This document provides information about the Publishing profiles report screen, which displays information about all publishing profiles supported by Segura™ Platform.
Path to access
- On Segura™ Platform, in the navigation bar, hover over the Products menu and select Certificate Manager.
- In the side menu, select Publishing > Publishing profiles.
Actions menu
| Item |
Type |
Description |
| Add |
Dropdown menu |
Adds a publishing profile. The profiles are: Apache, Nginx, IIS, Tomcat, F5 BigIP, IBM Websphere, Palo Alto, Windows, Kubernetes, NetScaler, Microsoft Azure, and CURL. |
| Actions |
Dropdown menu |
Displays the options: Print report, Export CSV, and Schedule report. |
Search fields
| Item |
Type |
Description |
| ID |
Text field |
Filters all profiles by the ID. |
| Profile name |
Text field |
Filters all profiles by the profile's name. |
| Profile type |
Dropdown menu |
Filters all profiles by the profile's type. The options are: Apache, Nginx, IIS, Tomcat, F5 BigIP, IBM Websphere, Palo Alto, Windows, Kubernetes, NetScaler, Microsoft Azure, and CURL. |
| Status |
Dropdown menu |
Filters all profiles by the status. The options are: Disabled and Enabled. |
Report fields
- ID.
- Profile name.
- Profile type.
- Server: displays the number of devices connected to the profile.
- Status.
- Actions:
- Edit: opens the Add a publishing profile screen along with the tabs of the respective publishing profile.
- Enable/Disable: displays a pop-up to confirm the activation or deactivation of the profile.
Info
By default, the report displays 30 records per screen. To go to the next screen, click the forward buttons at the end of the report.
Add publishing profile
This section provides information about the Settings, Devices, and Review tabs that are shared between all publishing profiles.
Settings tab
| Item |
Type |
Required |
Description |
| Profile name * |
Text field |
Yes |
Profile name. |
Credential for execution
| Item |
Type |
Required |
Description |
| Use a registered credential to access all devices |
Checkbox |
No |
Uses a registered credential to access all devices. |
| Access credential registered in the system |
Dropdown menu |
No |
Access credential. This field is only unlocked if the checkbox Use a registered credential to access all devices is checked. |
| Credential username |
Text field |
No |
Username of the credential that the profile will run. |
Devices tab
| Item |
Type |
Required |
Description |
| Add / Remove selected |
Button |
No |
Add or remove the selected devices. |
| Devices table |
Table |
No |
The fields of the table are: ID, Device name, Management, Type, Vendor, Product, Site, Tag, and Network Connector. |
| ID |
Text field |
No |
Device’s ID. |
| Device name |
Text field |
No |
Device’s name. |
| Management |
Text field |
No |
Device’s IP. |
| Type |
Text field |
No |
Device’s type. |
| Vendor |
Text field |
No |
Device’s vendor. |
| Product |
Text field |
No |
Device’s product. |
| Site |
Text field |
No |
Device’s site. |
| Tag |
Text field |
No |
Device’s tag. |
| Network Connector |
Text field |
No |
Yes or No, depending on whether the device has its own Network Connector agent configured. |
Review tab
Use the Review tab to check all the information entered in the previous tabs, including the Network Connector column from the Devices tab.
Publishing profiles
This section provides information about the configuration tab of each publishing profile.
Apache
Apache plugin configuration
| Item |
Type |
Required |
Description |
| Site |
Text field |
No |
Name of the site to which the SSL certificate will be applied to. This field is not used to publish: Segura® uses only the Configuration file path field. |
| Configuration file path |
Text field |
No |
Path to the Apache’s configuration file. For example: /etc/apache2/sites-available/exemplo.conf for Linux based systems. If the configuration file is not provided, the certificate will be installed on the default Apache site. |
| Port |
Text field |
No |
Port Segura® uses for the post-publication check of the certificate. The default port is 443. |
Nginx
Nginx plugin configuration
| Item |
Type |
Required |
Description |
| Site |
Text field |
No |
Name of the website for which the SSL certificate will be applied. |
| Configuration file path |
Text field |
No |
Path to the configuration file in Nginx. For example: /etc/nginx/sites-available/exemplo.conf. If the configuration file is not provided, the certificate will be installed on the default Nginx website. |
| Port |
Text field |
No |
Port Segura® uses for the post-publication check of the certificate. The default port is 443. |
| Delete password file after publication (if the file exists) |
Dropdown menu |
No |
Indicates whether the file containing the password used to publish the certificate should be deleted after the process is complete. The options are: Yes and No. |
| Use sudo? |
Checkbox |
No |
Uses the sudo command. |
IIS
IIS plugin configuration
| Item |
Type |
Required |
Description |
| Access port WinRM |
Text field |
No |
Port number used to connect via Windows Remote Management (WinRM). Port 5985 for WinRM HTTP, and port 5986 for WinRM HTTPS. The default is 5986. This port overrides the port of the device's WinRM connectivity. |
| Site name |
Text field |
No |
Name of the website for which the SSL certificate will be applied. Required to publish, even though the form does not mark it as required. |
| Site port |
Text field |
No |
Port of the existing HTTPS binding on the site. The default port is 443. |
| Certstore name |
Text field |
No |
Name of the Windows certificate store used by your website where the SSL certificate will be stored. The default is MY. |
Attention
The automatic certificate publishing feature using the IIS plugin requires Windows Server 2019 or a later version. If you are using a legacy system, you must upgrade to version 2019 or above to ensure compatibility.
Tomcat
Tomcat plugin configuration
| Item |
Type |
Required |
Description |
| Keystore name |
Text field |
No |
Full path of the keystore where SSL certificates will be stored. For example: /opt/tomcat9/keystore.jks. |
| Alias certificate |
Text field |
No |
Unique identifier for the certificate within the keystore. |
| Password keystore |
Dropdown menu |
No |
Password required to access and modify the keystore. |
| Way of the intermediate certificate |
Text field |
No |
Path to the intermediate certificate file if needed to complete the certification chain. |
| Configuration file path (server.xml) |
Text field |
No |
Path to the Tomcat's server.xml file where SSL settings are defined. Required if Keystore name, Alias certificate, or Password keystore is empty. If all three are filled in, Segura® publishes directly to the keystore and ignores server.xml. |
| Tomcat version |
Dropdown menu |
No |
Version of Tomcat that the server is running. |
| Port |
Text field |
No |
Port Segura® uses to check the server after publication. If the fingerprints differ, the publication fails. If the server does not respond, the publication still completes and the execution log records a warning. If you leave the field empty, Segura® skips this check. |
F5 BigIP
F5 BigIP plugin configuration
| Item |
Type |
Required |
Description |
| Certificate Name |
Text field |
No |
Base name of the certificate on the F5. Required to publish, even though the form does not mark it as required. The certificate is installed as <name>_<YYYYMMDD> (expiration date), with a serial-number suffix if that name already exists, and the chain as <name>_chain. |
| Port for access via SOAP (F5 / BigIP) |
Text field |
No |
Not used to publish. Segura® connects on the port of the device's HTTPS connectivity, or HTTP connectivity if there is no HTTPS. |
| Synchronization group |
Text field |
No |
Name of the F5 device group to synchronize the configuration with after publishing. |
| Force overwrite? |
Checkbox |
No |
Forces the configuration synchronization to the synchronization group. Has an effect only when Synchronization group is filled in. |
| Delete existing profiles in VIP? |
Checkbox |
No |
Indicates whether existing SSL profiles on the Virtual IP (VIP) should be removed before applying new ones. |
| Partitions |
Table |
No |
Name(s) of the partitions in F5 where the settings will be applied. At least one partition is required to publish. |
| SSLClient profiles |
Table |
No |
Client SSL profiles, which secure the traffic between clients and the BIG-IP. Each row takes the Full name of virtual server (VIP) and the Full profile name. |
| SSLServer profiles |
Table |
No |
Server SSL profiles, which secure the traffic between the BIG-IP and the pool members. Each row takes the Full name of virtual server (VIP) and the Full profile name. |
IBM Websphere
IBM Websphere plugin configuration
| Item |
Type |
Required |
Description |
| Path of app_server_root websphere |
Text field |
No |
Path to the WebSphere application server root directory. Required to publish. |
| Server port |
Text field |
No |
SSH port used to connect to the IBM WebSphere server. The default is 22. This port overrides the port of the device's SSH connectivity. |
| Path keystore (KDB) |
Text field |
No |
Path to the keystore file (KDB) where certificates are stored. Required to publish. |
| Password keystore |
Dropdown menu |
No |
Password used to access the keystore. Required if Stashed password? is not checked. |
| Label Certificate |
Text field |
No |
Unique identifier of the certificate within the keystore. |
| Standard certificate? |
Checkbox |
No |
Indicates whether the certificate being configured should be set as the default for the server. |
| Stashed password? |
Checkbox |
No |
Indicates whether the keystore password is "stashed" (stored securely), allowing access without manual entry. |
| Use sudo? |
Checkbox |
No |
Runs the commands on the server with sudo. |
| Restart services after publication |
Table |
No |
IBM HTTP Server instances to restart with apachectl after publication. Columns: Service name (HTTPServer), Installation path (default /opt/IBM/HTTPServer), Configuration file (default conf/this_instance.conf), and Service access port (default 443). Does not restart the WebSphere Application Server. Segura® validates only the services listed in this table. |
Palo Alto
Palo Alto plugin configuration
| Item |
Type |
Required |
Description |
| SSL/TLS profile |
Text field |
No |
If the SSL/TLS profile name is new, a new profile will be created. Otherwise, the settings may be changed. If empty, Segura® imports the certificate but cannot link it to an SSL/TLS profile, and you must link it manually on the firewall. |
| Min version |
Dropdown menu |
No |
Sets the oldest version of the TLS protocol that can be accepted. The options are TLSv1.0, TLSv1.1, and TLSv1.2. |
| Max version |
Dropdown menu |
No |
Sets the latest version of the TLS protocol that can be accepted. The options are TLSv1.0, TLSv1.1, TLSv1.2, and Max. Must be equal to or later than Min version. |
Windows
Windows plugin configuration
| Item |
Type |
Required |
Description |
| Store location |
Dropdown menu |
No |
Location of the certificate store in Windows. For example: CurrentUser or LocalMachine. |
| Certstore name |
Dropdown menu |
No |
Name of the repository where the certificate will be stored. The options are AddressBook, AuthRoot, CertificateAuthority, Disallowed, My, Root, TrustedPeople, and TrustedPublisher. |
| Port for access for WinRM |
Text field |
No |
Port number used to connect via Windows Remote Management (WinRM). Port 5985 for WinRM HTTP, and port 5986 for WinRM HTTPS. The default is 5985. |
| Set password |
Checkbox |
No |
When checked, enables Manual input password and disables Certificate password. |
| Certificate password |
Dropdown menu |
No |
Certificate password registered in Segura®. Available only when Set password is not checked. |
| Manual input password |
Text field |
No |
Certificate password entered manually. Available only when Set password is checked. |
Attention
The automatic certificate publishing feature using the Windows plugin requires Windows Server 2019 or a later version. If you are using a legacy system, you must upgrade to version 2019 or above to ensure compatibility.
Kubernetes
Kubernetes plugin configuration
| Item |
Type |
Required |
Description |
| Secrets |
Table |
No |
Secrets that store the certificate. Columns: Secret and Namespace. Each secret must already exist and contain the tls.crt and tls.key keys, as in a secret of type kubernetes.io/tls. |
| Automatic redeploy |
Table |
No |
Resources to redeploy after the secrets are updated. Columns: Type (Deployment, StatefulSet, or DaemonSet), Name, and Namespace. |
NetScaler
NetScaler plugin configuration
| Item |
Type |
Required |
Description |
| File path to save the certificate |
Text field |
No |
Path on the Netscaler system where the SSL certificate will be saved. Defines the location where the certificate is stored for use in SSL configuration. |
| Virtual servers |
Table |
No |
Table to allow certificates to be bound to virtual servers. |
| Service groups |
Table |
No |
Table to allow certificates to be bound to service groups. |
| Services |
Table |
No |
Table to allow certificates to be bound to services. |
Microsoft Azure
Microsoft Azure plugin configuration
| Item |
Type |
Required |
Description |
| Enterprise applications |
Table |
No |
Select Azure’s enterprise applications you want to add. |
CURL
CURL plugin configuration
| Item |
Type |
Required |
Description |
| Execution template |
Dropdown menu |
Yes |
Execution template that describes the request sent to the destination. Only lists templates whose execution type is Certificate publication. |
| Additional information |
Text field |
No |
Value that fills the [#CERT_ADD_INFO#] tag in the execution template. Accepts letters, numbers, dot, hyphen, and underscore only. |