CA SiteMinder® Federation Standalone Guide › Key and Certificate Management › Obtain a Key/Certificate Pair for Federated Transactions

Obtain a Key/Certificate Pair for Federated Transactions

CA SiteMinder® Federation Standalone uses a key/certificate pair and trusted certificates for a number of functions. For CA SiteMinder® Federation Standalone to perform tasks that use keys and certificates, these items must be in the certificate data store.

If you do not have a key/certificate pair in the certificate data store, you have two options:

• Import a key/certificate pair from an existing file (.p12 or .pfx).
• Generate a key/certificate pair.

  To generate a new key/certificate pair, request a certificate from a trusted Certificate Authority and then import the signed certificate response that the authority returns.

The following figure shows the steps for each method of obtaining a key/certificate pair or trusted certificate.

Import a Key/Certificate Pair from an Existing File

If you do not have a key/certificate pair in the certificate data store, import one from an existing .p12 or .pfx file.

CA SiteMinder® Federation Standalone treats a certificate that you import as a trusted certificate. The exceptions are self-signed certificates:

• If the system identifies a V3 self-signed certificate as a CA certificate, the certificate is treated as a CA certificate. This behavior occurs even though you initiate the import from the Certificate/Private Key dialog.
• CA SiteMinder® Federation Standalone treats the certificate as a trusted certificate:
  • If CA SiteMinder® Federation Standalone does not identify a V3 self–signed certificate as a CA.
  • If the certificate is a V1 self–signed certificate.

Follow these steps:

1. Log in to the Administrative UI.
2. From the Certs & Keys tab, select Certificates and Private Keys.

   The View Certificates and Private Keys dialog opens.

3. Click Import New and follow the wizard.

   Note: You can click Help for a description of fields, controls, and their respective requirements.

   Be aware of the following items as you complete the wizard:

   • You can import a single file with a key and certificate in it or separate key and certificate files. Select the appropriate option button for the file you are using.
   • To import a self-signed certificate as a Certificate Authority certificate, set the Use as CA option button to Yes. The certificate is imported as a CA certificate and is not available for when configuring partnerships (for example, for signing or encryption).

     Otherwise, accept the default No setting to import the certificate as a trusted certificate that is available when configuring partnerships.

   • For a trusted certificate file in DER (binary) format, the file can contain one or more certificate entries. For a trusted certificate file in PEM (base 64) format, CA SiteMinder® Federation Standalone expects one certificate per file.

     The standard extension for a file in DER or PEM format is *.crt or *.cer.

   • If you are using a .p12 file, you are required to fill in a password. CA SiteMinder® Federation Standalone processes a .p12 or .pfx file as a file containing key/certificate pairs.
   • For each entry you plan to add to the certificate data store, enter the alias you want to associate with that entry. If you select multiple entries, each requires a unique alias.
4. At the Confirm step, review the information and click Finish.

The key/certificate pair is imported into the certificate data store.

How to Generate a Key/Certificate Pair

If you do not have a key/certificate pair in the certificate data store, you can generate a new key/certificate pair.

Perform the following steps:

1. Generate a certificate request and send the request to a trusted Certificate Authority.
2. Import the signed certificate response from the authority.

Generate a Certificate Request

If you do not have a key/certificate pair in the certificate data store, request one from a trusted Certificate Authority. When the CA returns a signed certificate response, import it into the certificate data store.

When you generate a certificate request, CA SiteMinder® Federation Standalone generates a private key and a self–signed certificate pair. CA SiteMinder® Federation Standalone stores this pair in the certificate data store. Using the generated request, contact a Certificate Authority and fill out the CA certificate request form, pasting the contents of the generated request into the form.

The CA issues a signed certificate response, usually in PKCS #7 format. You can import the signed certificate response into the certificate data store. After the signed certificate response is imported, the existing self–signed certificate entry of the same alias is replaced.

Follow these steps:

1. Log in to the Administrative UI.
2. From the Certs & Keys tab, select Certificate and Private Keys.

   The View Certificates and Private Keys dialog opens.

3. Click Request Certificate.

   The Request Certificate dialog opens.

4. Complete the required fields.

   Note: Click Help for a description of fields, controls, and their respective requirements.

5. Click Save.

A file that conforms to the PKCS #10 specification is generated.

The browser prompts you to save or open the file, which contains the certificate request. If you do not save this file (or open it and extract the text), CA SiteMinder® Federation Standalone still generates the private key and self–signed certificate pair. Generate a new certificate signing request, using the Generate CSR feature, to get a new request file for the private key.

Import a Signed Certificate Response

After completing a certificate request and sending it to the Certificate Authority, the Certificate Authority issues a signed certificate response.

Import the signed certificate into the certificate data store to replace the existing self-signed certificate entry of the same alias.

Follow these steps:

1. From the Certs & Keys tab, select Certificate and Private Keys.

   The View Certificates and Private Keys dialog opens.

2. Search for the self-signed entry with the same alias.
3. Select Action, Update Certificate next to the entry that contains the self-signed certificate.

   The wizard for importing certificates and keys displays.

   Note: Click Help for a description of fields, controls, and their respective requirements.

4. Browse to the file you want. You can use a:
   • .p7 or .p7b file that contains the signed certificate and the corresponding certificate chain.
   • .cer or .crt file (base64 PEM file) with the signed certificate without the certificate chain.
5. Select the appropriate entry.
6. At the Confirm step, review the certificate information and click Finish.

The signed certificate is imported into the certificate data store and the self-signed certificate is replaced.

Generate a New Certificate Signing Request

A certificate signing request (CSR) is a message that you send to a Certificate Authority to apply for a identity certificate. Before you can generate a CSR, CA SiteMinder® Federation Standalone has to generate a key/certificate pair. The certificate is then placed in the CSR.

Generate a new request for an existing private key because:

• You no longer have the original request that CA SiteMinder® Federation Standalone generated for the private key/self-signed certificate pair.
• You need a new certificate for an expiring one, which requires a new copy of a CSR to submit to a Certificate Authority.

You can generate a new CSR for a self-signed or CA-signed private key/certificate pair. The private key always generates an identical CSR without modifying the existing private key.

Follow these steps:

1. From the Certs & Keys tab, select Certificate and Private Keys.

   The Certificate and Private Key List displays.

2. Select Action, Generate CSR for the private key entry for which you want a new CSR.

   A file that conforms to the PKCS #10 specification is generated and CA SiteMinder® Federation Standalone prompts you to save the CSR.

3. Click Save.
4. (Optional) If you require a CA-signed certificate, contact a Certificate Authority and follow the procedure the Certificate Authority requires for submitting a request. Use the PKCS#10 file you saved in the previous step for the request.

After you complete the certificate request process, the Certificate Authority issues a signed certificate response that you import into the certificate data store. CA SiteMinder® Federation Standalone replaces the existing certificate entry of the same alias with the newly imported certificate.