I have a CR (On-prem AA360 v.24) configured for Self-Signed SSL certificate. There’s an unconvinience in the certificate having to be manually installed on all of the Client Machines.
Is there a way to somehow make this self-signed certificate trusted by the domain withiout being manually installed?
Otherwise, what certificates should I get from IT (network dept) to switch to?
Would This external certificate replace self-signed and in the result the client’s machines would trust the CR certificate?
greetings Michal
Page 1 / 1
Hi @MichalTurek
Please take a look at the following documentation on how to deploy self-signed SSL certificates using GPO in your domain.
Self signed certificates are typically used for development and testing purposes. For production use, it is best to obtain a external certificate from a trusted certificate authority.
Please request your IT team to obtain an external certificate from a trusted certificate authority for the domain you have the control room configured.
Below is the documentation on how to import/modify the certificate from self-signed to external certificate in Control Room.
For multiple control rooms model, you can also provision a load balancer infront of control rooms to reduce load from TLS handshake through hardware offloading, when supported by the load balancer.
In some cases If certificate file does not contain any intermediate certificates, then copy all the intermediate certificates to a directory on your device and use the directory path in the following command.
Also, to add to above, External certificates (e.g. godaddy, digicert etc) are cost bound and only required if you are going to access Control Room over the internet.
If you intend to keep Control Room (and whole RPA foot print) internal to your organization only, then you only need and organization level enterprise server certificate, that is usually issued by your Org’s network/security team. You can request the certificate which fulfils following requirements. Give these parameters to your network/security team and they should be able to give you right certificate.
Also, to add to above, External certificates (e.g. godaddy, digicert etc) are cost bound and only required if you are going to access Control Room over the internet.
If you intend to keep Control Room (and whole RPA foot print) internal to your organization only, then you only need and organization level enterprise server certificate, that is usually issued by your Org’s network/security team. You can request the certificate which fulfils following requirements. Give these parameters to your network/security team and they should be able to give you right certificate.
Fill in the respective details and you should be good to register. Nonetheless, I have posted the content of above article as well in the next reply post.
Instructions
There are basically different scenarios for which entries of server FQDN / Load Balancer URL / DNS Alias URL in certificate fields vary. And based on which the process of certificate generation must be taken care of.
For all scenarios, the below requirements remain the same.
The certificate must have ".pfx" extension(PKCS#12 format certificate). For this, the certificate private key must be marked as exportable while generating the certificate. Without this, the certificate will become unusable for application.
The certificate must have a complete chain in the "Certification Path" tab. (root + intermediate + server)
Both - Third-party CA and Enterprise CA-issued certificates are supported.
Third-party CA-issued certificate (must be purchased by the security team) is only required if RPA / IQ Bot application will be accessed over the internet.
For all internal communication, Enterprise CA issued certificate is more than enough.
It can be generated from a Base64 encoded (X509) certificate (.cer file) if it does meet the following requirements.
A self-signed certificate must only be used for POC environments. For any actual environment, they don't serve the purpose and hence, should not be used.
The requirements mentioned below are specific to how environments are set up.
If there is only 1 Control Room node in the environment (Standalone mode set up)
CR server FQDN and/OR DNS Alias name in CN of the Subject field of the certificate
CR server FQDN and/OR DNS Alias name in Subject Alternative Name (SAN) field of the certificate.
