Info
KeePass Hub
B. Server Configuration
1) Server Port, Network, and OSI Model
2) Certificates
Setting up a Self-Signed Certificate
Let's Encrypt - Free Certificates
Trust Warning
TLS / SSL Policy Errors
3) Installing a 3rd Party Certificate
4) Changing databases for Pleasant Password Server
5) Service Configuration Utility
6) Stopping the Pleasant Password Service
7) Setting up Failover of Pleasant Password Server
8) Custom Branding
Sitemap
Info  >  KeePass Hub  >  B. Server Configuration  >  2) Certificates Page last modified Feb 17 2024, 20:24

Certificates

See why customers choose Pleasant Password Server with a KeePass client

Certificates are a foundation of authentication and security for software and websites. A certificate is used to identify the software or device as trustworthy when it interacts with other software and devices. 

Trust is established by having a well-known Certificate Authority (CA) provide a Certificate, verifying that the software in question has not been tampered with by a third-party. Usually CA's charge a fee in exchange for this service, but there are popular CA's now that provide this service free of charge.

We recommend using a third-party certificate from a reputable CA in your production environment, which provides an additional level of security and safeguards, especially when making your Pleasant Password Server available in an external domain.

For testing, or temporary use, or in some internal environments, it may be appropriate or necessary to create and use Self-Signed Certificates.

Have Questions?  Contact Us!

Sections:

  1. Resolve Certificate Warnings
  2. Get a Certificate
  3. Import a Certificate
  4. Automate Certificate Changes
  5. Distribute Certificates to Other Devices

 

Related:

Resolve Certificate Warnings

Pleasant Password Server comes with a default certificate which validates the software origin.

This certificate should be replaced with a third-party certificate (recommended) before going live with the site. For testing or internal purposes there are other options to remove the security warnings.

Browsers will provide security warnings until Pleasant Password Server is configured with a valid certificate that matches the site domain which is displayed in the browser URL, and is signed by a trusted Certificate Authority.

To resolve these errors, see the information.

   Chrome Browser:
Chrome Certificate Error

   Firefox Browser:Firefox Certificate Error

   Edge Browser:

Edge Certificate Error Picture

   Internet Explorer Browser:

Internet Explorer Certificate Error Picture

 

Resolve Temporarily: 

For temporary use, testing, or in secure internal settings (e.g. connecting to our own computer, on a trusted internal connections), we can choose to continue:

  • Chrome: Click Advanced, and, Proceed to localhost (unsafe)

Resolve Permanently: remove these errors, following the steps below to either:

  • Production: Get a third-party certificate (highly recommended) that is trusted by browsers and devices by default, OR,
  • Test/Internal setting: Generate a certificate (for a test/internal site)
    • Firefox Browser: 
      • Choose to "add a permanent certificate exception" in your browser
      • This is necessary if the browser does not trust your certificate's Certificate Authority (CA)

Get a Certificate

Certificate Types

Production sites should use a Third-Party Certificate. This establishes a very high level of trust with your users.

  • Third-Party Certificate

    • Request and purchase a certificate from a trusted Certificate Authority (CA). This option provides a high level of trust as the CA verifies your domain and sometimes your organization.

  • Let's Encrypt Certificate

    • Obtain a free certificate from Let's Encrypt, a non-profit CA run by Internet Security Research Group (ISRG) that provides X.509 certificates for Transport Layer Security (TLS) encryption at no charge.

  • Self-Signed Certificate

    • Generate a Certificate and Certificate Authority. While this option is not recommended for a production environment due to the lack of third-party verification, it can be useful for testing or internal applications.

  • Internal Certificate Management

    • Generate a certificate using your organization's established internal certificate management process. This is typically used in an enterprise environment where the organization operates its own private CA.

Remember to always ensure to keep your private keys secure and renew your certificates before they expire to maintain the integrity and availability of your website.

If you need more information, please Contact Us.

 

Install a Third-Party Certificate

Obtaining a certificate from a third-party is recommended.

Process Overview: 

  1. Fill out a Certificate Signing Request (CSR) and submit it to a trusted Certificate Authority (CA)

    1. The CA will then establish that you own the domain, and have proper control.
    2. Double-check that the CA's certificates are trusted for the device platforms. Trusted Root Certificate Lists: Windows Platform, MacOS Platform, iOS Mobile

  2. Import the certificate

    • Use the Service Config Utility, or using the PowerShell commands (section below)
      • Windows Start menu > Programs > Pleasant Password Server > Service Configuration
      • Get the certificate with private key by:
        • Either export the certificate from the same machine you generated the CSR
        • open mmc (run command), right-click on the certificate, and export with private key
      • If necessary, convert the certificate from the CA to *.pfx, or *.p12 format:
        • Import the certificate with mmc (windows run command), then export into the .pfx format
        • Alternatively, use OpenSSL commands

  3. (With IIS Hosting) Configure the Certificate in the site bindings.

  4. (If necessary) Distribute the public certificate to other devices

Install a Self-Signed Certificate

Only use temporarily, for testing, or in secure internal environments.

Security Considerations:

  • Self-Signed Certificates, are generally considered a less secure option than Third Party Certificates. Microsoft warns that self-signed certificates are more susceptible to man-in-the-middle attacks, not suitable for a production server environment or for sites connected to the internet.

Process Overview:

  1. Generate a certificate using this detailed guide.

  2. Then, upload the certificate with the Service Configuration utility or using the PowerShell commands (section below)

    • Windows Start menu > Programs > Pleasant Password Server > Service Configuration

  3. Distribute the public certificate to other devices

Import a Certificate

To change the Certificate that Password Server uses, run the Pleasant Service Configuration Utility that was packaged and installed with the server.

Follow these steps:

  1. Start the Service Configuration Utility.

    • Windows Start menu > Pleasant Password Server -> Service Configuration

  2. Click Certificate Configuration -> Click Import Certificate

  3. Browse for and select the Certificate file (must be a *.pfx or *.p12 private key certificate file):

    • If necessary, convert the Certificate to *.pfx, or *.p12 format, by either:
      • Using mmc run command, first import the certificate, then export into the pfx format
      • Using OpenSSL commands

  4. Enter the password for your certificate.

  5. Restart the Password Server service (click here for instructions).

  6. Navigate to the server URL in your browser.

    • Note: that sometimes browsers or devices may cache the old certificate, and so you may find the warning persists temporarily. In this case, double-check from a incognito tab or by refreshing the browser cache.

Clear Certificate:

The Certificate used can be reverted back to the default placeholder certificate at any time by clicking the Clear button within the Certificate Configuration section of the Service Configuration Utility.

This setting will persist through future updates of Pleasant Password Server.

Change Certificates with PowerShell Commands

Here is some PowerShell commands that can be used to change certificates when you are renewing a certificate or adding a certificate for the first time. The certificate name and location will also be set in the registry. Change the values in the scripts, such as certificate name, user name, password.

  • PowerShell commands:

# Stop service
Stop-Service "Pleasant Password Server"

# Restart service
Restart-Service "Pleasant Password Server"

# List your Certificates; Also checks if the certificate path is accessible
Get-ChildItem Cert:\LocalMachine\My

# Check if registry points at correct certificate
Get-ItemProperty "HKLM:\Software\Pleasant Solutions\PasswordManager"

# Delete previous certificate, in case it's a renewal
Get-ChildItem Cert:\LocalMachine\My | Where-Object {$_.Subject -Like "CN=PasswordServer-Production-Certificate*" } | Remove-Item

# Import new certificate
Import-PfxCertificate -FilePath New-Certificate.pfx -CertStoreLocation Cert:\LocalMachine\My -Password (Get-Credential -UserName "PFX" -Message "PFX Password").Password

# Update registry to point at correct certificate, if needed
Set-ItemProperty "HKLM:\Software\Pleasant Solutions\PasswordManager" -Name CertificateName -Value "PasswordServer-Production-Certificate"
Set-ItemProperty "HKLM:\Software\Pleasant Solutions\PasswordManager" -Name ThumbPrint -Value "63DF81FF0024F999D2A5B077F6152480E6C31F0"

Here is a list of the certificate registry keys:

  • Certificate Registry Settings:

[HKEY_LOCAL_MACHINE\Software\Pleasant Solutions\PasswordManager]
"CertificateName"="PasswordServer_Temporary_Placeholder_Certificate"
"StoreName"="My"
"StoreLocation"="LocalMachine"

Automate Certificate Changes

When using a free site certificate service, you may wish to automate the changing of the certificates which would include the following items in your script:

  1. Get the new certificate

  2. Stop the service (IISExpress) or website (IIS)

  3. Remove the old certificate from the Certificate Store

  4. Put the new certificate into the Certificate Store

  5. Start the service / site again

Distribute the Certificate to Other Devices

The Certificate Authority (CA) of a certificate must be trusted. By default a reputable third-party certificate is already trusted by browsers and devices, but if you have generated a certificate or have an internal CA, then you will need to ensure that the public certificate is distributed to the other networked computer workstations or devices.

This can be done by exporting the public certificate (without the private key) from the Password Server computer and then importing it on other computers.

Some customers may wish to further automate the distribution using scripts or using their directory's Group Policy.

Here are the simple steps.

  1. Open the Microsoft Management Console (MMC).

    • Type mmc.exe in the Start menu search box or open a Run... dialog, type mmc.exe and click OK.

  2. Click File -> Add/Remove Snap-in...

  3. Add the Certificates snap-in.

    • (Windows Vista/7) Click Certificates from the left pane and click Add.
    • (Other Windows versions) Click Add... then select Certificates and click Add.

  4. Select Computer Account and click Next.

  5. Select Local Computer and click Finish.

  6. Exit the open dialog(s).

In the list of folders on the left, the top folder should be Personal followed by Trusted Root Certification Authorities.

These folders represent the various certificate stores for the local computer.

  1. Open Trusted Root Certificate Authorities -> Certificates.

  2. Locate the certificate with your computer name.

  3. Right-click on the certificate and select All Tasks -> Export...

  4. Follow the Certificate Export Wizard to save the certificate file.

    • Select: No, do not export the private key
    • Select: Base-64 encoded X.509 (.cer)

  5. Specify a location and file name for the certificate.

Securely transport the certificate to your other workstation so that it can be imported. Use the MMC Certificate snap-in as above.

  1. Right-click on Trusted Root Certification Authorities and select All Tasks -> Import...

  2. Select your certificate file.

  3. Complete the Certificate Import Wizard.