Set Up Certificate-based Authentication

You can use certificate-based authentication when logging in to Signum using a certificate. Instead of authenticating with a username and password, you prove your identity using a cryptographic credential. Certificate authentication enables stronger security, automation, and integration.

To use certificate-based authentication in Signum, the Signum Administrator configures the users with a public key, certificate (.cer) file, and the users authenticate with a private key, PKCS#12 (.p12), file.

• Admin Setup

• User Setup

Admin Setup

Upload a certificate (.cer) file to the Admin Console and configure users with the certificate.

Step 1 - Add Certificate to Truststore

When using certificate-based authentication, adding the CA to the Truststore is required. In the SaaS Portal, navigate to the Trust and Identity section.

1. Click Add.

2. In the pop-up, provide a name for the certificate.

3. Upload the certificate file. Accepted file types are .pem, .crt, and .cer.

4. Click Add.

Step 2 - Upload Certificate to the Admin Web Console

In the Admin Web, navigate to the Certificates page.

1. Open the Client Auth Certificates tab.

   

2. Click Upload.

3. Upload chosen certificate.

For more information, see Client Auth Certificates.

Step 3 - Configure User Access with the Certificate

After uploading the file to the console, configure the users.

1. In the Admin Web, go to the Access page.

2. Under the Domain tab, click on the Domain Type Certificate users. If you do not already have this domain type created, click New to create.

3. In the Edit Domain popup window, go to the Users tab:

   

4. Click New.

5. Under Signum Configurations, fill in username, name, and email:

   

6. Under Client Certificate Chains, click Select Certificates:

   

7. Choose the certificate to use for user authentication.

8. Complete the user configuration as needed.

9. If the user needs access to the Admin Web Console, make sure the user is assigned to the appropriate Role:

   

   
   

For further configuration information, see Certificate User Domains.

User Setup

To authenticate as a user, you need to install the private key, PKCS#12 (.p12) file, to your local machine, and configure the Agent with the file.

Step 1 - Install PKCS#12 File on the Local Machine

Put the certificate on the local disk, accessible by SignumService. It is recommend to put the certificate either in /tmp/ or /etc/keyfactor/.

The following example is using the Microsoft Current User Certificates store. For macOS, a similar process can be done for importing certificate to the keychain. See Add certificates to a keychain using Keychain Access on Mac. For Linux users, you must install the certificate directly to your browser. For an example with Firefox, see Import Certificate to Mozilla Firefox.

1. On your local machine, locate the .p12 file.

2. Open your certificates store or double-click on the certificate to open.

3. Click Import Certificate:

   

4. Create a password:

   

5. Click Next.

6. Select the Certificate store to place your certificate:

   

7. Click Next.

8. Click OK.

   

After installation, you should see the certificate in your certificate store.

Step 2 - Set up Agent to Use Certificate

After making the certificate available on your local machine, configure your Signum Agent to use the certificate. See Configure & Authenticate Agent.