Trust Store

Configuration > Overlays & Security > Security > Trust Store

Starting with Orchestrator 9.7.0, on the Trust Store tab you can manage a single, orchestrated trust store for Orchestrator and EdgeConnect functions that use Certificate Authority (CA) certificates, including IPSec tunnel peer authentications and TLS client connections. The trust store contains:

  • Built-in CA certificates that Orchestrator receives from the Cloud Portal. These are well-known, globally trusted root CA certificates. The CA certificates required to establish trust with the Cloud Portal are included in the built-in certificates.

  • Custom CA certificates that you add.

NOTE: Certificates that are used for WAN Optimization (previously called Boost) should not be added to the Trust Store. These should be added to either the SSL WAN Optimization Certificates tab or the SSL WAN Optimization CA Certificates tab (Configuration > Overlays & Security > SSL for WAN Optimization). For more information see, SSL WAN Optimization Certificates and SSL WAN Optimization CA Certificates.

Each certificate in the trust store can be deployed to or withdrawn from appliances. Only certificates that are deployed are synced to appliances. The trust store can automatically connect to the Cloud Portal daily to check for updates for built-in certificates. For more information, see Enable/Disable Auto Sync With Cloud Portal.

  • You cannot edit or delete built-in certificates. To view information about a built-in certificate, hover over the Actions column and click the info (Details) icon (i).

  • You can edit and delete custom certificates.

  • To test connectivity between Orchestrator and the Cloud Portal and between Orchestrator and all appliances, click Test Connectivity.

  • To add a custom CA certificate, click Add Certificate. For more information, see Add a Custom CA Certificate to the Trust Store.

The following table describes the information shown on the Trust Store tab for each certificate. Some columns are shown by default.

Column Description
Alias Unique identifier for the certificate. For custom certificates, the user enters the alias when the certificate is added to the trust store.
Issuer Trusted CA that issued and signed the certificate.
Issued to Entity that the certificate was issued to.
Expiration Expiration date of the certificate. A red icon displays next to the expiration date for expired certificates before they are removed. A yellow icon displays next to the expiration date for certificates that are expiring in the next 60 days.
Source Indicates how the certificate was added to the trust store.

Built-in – The certificate was added to the trust store from the Cloud Portal.

Custom – A user added the certificate to the trust store.
Sync to appliances Status of a certificate that indicates whether the certificate has been deployed to or withdrawn from appliances.

Deployed – The certificate is synced with all appliances.

Deployment pending – The certificate is ready to sync with appliances but is waiting for Orchestrator to restart.

Withdrawn – The certificate will not be synced with appliances.

Withdrawal pending – The certificate is ready to be withdrawn from appliances but is waiting for Orchestrator to restart.
Date added Date that the certificate was added to the trust store.
Certificate Shows the certificate data in PEM-encoded format.
Certificate hash A unique fixed-length string generated by applying a cryptographic hash function to the CA certificate data.
CA type Role and trust level of the certificate (Root CA or Intermediary CA).
Key type Cryptographic algorithm used to generate the public and private key pair for the certificate.
Key size Length of the cryptographic key used for encryption and signing, measured in bits (for example, 2048 or 4096 bits).
Signature algorithm Cryptographic hash function and algorithm used to authenticate the certificate.
Actions Hover to view available actions for this row (Details, Edit, and Delete). Edit and Delete are not available for Built-in certificates.

Enable/Disable Auto Sync with Cloud Portal

The trust store can automatically connect to the Cloud Portal daily to check for updates for built-in certificates.

  • Click Auto sync on to enable the trust store to automatically connect to the Cloud Portal. If Orchestrator receives updates to built-in certificates from the Cloud Portal, a minor alarm is raised, and you must restart Orchestrator to apply the built-in certificate updates.

  • Click Auto sync off to disable the trust store from syncing with the Cloud Portal.

View Built-In Certificate Details

To view the details of a built-in certificate:

  1. Hover over the Actions column for the certificate and click Details.

    The Certificate Details dialog box opens.

  2. To expand the Certificate field and view the certificate data in PEM-encoded format, click More.

  3. To copy the certificate, click Copy.

To view the details of a custom certificate, hover over the Actions column for the certificate and click Edit to open the Add/Edit Certificate dialog box.

Add a Custom CA Certificate to the Trust Store

NOTE: If you are managing CA certificates in an Orchestrator version earlier than 9.7.0, see Manage Certificates in Orchestrator Versions Earlier than 9.7.0.

