Skip to main content
Version: Axidian Privilege 3.2

Certificate issues

A certificate provides a secure HTTPS connection.If there are problems with the certificate, the browser cannot guarantee secure data exchange with the server, and the risk of data interception increases.

When it is necessary to replace a certificate:

  • Outdated certificate data — the certificate contains outdated data, for example, the domain name, SAN (Subject Alternative Names), or server IP address.
    If the old certificate is retained, PAM will become unavailable.

  • Compromise of the server's private key — the key becomes known and can be used by third parties.
    Replace certificates even if they have not yet expired.

  • Expiration — the most common reason for certificate replacement.
    We recommend replacing certificates before they expire, otherwise PAM will become unavailable and the connection will be insecure for users.

    How to check when the certificate expires?

    If the user or administrator console does not open, and the browser address bar displays the error Not secure, check the certificate expiration date. Click on the warning in the address bar of your browser:

    • Microsoft Edge: go to Not secure → Your connection to this site isn't secure → icons8-certificate-22.png.
    • Google Chrome: go to Not secure → Certificate details.

Root certificate of the CA​

The CA root certificate must be replaced on all PAM servers, including the load balancer.
The certificate must be in PEM format with Base-64 encoding and use the SHA-256 signature algorithm. When replacing certificates, preserve the original file names.

info

If the new CA certificate is created with the same private keys, replacing certificates in the PAM installation is not required. When creating a certificate with a new key pair, it is necessary to replace all previously issued certificates throughout the entire PAM installation.

  1. Export the root certificate without the private key with the extension .cer or .crt.
  2. Right-click on the certificate file and select Install Certificate from the context menu.
  3. In the certificate import wizard, for the Store Location parameter, select Local Machine and click Next.
  4. Select Place all certificates in the following store and click Browse.
  5. In the window that opens, select Trusted Root Certification Authorities and click OK.
  6. Click Next.
  7. Click Finish in the confirmation dialog.

Server certificate​

Replace the certificates on the target server. New certificates must meet the requirements and preserve the original file names.

  1. Export the private key certificate in .pfx format.

  2. Place the server certificate in the computer's personal certificates:

    1. Right-click on the certificate file and select Install Certificate from the context menu.
    2. In the certificate import wizard, for the Store Location parameter, select Local Machine and click Next.
      Enter the certificate password.
    3. Select Place all certificates in the following store and click Browse.
    4. In the window that opens, select Personal and click OK.
    5. Click Finish in the confirmation dialog.

  3. Launch IIS Manager.

  4. In the left Connections panel expand <FQDN> → Sites → Default Web Site.

  5. Select Default Web Site and in the right Actions panel, click Bindings.

  6. In the window that opens, replace the certificate for all bindings with type HTTPS and port 443:

    1. Select the binding and click Edit.
    2. In the window that opens, click Select and choose the imported certificate.

  7. After replacing the certificates, in the left Connections panel, click on the server FQDN.

  8. In the right Actions panel, click Restart.

  9. Open the configuration file C:\Program Files\Axidian\Axidian Privilege\Gateway\Pam.Gateway.Service\appsettings.json with administrator rights

  10. In the Kestrel section, specify the Subject value of the new certificate for the Subject parameter.

    Configuration file structure
       "Kestrel": {
         "Endpoints": {
           "HttpsInlineCertStore": {
             "Url": "https://0.0.0.0:5443",
             "Certificate": {
               "Subject": "dc.axidian.local", // Specify the value from the new certificate
               "Store": "My",
               "Location": "LocalMachine",
               "AllowInvalid": "False"
             }
           }
         }
       }

    If the server IP address is not specified in the SAN field of the new certificate, update the ProxyApp configuration:

    • Open the configuration file C:\Program Files\Axidian\Axidian Privilege\Gateway\ProxyApp\appsettings.json
    • In the GatewayService section, replace the IP address with the server name in FQDN format.

    Configuration file structure
    "GatewayService": {
      "Url": "https://dc.axidian.local:5443" // Specify the server name in FQDN format
    }

RDS access server certificate​

RDS access server certificates are managed through Server Manager, as they are used by the following services:

  • RD Connection Broker: SSO
  • RD Connection Broker: Publishing

To replace the certificate:

  1. Export two private key certificates in .pfx format.
    Certificates must meet the requirements.
  2. Open Server Manager.
  3. Go to Remote Desktop Services.
  4. In the Deployment Overview window, click Tasks and select Edit Deployment Properties from the drop-down list.
  5. In the window that opens, select Certificates.
  6. In the Role Service window, select RD Connection Broker - Enable Single Sign On.
  7. Click Select existing certificate....
  8. Select Choose a different certificate and click Browse.
  9. In the window that opens, select the certificate to import and click Open.
  10. In the Password field, enter the certificate password.
  11. Enable the Allow the certificate to be added to the Trusted Root Certification Authorities certificate store on the destination computers checkbox.
  12. Click OK and Apply.
  13. Repeat steps 6-12 for the RD Connection Broker - Publishing role service.