A certificate signing request (CSR) tells an external Certificate Authority (CA) that you want an SSL certificate generated and signed by that CA. The SSL certificate can then be uploaded to Cryptographic Security Platform Vault and used in place of the default self-signed certificate.

When you use Cryptographic Security Platform Vault to create the CSR, Cryptographic Security Platform Vault creates a key pair and uses that key pair in conjunction with the information you specify to create the CSR. Cryptographic Security Platform Vault then encrypts the key pair and stores it for later use.

You can use the resulting CSR to generate an SSL certificate from the external CA you want to use. After you receive the SSL certificate from that external CA, you can upload it to Cryptographic Security Platform Vault. Because the key pair already exists on the system, you do not need to upload anything else.

If you create the CSR outside of Cryptographic Security Platform Vault, you need to upload both the SSL certificate and the matching private key file when you install the certificate on Cryptographic Security Platform Vault.

Procedure

  1. Log into the Cryptographic Security Platform Vault Management webGUI using an account with Domain Admin privileges.
  2. Click the Settings icon.
  3. On the KMIP Vault Settings page, select Actions > Generate CSR.

  4. In the Generate Certificate Signing Request dialog box, specify the options you want to use.

    Field

    Description

    Common Name

    The name to associate with this request.

    Locality

    The locale to associate with this request.

    State

    The state to associate with this request.

    Subject Alternative Names

    The host names that will be protected by this certificate.

    Key Size

    Select the key size that you want to use. The default is 4096 bytes.

    Country

    The country to associate with this request. The default is US.

    Organization

    The organization to associate with this request.

    Organization Unit

    The organizational unit associate with this request.

  5. Click Generate.
  6. When you receive the message that Cryptographic Security Platform Vault has created the CSR, click Download to save a copy of the CSR to your browser's default download directory.
  7. Use the CSR to request an SSL certificate from the external Certificate Authority you want to use. How you do this depends on the CA that you are using.

What to Do Next 

After you receive the SSL certificate from the external CA, install it on Cryptographic Security Platform Vault. For more information, see Installing a Custom Certificate.