To add a custom CA certificate to the trust store:

  1. On the Trust Store tab, click Add certificate.

    The Add/Edit Certificate dialog box opens.

  2. Enter an alias (unique identifier) for the certificate.

  3. In the Certificate field, paste the certificate content.

    If the certificate is valid, the fields in the Certificate details section of the dialog box are populated with the appropriate information.

  4. Click Done to close the Add/Edit Certificate dialog box.

  5. On the Trust Store tab, click Save.

    The system prompts you to confirm the changes you are applying to the trust store.

  6. Click Confirm to apply the changes.

    The certificate appears in the trust store with a status of Deployment pending in the Sync to Applications column.

  7. To sync the certificate with all appliances, you must restart Orchestrator.

    After Orchestrator restarts, the status on the Trust Store tab in the Sync to appliances column should show Deployed.

Deploy/Withdraw a Certificate

Each certificate in the trust store can be deployed to or withdrawn from appliances. Only certificates that are deployed are synced to appliances. CA certificates that are added to the trust store are in Deployment pending state until you restart Orchestrator.

To deploy a certificate:

  1. Find the certificate on the Trust Store tab and in the Sync to appliances column, move the toggle from Withdrawn to Deployment pending.

  2. Restart Orchestrator.

    After Orchestrator restarts, on the Trust Store tab the status for the certificate shown in the Sync to appliances column changes to Deployed. The certificate is now synced to all appliances.

To withdraw a certificate:

  1. Find the certificate on the Trust Store tab and in the Sync to appliances column, move the toggle from Deployed to Withdrawal pending.

  2. Restart Orchestrator.

    After Orchestrator restarts, on the Trust Store tab the status for the certificate shown in the Sync to appliances column changes to Withdrawn. The certificate is now withdrawn from all appliances.

Manage Certificates in Orchestrator Versions Earlier than 9.7.0

Orchestrator versions earlier than 9.7.0 ship with the following:

  • A default trust store with well-known, globally trusted root CA certificates. The default trust store contains Certificate Authority (CA) certificates required to establish trust with the Cloud Portal.

  • A Custom CA Certificate Trust Store.

To manage certificates in Orchestrator versions earlier than 9.7.0:

  • You must add the default root CA certificates from the default trust store to the Custom CA Certificate Trust Store (one-time action).

  • Enterprises deploying self-hosted Orchestrators must install their end entity certificate (HTTPS server certificate) in the Orchestrator instance. If the end entity certificate is not in the collection of default root CA certificates from the default trust store, enterprises must add the root CA certificate associated with the issuer to the Custom CA Certificate Trust Store.

  • If you want your Orchestrator and appliances to establish connectivity with any of the following services, you must add the certificates for these services to the Custom CA Certificate Trust Store:

    • Remote authentication servers, such as OAuth, JWT, or SAML

    • Remote log receivers

    • Netskope

    • Zscaler

    • Azure

    • HPE Aruba Networking ClearPass Policy Manager

NOTE: If you are using Orchestrator as a Service (OaaS), ensure that you have copied the root CA certificates from the default trust store to the Custom CA Certificate Trust Store, and verified communications from the appliances to both Orchestrator and Cloud Portal before you enable the Custom CA Certificate Trust Store.

In Orchestrator versions earlier than 9.7.0, follow these steps to add well-known, globally trusted certificates from the default trust store to the Custom CA Certificate Trust Store:

  1. Click Add Default Certificates.

    The custom trust store is populated with multiple default certificates.

  2. Click Apply Changes.

To enable the custom certificate trust store:

NOTE: You must either add the root CA certificates from the default trust store or upload at least one certificate before you can enable the custom trust store.

  1. Click Test Connectivity to Portal to validate that appliances can successfully connect to Orchestrator and Cloud Portal using the custom CA.

  2. Click the Use Custom Certificate Trust Store check box.

  3. Click Apply Changes.

To add a CA certificate to the custom certificate trust store:

  1. Click Add Certificate to Custom Trust Store.

    The Add/Edit Custom Certificates dialog box opens.

  2. Enter a meaningful alias for the certificate in the Alias field. For example, for an Orchestrator web server certificate use “Orchestrator_HTTPS” or for a Syslog server use “Syslog_HTTPS”.

  3. Paste the root certificate into the Certificate field.

  4. Click Save.

NOTE: After adding root CA certificates to the Custom Trust Store, Orchestrator must be restarted.