Configure Windows

This document provides information on how to configure the Windows publishing profile to make it possible to install and publish certificates.

If the Windows device is not directly reachable from Segura™ Platform, the profile publishes through the Network Connector configured on the device.

Requirements

• A certificate generated and signed by a CA. More information in How to create a request and How to sign a request.
• A credential registered in Segura™ Platform with access to the device. More information on how to configure a credential in Segura™ Platform in How to configure a credential in Segura™ Platform.
• A device registered in Segura™ Platform.
  If the device is not directly reachable from Segura™ Platform, configure a Network Connector on the device before creating the profile. The Network Connector configured on the device always takes precedence over a global Network Connector configured for the environment. More information in How to configure a device.
• A WinRM connectivity on the device. Without it, the publication fails with the error Device without WinRM connectivity.

Configure Windows

To configure Windows, see the following steps:

1. On Segura™ Platform, in the navigation bar, hover over the Products menu and select Certificate Manager.

2. In the side menu, select Publishing > Publishing profiles.

3. Click the actions button and select Windows.

4. In the Settings tab, complete the following fields:

   1. In the Profile name * field, enter the profile's name.
   2. In the Credential username field, enter the credential's name.
   3. Optional: Check the Use a registered credential to access all devices option and, in the Access credential registered in the system field, select the access credential registered in Segura™ Platform to be used.

5. Click Continue.

6. In the Windows tab, complete the following fields:

   1. In the Store location field, select the location of the certificate store in Windows. For example: CurrentUser or LocalMachine.
   2. In the Certstore name field, select the name of the repository where the certificate will be stored. The options are AddressBook, AuthRoot, CertificateAuthority, Disallowed, My, Root, TrustedPeople, and TrustedPublisher.
   3. In the Port for access for WinRM field, enter the port number used to connect via Windows Remote Management (WinRM). Port 5985 is for WinRM HTTP, and port 5986 is for WinRM HTTPS. The default is 5985.
   4. Optional: Set the certificate password in one of the following ways:
      • To enter the password manually, check the Set password option and enter the password in the Manual input password field. The Certificate password field is disabled.
      • To use a password registered in Segura™ Platform, leave the Set password option unchecked and select the password in the Certificate password field. The Manual input password field is disabled.
   Attention

   The automatic certificate publishing feature using the Windows plugin requires Windows Server 2019 or a later version. If you are using a legacy system, you must upgrade to version 2019 or above to ensure compatibility.

7. Click Continue.

8. In the Devices tab, select the Windows server.

   1. The device must be previously registered in Segura™ Platform.
   2. The Network Connector column shows Yes or No, depending on whether the device has its own Network Connector agent configured.

9. In the Review tab, review all information entered previously, and click Save.

Next steps

After configuring the profile, it appears in the Publishing profiles report. Now, you can publish certificates on your Windows server. More information in How to publish a certificate.