Active Administrator 8.6.3 - User Guide

Setting certificate configuration

Setting certificate configuration

The Certificates feature monitors the state of certificates on managed computers and the security on the repository. You can enable or disable certificate monitoring, and send a notification email when the state of a certificate changes.

Certificate protection validates that the certificate details stored by Active Administrator® match the details of the certificate installed on the computer. When this feature is enabled, any differences found are reported as broken certificates and email notifications are sent to the recipients on the certificate email list.

To make changes to certificates in the repository, users and groups must be granted the modify permission on the Certificate Repository folder from within Active Administrator. You can check the security and send notifications if the modify permission is altered with system-provided tools.

Topics 

•	Setting certificate notifications

•	Setting up certificate email notifications

•	Configuring certification authority

•	Configuring certificate protection

•	Setting security on the repository

Setting certificate notifications

Setting certificate notifications

Notifications are sent to accounts on the email list based on the settings you configure.

To set certificate notifications

1	Select Configuration | Certificate Configuration.

2	Open the General tab, if necessary.

3	By default, certificate monitoring is enabled for the Certificate Management and Certificate Repository modules. To disable the feature, clear the check box

4

By default, security on the Certificate Repository is not checked. If you select this feature, an email notification will indicate if the modify permission was granted using system-provided tools, but not from within Active Administrator®, if the modify permission was deleted using system-provided tools, or if the user/group was deleted using system-provided tools.

NOTE: Users and groups need the modify permission on the Certificates Repository folder to make changes to certificates stored in the Certificate Repository. See Setting security on the repository.

5	Select the state of the certificate to trigger the notification email. You can select to send an email notification to the listed email addresses when a certificate is:

Table 115. Certificate states that trigger an email notification

Certificate state	Description
deleted	Certificate Management only Select to enable or disable notifications for certificates that were deleted.
added	Certificate Management only Select to enable or disable notifications for certificates that were added. You also can further specify to only send notifications when a certificate is added using system-provided tools.
going to expire	Select to enable or disable notifications for certificates that are going to expire. To exclude expiring certificates in the repository and PFX files, clear the check boxes. You also can select to send notifications to the user prior to a password expiring The maximum value is 90 days. Select to send additional levels of notification, if desired. Select to repeat the notifications after the final notification, if desired. The setting for the final notification will repeat, so if the final notification is set to 5 days, the user will continue to receive the notification daily after 5 days until they change their password.
expired	Select to enable or disable notifications for certificates that are expired. To exclude expired certificates in the repository and PFX files, clear the check boxes.
uses a cryptographic hash algorithm	Select to enable or disable notifications for certificates that use a cryptographic hash algorithm. By default, only SHA1RSA is included in the notification. To include other hash algorithms, select the check boxes. NOTE: If you enable notification, you can choose to disable specific certificates from the notification. See Excluding certificates that support cryptography.
revoked	Select to enable or disable notifications for certificates that were revoked. To exclude revoked certificates in the repository and PFX files, clear the check boxes. NOTE: If you enable notification for revoked certificates, you can choose to disable specific certificates from the notification. See Excluding revoked certificates.

6	Set the window to check for certificate expiration. The default is for certificates set to expire within the next 30 days.

7	Set the time to check the certificates.

8	Click Save.

Setting up certificate email notifications

Setting up certificate email notifications

Email notifications are sent to the listed accounts based on the settings on the General tab. See Setting certificate notifications. Notifications are also sent for broken certificates. See Configuring certificate protection.

To set up the email list for certificate notifications

1	Select Configuration | Certificate Configuration.

2	Click Email Addresses.

3	Add, edit, or remove emails from the list. Each listed email address receives the certificate notification.

 

NOTE: You also can manage the Certificate Settings email address list from the Settings menu. See Managing email addresses.

4	Click Save.

Configuring certification authority

Configuring certification authority

When searching for Certificate Authority (CA) certificates, you can employ the search cache instead of searching Active Directory. You can choose to cache an entire forest to maximize the speed of retrieving results, or you can choose to cache only found objects in Active Directory to quickly retrieve the object again from the cache for a certain amount of time.

To configure certificate authority

1	Select Configuration | Certificate Configuration.

2	Click Certificate Authority.

3	Checking CA services is set to every 10 minutes by default. To change the frequency for checking the CA services, enter a number greater than 10 minutes.

4	Search caching is enabled by default. To disable search caching, clear the check box.

 

NOTE: If you disable search caching, all searches are preformed against Active Directory. You also can disable search caching for specific searches.

5	Choose the type of search caching.

 

Option	Description
Full	The entire forest (users and computers with CA certificates) is cached in memory. Set the cache refresh rate. By default, the cache is refreshed every 20 minutes.
Minimal	Only objects that are found during the search are cached. If you search for the object again, the object is found first in the cache. The object is removed from the cache after 20 minutes.

6	If you want to exclude certain domains from the search cache, click Add and select the domain.

7	Click Save.