About external certificates on Access Appliance
Starting from the Access Appliance 8.1 release, you can generate and use external certificates instead of internal certificates. External Certificate Authority (ECA) certificates are the digital credentials that attest to the certificate owner's identity and affiliation. Once you deploy the external certificates, all the Access Appliance components use them. One certificate is deployed for all the components. These certificates are used by Access Appliance web server and S3 server for a secure client-server communication.
The external certificates also deploy a certificate bundle and (optionally) certificate revocation list. To generate an external certificate, you have to create a certificate request with proper 'Subject Distinguished Name' and 'Subject Alternative Names.' You can generate a certificate request using the GUI. The necessary FQDNs are auto-populated to generate the correct request. You can add additional information as needed. Based on the certificate request, you can create an external certificate. When deploying external certificate for the first time, you have to provide a CA certificate bundle. This is used to validate the incoming and deployed external certificate. You can also optionally provide a certification revocation list.
Some important terminologies:
A certificate authority, also known as a certification authority, is a trusted organization that verifies websites (and other entities) so that you know who you are communicating with online. Their objective is to make the internet a more secure place for both organizations and users. Becoming a Certificate Authority (CA) means that you (or your customers) oversee the issuing process of cryptographic pairs of private keys and public certificates.
Certificate bundle (CA bundle) is a file that contains root and intermediate certificates. The end-entity certificate along with a CA bundle constitutes the certificate chain.
Certificate Revocation List (CRL) is a list of digital certificates that have been revoked by the issuing Certificate Authority (CA) before their scheduled expiration date and should no longer be trusted. CRL is optional. It may be provided as a file or embedded in certificate as a URL.
Subject Alternative Name: This field lets you specify additional host names (such as sites, IP addresses, common names, and S3 endpoints) to be protected by a single SSL certificate.
Considerations while deploying ECA:
All certificates for communication should be obtained from a common trusted CA.
After ECA is deployed on the cluster, you can renew or update the ECA.
It is recommended to pause backup/restore operations before starting ECA deployment/renewal.
The CA bundle and CRL file independent of other security artifacts.
When you deploy security artifacts, they are validated and if inconsistencies are found, you are notified, and deployment does not proceed. If you provide an external certificate and CA certificate bundle, the EC certificate is validated against the user provided CA certificate bundle. If only one of the items is provided, it is validated against deployed artifacts.
You receive continuous alerts and emails for 60 days before external certificates are about to expire. You must get new CA certificates and deploy it again for seamless working of the Access Appliance. If you fail to do so, the web server and S3 server stop working.
Download the Access Appliance root certificate, and add it to your web browser's list of trusted certificate authorities. This prevents your web browser from displaying security warning messages when you access the Access Appliance UI. If the appliance has been upgraded from any version before 8.1, the internal certificates are updated. You can download the certificate from the GUI by navigating to and upload it in the client trust store for a secure client-server communication.