Focus

Next-Gen Trust Security

Create a Common KeyStore Machine

Table of Contents

Create a Common KeyStore Machine

Creating a new machine enables Next-Gen Trust Security to connect directly to application keystores for certificate management. After creating the machine, you can provision certificates to it.

Important: This topic continues the steps started in Create a new machine. Complete that procedure before continuing.

Before You Begin

SSH Protocol

IP address or hostname
Port
Credentials with permission to create, read, and write to the keystore destination
(Optional) Permission to restart services on the target system

Windows Remote Management (WinRM)

IP address or hostname
WinRM port
(Kerberos only) Domain name
(Kerberos only) Key Distribution Center address or hostname
(Kerberos only) Service Principal Name
Credentials with permission to create, read, and write to the keystore destination

Supported Platforms

Windows Server 2019 and 2022
Ubuntu 18.04 LTS or later
Red Hat Enterprise Linux 7.9
Oracle Linux 8 or later

If you have completed the steps in Create a new machine, continue below to configure the Common KeyStore–specific settings.

From Protocol, select SSH or Windows Remote Management.
Tip: Select the section that matches the protocol you are using.

SSH

From Authentication Type, select Password or Private key.
Enter the IP Address/Hostname and Port.
From Credential Type, select Enter Credentials or Select Credentials.
Note: Available credential options depend on your environment configuration.
Enter the required credentials.
Warning: Remember to store your username and password securely when creating a new machine. For security reasons, you will not be able to modify the fields under the "Access" tab without these credentials. This ensures that only authorized individuals can modify these fields.
(Optional) To restart a service after certificate deployment, enter a value in Service Name.
If no service name is provided, the certificate is deployed without triggering a restart.
Click Test Access, then click Continue.

Linux Service Restart Support

The Service Name option is supported only on Linux systems using systemd.

The service name must match a systemd-managed service.
The restart command executed is sudo systemctl restart <service-name>.

Restart behavior does not apply to WinRM-based connections.

Windows Remote Management

Select an authentication method, then follow the applicable steps.

Basic Authentication

Enter the IP Address/Hostname and Port.
Enable Use TLS for WinRM to secure credentials in transit.
Warning: Disabling TLS sends credentials in plaintext.
From Credential Type, select Enter Credentials or Select Credentials.
Enter the required credentials.
Warning: Remember to store your username and password securely when creating a new machine. For security reasons, you will not be able to modify the fields under the "Access" tab without these credentials. This ensures that only authorized individuals can modify these fields.
Click Test Access, then click Create.

Kerberos Authentication

Enter the IP Address/Hostname and WinRM Port.
(Optional) Enable Use TLS for WinRM.
Enter the Domain Name, Key Distribution Center, and Service Principal Name.
From Credential Type, select Enter Credentials or Select Credentials.
Enter the required credentials.
Warning: Remember to store your username and password securely when creating a new machine. For security reasons, you will not be able to modify the fields under the "Access" tab without these credentials. This ensures that only authorized individuals can modify these fields.
Click Test Access, then click Create.

What's Next

Complete discovery and provisioning scheduling. See Create a new machine.
Provision certificates to machines.
Discover certificates on machines.

Create a Microsoft SQL Server Machine

Create a Citrix ADC Machine