Skip to main content

Replace the web console certificate

The installer creates a self-signed certificate for the console and binds it to the SbPAM Web Service website in Internet Information Services (IIS) on port 6500. Browsers don't trust a self-signed certificate. Replace it with a certificate from a trusted certificate authority (CA), then register services so they use the certificate's DNS name.

Prerequisites​

  • A certificate for client and server authentication, issued by a trusted CA.
  • The certificate and its private key are in the Local Computer Personal store on the Netwrix Privilege Secure server, and the issuing CA's root certificate is trusted on every client that opens the console.
  • For a high availability deployment, a certificate that lists the fully qualified domain name (FQDN) of each server in the Common Name (CN) or Subject Alternative Name (SAN) field.

Bind the certificate to the website​

  1. On the Netwrix Privilege Secure server, open Internet Information Services (IIS) Manager.
  2. Right-click the SbPAM Web Service website and select Edit Bindings.
  3. Double-click the https binding.
  4. In SSL certificate, select the certificate whose DNS name matches the name of your server.
  5. Select OK, then Close.
  6. Open Command Prompt as an administrator and run iisreset.

The installer saves the bindings of the website during an install or upgrade and applies them again. It restores each binding that has a certificate, as long as the certificate is still in a Local Computer certificate store. It skips a binding whose certificate is no longer there. An upgrade doesn't recreate or reconfigure the website, so custom bindings are kept.

Register services with the new DNS name​

Set NPS Rest URL to the FQDN on the certificate and register the services. See Set the NPS REST URL and register services.

Renew the JWT signing certificate​

The console signs sign-in tokens with a separate JSON Web Token (JWT) signing certificate. Renew it only when Netwrix Support tells you to. The procedure stops services, removes the existing certificate, and runs the key generator. For the steps, see Renewing the JWT Signing Certificate.