Configure Access to certificate private key

Share on twitter
Share on linkedin
Share on facebook
Share on stumbleupon
Share on xing
Share on email
Share on print
Last updated: 2018-07-18

When you run software solutions that make use of TLS secured communication channels the applications need to have access to the certificate's private key. The private key is part of the certificate stored in the local certificate store of the computer. In most cases the software solution creates a new self-signed certificate and configures access rights appropriately.

When establishing TLS communication channels to external partners, the use of a public SSL/TLS certificate is a must have requirement.

The following step-by-step instructions describe how to assign Read permisson for the Email Security Solution Gateway NoSpamProxy. In this case the solution does not utilize a classic service account, but a so-called virtual service account. Virtual service accounts provide a much better access security when executing Windows services.

Step-by-Step Instructions

Step 1

Open the local computers certificate store using the MMC Snap-Ins.

 

Step 2

Select the certificate to use and open the context menu (right click).

SSL Certificate Conext Menu

Select Manage Private Keys to manage the private key permissions.

 

Step 3

Click Add and add the required service accounts.

In this case the virtual service accounts are part of the local computer entity. Select the local computer and not the Active Directory domain as source when searching accounts. Virtual accounts us the prefix NT Service.

Add the follow accounts to configure read access for NoSpamProxy on a server having the Gateway and Intranet role installed.

NT Service\NetatworkMailGatewayIntranetRoleNT Service\NetatworkMailGatewayManagementServiceNT Service\NetatworkMailGatewayGatewayRoleNT Service\NetatworkMailGatewayPrivilegedService

Add the follow accounts to configure read access for NoSpamProxy on a server having the Gateway role installed only.

NT Service\NetatworkMailGatewayManagementServiceNT Service\NetatworkMailGatewayGatewayRoleNT Service\NetatworkMailGatewayPrivilegedService

Add virtual service accounts

Click Check Names to verifiy the existence of the entered service accounts.

 

Step 4

When correctly resolved the accounts names are replaced by theis respective display names. Click OK to add the accounts. 

Resolved service accounts

 

Step 5

Configure read access for all added service accounts and click OK.

Configure read access

The software solution is now capable of accessing the private key of the certificate.

Link

 

 

%d Bloggern gefällt das: