Add a certificate to an Advanced Server Access gateway

This topic explains how to create a certificate for using LDAP and RDP options on an Advanced Server Access gateways. This certificate must be PEM (Base-64) encoded and include the public key of the Root Certification Authority (Root CA) used to issue certificates to domain computers. This process requires admin permissions on the Active Directory (AD) domain and the gateway.

Additionally, you must also create a server authentication certificate on your Windows device.

Apply this configuration only if enterprise-managed certificates are already in place in the RDP listener. By default, this configuration uses a self-signed certificate.

  1. Access the Root CA domain certificate.
    1. Sign in to the Root CA for the domain.
    2. Go to StartAdministrative ToolsCertification Authority.
    3. Right-click the Certification Authority in the left panel and select Properties. A properties window opens.
    4. In the General tab, click View Certificate. The Certificate window opens.
    5. In the Details tab, click Copy to file.
  2. Export the certificate.
    1. From the Certificate Export Wizard, click Next.
    2. Select Base-64 encoded X.509 and click Next.
    3. Click Browse to specify a path, and then click Next.
      Okta recommends that teams use a standard naming structure that allows them to easily identify the exported certificate.
    4. Click Finish.
  3. Open the exported certificate and copy the content.
  4. Configure the Advanced Server Access gateway.
    1. Sign in to the gateway.
    2. Create a new trusted certs directory.
      mkdir -p /etc/sft/trustedcerts
    3. Create a certificate file.
      touch /etc/sft/trustedcerts/<domainname>.pem
    4. Open the created file and paste the content from the exported AD certificate.
    5. Configure the TrustedCAsDir option for RDP and LDAP. See Configure the Advanced Server Access gateway.
    6. Restart the sft-gatewayd service.

Create a Server Authentication Certification

Follow the steps in Create a Server Authentication certificate topic in the Microsoft documentation. The steps may differ depending on the version of Windows you're using.