Configure Certificates

Certificates and Access Gateway

Certificates are made available for use to the Access Gateway and it’s applications in two ways:

• Certificates are generated when an application is created. Generated certificates are self-signed and mainly used for initial configuration of the application in non-production environments.
  
  

  Note

  Generated certificates should not be used in production environments

• Certificates are loaded using the Access Gateway management console. When new certificates are loaded for the same domainA domain is an attribute of an Okta organization. Okta uses a fully-qualified domain name, meaning it always includes the top-level domain (.com, .eu, etc.), but does not include the protocol (https). they overwrite any existing certificate. If no certificate exists, then the certificate is stored.

When creating an application, the following logic is used to associate certificates with the new application.

1. If a certificate already exist for the application domain, then the application uses the existing certificate.
   The certificate could have been created automatically, or loaded through the management console.

2. If the certificate doesn’t exist, then a self-signed wildcard or hostname certificate is created and associated with the application.

Topics

1. Auto Generated Self-Signed Certificates

2. Configuring Apps with Hostname Certificates

Auto Generated Self-Signed Certificates

When an application is created and no certificate has been loaded that corresponds to the application’s domain a certificate is generated. The following sections show how to create applications using wildcard and hostname certificates.

To use an auto-generated wildcard certificate in the Access Gateway:

1. In a web browser, log in to the Access Gateway AdminAn abbreviation of administrator. This is the individual(s) who have access to the Okta Administrator Dashboard. They control the provisioning and deprovisioning of end users, the assigning of apps, the resetting of passwords, and the overall end user experience. Only administrators have the Administration button on the upper right side of the My Applications page. console.

2. Select the Applications tab.

3. Click the pencil icon in the row containing the application which should be associated with the certificate.
   In this tutorial we use the Sample Header AppAn abbreviation of application. Essentially, it is a web-based site used to perform any number of specific tasks, and requires authentication from end users by signing in..
   

4. In the Settings tab expand Advanced

5. Ensure the Certificate Type toggle is disabled.
   

6. Click Done.

7. In the same row click the Goto Application icon.
   
   >Note: Your Okta tenant administrator will need to assign the sample application to you.

   Generated certificates should not be used in production environments

8. When the application is reached click the Not Secure nex to the application URL.
   

   

   Note

   This tutorial uses Google Chrome. Other browsers have similar functionality but may use different steps.

9. Click Certificate.
   

   The certificate associated with the application is then displayed.
   

   

   Note

   With wildcard certificates, the domain shown in the Issued to: field is prefixed by an * (asterisk) to show this certificate can be used for any hostname that is in the applications domain.
   Note the Issued by: field, indicating this is a self signed certificate.

Configuring Apps with Hostname Certificates

To use an auto-generated hostname certificate in the Okta Access Gateway:

1. In a web browser, log in to the Access Gateway Admin console.

2. Select the Applications tab.

3. In the Settings tab expand Advanced

4. Ensure the Certificate Type toggle is enabled.
   

5. In the same row click the Goto Application icon.
   
   

   

   Note

   Your Okta tenant administrator will need to assign the sample application to you..

6. Click Done.

7. In the same row click the Goto Application icon.

8. When the application is reached click the Not Secure button to the left of the application URL.
   

9. Click Certificate.
   

Note: For hostname certificates, the domain shown in the “Issued to:” field shows the fully qualified domain name (FQDNA fully qualified domain name (FQDN) is the complete domain name for a specific computer, or host, on the internet.) of the host server.

Adding Certificates and Replacing an Auto-Generated Certificate with a Valid Certificate

The steps below show how the command line console can beused to replace an automatically generated certificate with a user supplied certificate.

Note

User supplied certificates are normally issued and signed by a trusted CA, but can also be a self-signed.

1. Using SSH connect to the Access Gateway command line console. For a complete list of command line console command see here.

2. Enter 2 to enter the Services sub-menu.

3. Enter 1 to enter the NGINXNginx is a web server which can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache. sub-menu.

4. Enter 6 to update an SSL certificate.
   All existing certificates will be displayed and will resemble:
   

   Available Certificates:
   -----------------------
   [1] admin.crt
   [2] gateway_info.crt
   [3] localhost.crt
   . . . 
   [a] Add new certificate
   [x] Exit
   [#, a, x]: 
   

5. .Select a command to perform:

   1. x - Exit the add/modify certificates sub-menu.
   2. a - Add a new certificate.
   3. # - Modify an existing certificate.

Add a new certificate

Certificates are added via cut and paste operations.

Note

Both the certificate and the key must be in PEM format.

Note

Depending on your OS the command sequence for copy/paste may be different.
This applies only to copy/paste operations and not completing the entry of certificate contents.

1. In a text editor open the new certificate file.
2. Within the editor select and copy the contents of the certificate file.
3. Return to the command line console and paste the certificate file contents.
   
4. Press [ctrl][d] to save the certificate contents.
   

   Note

   The command line console will then open a new editor for the certificates associated key contents.

5. In a text editor open the key file.
6. Within the editor select and copy the contents of the key
7. Return to the command line console and paste the key file contents.
   
8. When complete, press [ctrl][d] to save the key contents. .

Note

The hostname and certificate type will be pulled automatically for the certificate.

If an existing certificate is being updated, a prompt showing A certificate for this domain already exists, do you wish to replace it? [Y,N] will be presented. To proceed with the certificate update, press the y , followed by Enter.

Note

Replacement certificates can be verified by launching the associated application, in the Admin Console, and following the steps to view the web page's certificate as described above. .

Modify an existing certificate

When modifying an existing certificate you will be presented with three options:

• [d] - Delete certificate
• [u] - Update certificate
• [x] - Return without change.

To exit without change enter x.

To update a certificate, enter u.
Follow the prompts to copy and paste the replacement certificates key and certificate file, both of which must be in PEM format.

To delete a certificate, enter d.
Follow the prompt to confirm the delete or cancel.