Preparing and uploading an SSL certificate to Active Directory

To prepare and upload an SSL certificate to Active Directory, perform the following actions for each server with the Central Node component:

1. Select an Active Directory container for the certificate. The Endpoint Sensors component lets you search for the serviceConnectionPoint object in the following locations (in the sequential order of the search):
   • ldap://CN=<Active Directory Site containing the computer with the Endpoint Sensors component>,CN=Sites,<configurationPartition>

     ldap://CN=Services, <Active Directorу configuration partition>

   It is recommended to publish the certificate in the "Sites" container if a separate Central Node component is deployed for any Active Directory Site.

2. In the selected container, create a serviceConnectionPoint object.
3. In a text editor, open the PEM SSL certificate of the server hosting the Central Node component and perform the following actions:
   1. Delete the strings BEGIN CERTIFICATE and END CERTIFICATE.
   2. Delete all line breaks.
4. Fill in the attributes of the serviceConnectionPoint as follows:
   • keywords contains the ID string 013D90F9-517B-486D-A7E8-888439D1DD61.
   • serviceDNSName matches the address of the Central Node server specified during installation of the Endpoint Sensors component.

     If an IP address was specified as the address during installation, the attribute must contain the same IP address. If the server FQDN was specified as the address, the attribute must contain the same server FQDN.

   • serviceBindingInformation contains the SSL certificate of the server with the Central Node component in PEM format in one string.

The Endpoint Sensors component performs a sequential search for the serviceConnectionPoint object starting in the Sites container and then in the Services container. It uses the first found object whose keywords attribute contains a unique ID but whose serviceDnsName attribute matches the Central Node server address that was defined during installation of the Endpoint Sensors component.

If the same Active Directory container contains two or more serviceConnectionPoint objects whose keywords attributes contain a unique ID but whose serviceDNSName values match, the Endpoint Sensors component will have limited functionality.

If the Endpoint Sensors component cannot decode the value of the serviceBindingInformation attribute into binary format, or if the attribute value is an empty string, the Endpoint Sensors component will have limited functionality.

Page top