Security Compliance

Replacing the certificates used to encrypt communication between ARM server and collectors

This article explains how to use the OpenSSL tool to create a suitable self-signed certificate for communication between the ARM server and collector, and how to replace the existing certificates.

First published date

9/28/2020 12:20 PM

Last published date

10/23/2025 3:10 PM

Overview

ARM version 2020.2.2 introduced a new communication layer based on gRPC. From this version on, communication between ARM server and collectors is encrypted by default. 
Optionally, you can replace the certificates used by ARM by default with self-created ones.
This article describes
  • what requirements the certificate must meet,
  • how to create an appropriate certificate using OpenSSL,
  • how to replace the existing certificates.

Product section

Access Rights Manager

Cause

The previous methods that were valid until version 2020.2.1 to encrypt the communication between ARM Server and collectors are no longer applicable. Starting with version 2020.2.2, communication between ARM Server and collectors is encrypted by default.

Resolution

You can replace the certificates that ARM Server uses by default with certificates that you create yourself, for example, because company policies require it.

Certificate requirements

  • The files need to be present in PEM format.
    • server.pem - file contains only the public key
    • server_private_key.pem - file contains the public and the private key
  • The attribute "Subject Alternative Name" has to contain all required hostnames. 
  • ARM requires at least the single machine name and the FQDN, for instance: 
    • arm-srv-001
    • arm-srv-001.DNS.name.local
  • The certificate must not be protected by a passphrase. The ARM service cannot load protected certificates and therefore the ARM server does not start.

Create a suitable certificate
To create a certificate using the OpenSSL tool, proceed as follows::
 
  • Create the file "ssl.conf". The content of the file should be: 
    [req]
distinguished_name = distinguished_name
x509_extensions = v3_req
prompt = no
[distinguished_name]
C = DE
ST = BER
L = Berlin
O = SW
OU = Support
CN = armserver.arm.local
[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = armserver
DNS.2 = armserver.arm.local
  • Adjust the fields according to your environment. It is essential that the values in distinguished_name and alt_names are correct..
  • Use this OpenSSL command to create certificate files: 
    openssl req -x509 -newkey rsa:4096 -keyout server_private_key.pem -out server.pem -days 10000 -nodes -config ssl.conf

Replace existing certificates
The certificates are stored under the following path:
C:\ProgramData\protected-networks.com\8MAN\cfg\security\server
  • Replace the existing certificates in the folder with the new ones you created.
  • Restart the ARM service to apply the changes.