Active Administrator 8.7 - User Guide

Setting certificate notifications

Setting certificate notifications

Notifications are sent to accounts on the email list based on the settings you configure.

To set certificate notifications

1	Select Configuration | Certificate Configuration.

2	Open the General tab, if necessary.

3	By default, certificate monitoring is enabled for the Certificate Management and Certificate Repository modules. To disable the feature, clear the check box

4

By default, security on the Certificate Repository is not checked. If you select this feature, an email notification will indicate if the modify permission was granted using system-provided tools, but not from within Active Administrator®, if the modify permission was deleted using system-provided tools, or if the user/group was deleted using system-provided tools.

NOTE: Users and groups need the modify permission on the Certificates Repository folder to make changes to certificates stored in the Certificate Repository. See Setting security on the repository.

5	Select the state of the certificate to trigger the notification email. You can select to send an email notification to the listed email addresses when a certificate is:

Table 115. Certificate states that trigger an email notification

Certificate state	Description
deleted	Certificate Management only Select to enable or disable notifications for certificates that were deleted.
added	Certificate Management only Select to enable or disable notifications for certificates that were added. You also can further specify to only send notifications when a certificate is added using system-provided tools.
going to expire	Select to enable or disable notifications for certificates that are going to expire. To exclude expiring certificates in the repository and PFX files, clear the check boxes. You also can select to send notifications to the user prior to a password expiring The maximum value is 90 days. Select to send additional levels of notification, if desired. Select to repeat the notifications after the final notification, if desired. The setting for the final notification will repeat, so if the final notification is set to 5 days, the user will continue to receive the notification daily after 5 days until they change their password.
expired	Select to enable or disable notifications for certificates that are expired. To exclude expired certificates in the repository and PFX files, clear the check boxes.
uses a cryptographic hash algorithm	Select to enable or disable notifications for certificates that use a cryptographic hash algorithm. By default, only SHA1RSA is included in the notification. To include other hash algorithms, select the check boxes. NOTE: If you enable notification, you can choose to disable specific certificates from the notification. See Excluding certificates that support cryptography.
revoked	Select to enable or disable notifications for certificates that were revoked. To exclude revoked certificates in the repository and PFX files, clear the check boxes. NOTE: If you enable notification for revoked certificates, you can choose to disable specific certificates from the notification. See Excluding revoked certificates.

6	Set the window to check for certificate expiration. The default is for certificates set to expire within the next 30 days.

7	Set the time to check the certificates.

8	Click Save.

Setting up certificate email notifications

Setting up certificate email notifications

Email notifications are sent to the listed accounts based on the settings on the General tab. See Setting certificate notifications.

To set up the email list for certificate notifications

1	Select Configuration | Certificate Configuration.

2	Click Email Addresses.

3	Add, edit, or remove emails from the list. Each listed email address receives the certificate notification.

 

NOTE: You also can manage the Certificate Settings email address list from the Settings menu. See Managing email addresses.

4	Click Save.

Configuring certification authority

Configuring certification authority

When searching for Certificate Authority (CA) certificates, you can employ the search cache instead of searching Active Directory. You can choose to cache an entire forest to maximize the speed of retrieving results, or you can choose to cache only found objects in Active Directory to quickly retrieve the object again from the cache for a certain amount of time.

To configure certificate authority

1	Select Configuration | Certificate Configuration.

2	Click Certificate Authority.

3	Checking CA services is set to every 10 minutes by default. To change the frequency for checking the CA services, enter a number greater than 10 minutes.

4	Search caching is enabled by default. To disable search caching, clear the check box.

 

NOTE: If you disable search caching, all searches are preformed against Active Directory. You also can disable search caching for specific searches.

5	Choose the type of search caching.

 

Option	Description
Full	The entire forest (users and computers with CA certificates) is cached in memory. Set the cache refresh rate. By default, the cache is refreshed every 20 minutes.
Minimal	Only objects that are found during the search are cached. If you search for the object again, the object is found first in the cache. The object is removed from the cache after 20 minutes.

6	If you want to exclude certain domains from the search cache, click Add and select the domain.

7	Click Save.

Setting security on the repository

Setting security on the repository

To make changes to certificates in the repository, users and groups must be granted the modify permission on the Certificate Repository folder. Active Administrator provides the tool to help you manage who has the modify permission to the certificate repository.

To set security on the repository

1	Select Configuration | Certificate Configuration.

2	Click Edit permissions.

The users and groups listed have the modify permission to the Certificate Repository folder.

▪	To add a user or group to the list, click Add and select an account.

▪	To remove a selected user or group from the list, click Remove.

3	Click Update.

4	Click Save.

5	Click Yes to acknowledge that permissions on the Certificate Repository folder will be updated.

Active Administrator runs a check on the Certificate Repository folder. You will see warnings if the:

▪	modify permission was granted using system-provided tools, but not from within Active Administrator

▪	modify permission was deleted using system-provided tools

▪	user/group was deleted using system-provided tools