automatically becomes the new common certificate 24 hours before the old common certificate expires.
If you specify a validity term longer than 397 days for the Administration Server certificate, the web browser returns an error.
If the Administration Server certificate is lost, you must reinstall the Administration Server component, and then restore the data in order to recover it.
You can also back up the Administration Server certificate separately from other Administration Server settings in order to move Administration Server from one device to another without data loss.
Web Server certificate
A special type of certificate is used by Web Server, a component of Kaspersky Security Center Administration Server. This certificate is required for publishing Network Agent installation packages that you subsequently download to managed devices. For this purpose, Web Server can use various certificates.
Web Server uses one of the following certificates, in order of priority:
Kaspersky Security Center 13 Web Console certificate
The Server of Kaspersky Security Center 13 Web Console (hereinafter referred to as Web Console) has its own certificate. When you open a website, a browser verifies whether your connection is trusted. The Web Console certificate allows you to authenticate the Web Console and is used to encrypt traffic between a browser and the Web Console.
When you open the Web Console, the browser may inform you that the connection to the Web Console is not private and the Web Console certificate is invalid. This warning appears because the Web Console certificate is self-signed and automatically generated by Kaspersky Security Center. To remove this warning, you can do one of the following: