Skip to main content

CA Certificates

CA Certificates are digital credentials used to verify the identity of remote systems by validating the TLS Certificates they present. In USP, CA Certificates play a critical role in two contexts:

  • Mutual TLS (mTLS) authentication between the USP Manager and USP Server.
  • TLS-based LDAP server validation when LDAP is used as an inbound authentication source.
info

For more detailed information on CA Certificates beyond what is covered on this page, refer to Certificates.

Before You Begin​

CA Certificates in mTLS Authentication​

USP uses CA Certificates on both ends of the mTLS connection between the USP Manager and USP Server to ensure that each component can verify the identity of the other.

ComponentRole of CA CertificateWhere It's Added
USP ManagerUsed to confirm that the USP Server's TLS Certificate was signed by a trusted authority.Selected in the Proxy Server configuration in the USP Admin UI or via the USP REST API.
USP ServerUsed to confirm that the USP Manager's TLS Certificate was signed by a trusted authority.Referenced in the web.tls.ca field of the USP Server's .hcl configuration file.

CA Certificates in LDAP Server Validation​

When a Rule uses LDAP as the Inbound Authentication Source and connects to the LDAP server over SSL/TLS, a CA Certificate is used to validate the LDAP server's identity.

ComponentRole of CA CertificateWhere It's Added
USP ServerUsed to confirm that the LDAP server's TLS Certificate was signed by a trusted authority.Configured in the LDAP Connection referenced by the Rule.

CA Certificate Administration via USP Admin UI​

Adding a CA Certificate​

To add a CA Certificate, follow these steps:

  1. From the Sidebar, click Authentication > Certificates.
  2. Click CA Certificates.
  3. Click Add CA Certificate.
  4. Complete the details for the new CA Certificate using the Field Descriptions table as a guide.
  5. Click Save.

Field Descriptions​

NameDescriptionSpecificationsRequired
NameThe name of the CA Certificate.
  • Must be unique.
  • Must follow the Standard Naming Pattern.
Yes
DescriptionThe description of the CA Certificate.No
CertificateThe CA Certificate content.Must be in PEM format.Yes

Editing a CA Certificate​

To edit a CA Certificate, follow these steps:

  1. From the Sidebar, click Authentication > Keys.
  2. Click CA Certificates.
  3. Click the Name of the CA Certificate you want to edit.
  4. Click the Edit button above the CA Certificate details.
  5. Edit the details of the CA Certificate using the Field Descriptions table as a guide.
  6. Click Save.
warning

If you modify a CA Certificate that is currently in use by a USP Server instance, the changes will not take effect until you manually apply the updated configuration by pushing it to the server. To apply the changes:

  1. Navigate to Monitoring > Status.
  2. Click the Name of the associated USP Server instance.
  3. Go to the Configuration tab.
  4. Review the pending changes in the Updated Configuration column.
  5. If the changes are correct, click Push Configuration.

CA Certificate Metadata​

CA Certificate details include all parameters given in the Field Descriptions table above, plus the following read-only metadata:

NameDescription
IDUniversally Unique Identifier of this CA Certificate.
EnabledA Boolean value indicating the status of the CA Certificate. The only possible value is true.
CertificateThe CA Certificate content.
Created AtDate and time this CA Certificate was created.
Updated AtDate and time this CA Certificate was last updated.

Deleting a CA Certificate​

To delete a CA Certificate, follow these steps:

  1. From the Sidebar, click Authentication > Keys.
  2. Click CA Certificates.
  3. Click the Name of the CA Certificate you want to delete.
  4. Click the Delete button above the CA Certificate details.
  5. You will be asked to confirm the deletion. Click Delete.
warning

USP Manager prevents deletion of a CA Certificate if it is currently referenced by a Configuration Item.

Additionally, if the CA Certificate is used by a USP Server instance, the updated configuration must be manually applied. To apply the changes:

  1. Navigate to Monitoring > Status.
  2. Click the Name of the associated USP Server instance.
  3. Go to the Configuration tab.
  4. Review the pending changes in the Candidate Configuration - Preview section.
  5. If the changes are correct, click Push Configuration.

The changes do not take effect on the server until this step is completed.