Administer > SA Core and component security > SA certificate management > Use SA in third-party certificate mode > Work with Certificate Signing Request (CSR)

Work with Certificate Signing Request (CSR)

For each certificate that SA requires, the SA Core installer or the Core Recertification generates a PKCS#10 Certificate Signing Request (CSR). Manually retrieve these CSRs and submit them to your external Certificate Authority (CA) for signing. Once you provide the issued certificates, SA resumes the SA Core or Agent installation.
SA 10.60 does not integrate with any external CAs to automatically submit the CSRs and pick up the resulting certificates.

Configure CSRs

Before installing the primary Core or before starting the Core Recertification job, you can configure the CSR configuration file available under /etc/opt/opsware/crypto/csr.conf. This enables you to change most of the attributes of the Subject field. Your external CA can also configure these fields in the resulting certificates.

Do not change the subject@CN attribute, otherwise SA crashes with various authorization errors. This attribute is used to identify the component owner of each certificate. SA determines the subject@CN value automatically and includes it in the CSR.

You can also configure the Subject Alternative Name extension (SAN). This stores the FQDN of the host where the certificate will be installed. When generating the CSR, SA determines the host FQDN and includes it as the value of the SAN extension. The CA can change the value of the SAN extension when signing the CSR. For example, the CA can add additional names of the host to the SAN extension. It can also completely remove the SAN extension from the certificate, as SA does not use this extension at runtime.

Related topics

SA Core installation

SA Core recertification

Install an SA Agent in third-party mode using the CLI

Install the SA Agent in third-party mode using ADT

Send Help Center feedback