Use SA in self-signed certificate mode

In self-signed certificate mode, SA generates its own root Certificate Authorities (CAs) during Core installation or during Core Recertification. SA then uses these root CAs to sign all its certificates:

• Bootstrap CA – signs the Bootstrap certificate. The SA Agents use the Bootstrap certificate to register with the SA Core during Agent installation.
• Agent CA – signs all the SA Agent certificates.
• Core CA – signs all SA Core components certificates.
• Admin CA – signs the client certificate which can be used to access some administration web interfaces.

Certificate validity

By default, all SA certificates are valid for ten years. You can change the life span of the SA certificates only through customization.

Compromised certificates

In self-signed certificate mode, SA uses Class certificates where all the Core components of a class share one certificate. For example, all the Command Engines share one Command Engine certificate. Compromising one Command Engine certificate means all the Command Engine certificates are compromised.
Furthermore, SA does not support certificate revocation. The only way to invalidate a compromised Core Component certificate is to recertify the entire Core.