Sign in to Next-Gen Trust Security.
Click Insights > Certificate Installations > Machines.
Click the more options button at the end of the machine's row, and then select Provision.
In Search a certificate by name, expiration or fingerprint, enter part of the certificate's name, expiration date, or fingerprint, and then select the certificate from the results. Confirm that it's the right certificate by checking Subject DN, Validity, and Certificate SHA1 Fingerprint.
The rest of the Provision a certificate dialog appears after you select a certificate.
Under Certificate Information, in Application Domain, enter the name of the application domain. To use the default domain, enter default.
In Certificate Name, enter the name of the CryptoCertificate object. If the domain has no object with this name, Next-Gen Trust Security creates it. If it has one, Next-Gen Trust Security points it to the new certificate file. To replace a certificate that a profile already uses, enter the name of its existing CryptoCertificate object.
(Optional) In Key Name, enter the name of the CryptoKey object. Next-Gen Trust Security creates or updates it the same way.
In Certificate File Path, enter the filestore path for the certificate file, for example cert:///server.pem. If you enter only a file name, Next-Gen Trust Security stores the file in the cert: directory. The file holds the certificate and its issuing chain, and it replaces any file already at that path.
(Optional) In Key File Path, enter the filestore path for the private key file, for example cert:///server-key.pem.
Note: Next-Gen Trust Security uploads the private key only if you enter a Key File Path. It creates or updates the CryptoKey object only if you enter both Key Name and Key File Path.
Under Installation Endpoint, for Certificate Usage Type, choose how the gateway uses the certificate:
(Optional) In SSL Profile / Credential Name, enter the name of the SSLServerProfile, SSLClientProfile, or CryptoIdentCred object that uses the certificate.
(Optional) In Identity Credential, enter the name of the CryptoIdentCred object that uses the certificate.
(Optional) If you chose HTTPS Listener, in HTTPS Front-Side Handler, enter the name of the front-side handler that uses the certificate.
(Optional) If you chose HTTPS Listener, in Listener Port, enter the port the handler listens on.
(Optional) If you chose HTTPS Listener, in Multi-Protocol Gateway, enter the name of the Multi-Protocol Gateway service that uses the handler.
Note: The binding fields record where the certificate is used. Next-Gen Trust Security doesn't change the profiles, credentials, handlers, or services that you name.
(Optional) To save the installation without pushing the certificate now, disable Push certificate on save.
Click Save. To save and then provision another certificate, click Save & New.
After you save, Next-Gen Trust Security uploads the files, creates or updates the CryptoCertificate and CryptoKey objects, and then saves the application domain's configuration so the change persists after the gateway restarts. An installation appears on the machine's
Installations tab. To provision on a schedule instead of right away, set up a
machine provisioning schedule.
