Certificates

On your Server Settings page there are two tables with certificate information. Both tables will contain at least one certificate to ensure a normal operation of your systems.

List of all available Server Certificates

The first table shows all available certificates your RADIUS server is able to use.

List of allowed RadSec Connection Certificates

The second table contains all certificates that are allowed to establish a RadSec connection.

Server Certificates

Default Certificates

By default, RADIUSaaS generates a RADIUS server certificate signed by a Certificate Authority (CA) that is available on our service solely for this very purpose. We refer to it as the Customer-CA. The Customer-CA is unique for each customer.

Customer-CAs

To create your Customer-CA, follow these simple steps:

  1. Click Add

  2. Choose Let RaaS create a CA for you

  3. Click on Create

  1. After the creation, you will see a new certificate available in your table:

Bring your own Certificate

In case you do not want to use any of the standard certificates which we are providing, you can upload up to two of your own certificates.

SCEPman Server Certificate

You may leverage SCEPman Certificate Master to generate a server certificate for you. Please follow those steps:

  1. Navigate to your SCEPman Certificate Master web portal.

  2. Generate a server certificate as described here and provide any FQDN you want. We recommend to adapt the SAN of the default server certificate, e.g. radsec-<your RADIUSaaS instance name>.radius-as-a-service.com.

  3. Set the Download file format to PEM with certificate chain and download the certificate. Important: Take temporary note of the password since it cannot be recovered from Certificate Master.

  4. