Administer > SA Core and component security > SA certificate management > Use SA in third-party certificate mode > SA certificates format

SA certificates format

Requirements for supplying the SA certificates

  • Provide each SA certificate in its own file. Concatenating multiple certificates in a single file is not supported.
  • Provide the certificates in PEM format (ASCII, base64 encoding of the DER certificate).
  • Do not include the CA chain that signs the certificate.

Requirements for supplying the CA chain

  • The CA certificates must be provided in PEM format (ASCII, base64 encoding of the DER certificate).
  • The entire chain must be provided in a single file by concatenating the PEM encoded CA certificates.

Requirements for naming the certificate files

For Core installation and Recertification, the filename of each generated CSR contains the component name and the FQDN of the machine where the component will be installed.

When copying the certificates from your CA, use the filename of the CSR file, but change the *.csr extension to *.crt. For example, change twist_smo.dev.opsware.com.csr to twist_smo.dev.opsware.com.crt.

If the issued certificates do not meet this naming convention, the SA installer ignores your third-party certificates and cannot complete the SA Core installation.

Requirements for the CA chain

For Core installation and Recertification, make sure to also provide the CA chain that signs the SA certificates. Place the certificates and the CA chain in a folder with the following structure:

admin-ca
- ca.crt
agent-ca-3rdparty
- ca.crt
opsware-ca
- ca.crt
agent_smo.dev.opsware.com.crt
browser_smo.dev.opsware.com.crt
opswareinstaller_smo.dev.opsware.com.crt
...
Provide the CA chain in the ca.crt file and place it in all three folders: admin-ca agent-ca-3rdparty and opsware-ca. Make sure the content of ca.crt is the same in all three subfolders. The last entries in the folder are the certificate files which use the naming convention described above.

Send Help Center feedback