Certificates
On your Server Settings page there are two tables with certificate information. Both tables will contain at least one certificate to ensure a normal operation of your systems.
List of all available Server Certificates
The first table shows all available certificates your RADIUS server is able to use.
List of allowed RadSec Connection Certificates
The second table contains all certificates that are allowed to establish a RadSec connection.
Server Certificates
Default Certificates
By default, RADIUSaaS generates a RADIUS server certificate signed by a Certificate Authority (CA) that is available on our service solely for this very purpose. We refer to it as the Customer-CA. The Customer-CA is unique for each customer.
Customer-CAs
To create your Customer-CA, follow these simple steps:
Click Add
Choose Let RaaS create a CA for you
Click on Create
After the creation, you will see a new certificate available in your table:
Bring your own Certificate
In case you do not want to use any of the standard certificates which we are providing, you can upload up to two of your own certificates.
SCEPman Server Certificate
You may leverage SCEPman Certificate Master to generate a server certificate for you. Please follow those steps:
Navigate to your SCEPman Certificate Master web portal.
Generate a server certificate as described here and provide any FQDN you want. We recommend to adapt the SAN of the default server certificate, e.g.
radsec-<your RADIUSaaS instance name>.radius-as-a-service.com.Set the Download file format to PEM with certificate chain and download the certificate. Important: Take temporary note of the password since it cannot be recovered from Certificate Master.
Navigate to your RADIUSaaS instance and upload the server certificate file. Subsequently, provide the password and click Save.
Please note: By default, SCEPman Certificate Master issues certificates that are valid for 730 days. If you'd like to change this, please refer to SCEPman's documentation.
Add the Certificate
To add your own server certificate, e.g. one issued by SCEPman, please follow those steps.
Click Add
Choose PEM encoded Certificate
Copy & Paste your certificate or use the Browse File option
Enter the password of your Private Key
Click Save
Certificate Activation
As certificates expire from time to time or your preference on which certificates you would like to use change, it is important that you can control the certificate that your server is using. The Active column shows you the certificate your server is currently using. To change the certificate your server is using, expand the row of the certificate you would like to choose and click Activate.
Download
To download your Server Certificate click Download in the corresponding row.
It will open a dialog, and show the complete certificate path. The root certificate will always be marked in green.
RadSec Connection Certificates
RadSec itself works with certificate authentication as well. Hence, your RADIUS server has to know who is allowed to establish a valid RadSec connection. Due to this requirement, you will always see at least one certificate in this table, which is the one related to your RADIUS proxy. To ensure that your proxies are able to start up properly and are able to establish a connection to your instance, you cannot delete it.
Add a new Certificate
To allow new clients to establish a RadSec connection to your instance, follow these steps:
Click Add
Copy & Paste your certificate (or the CA that has issued it) or use the Browse File option
Click Save
After this you should see your imported certificate in your table.
Delete
To delete a certificate, expand the corresponding row, click Delete and confirm your choice.
Certificate Expiration
Certificates will expire from time to time. Five months before your certificate is going to be expired, you dashboard will give you a hint that your certificate is about to expire.
If you're seeing this triangle, follow this guide how you can change your server certificate:
Last updated
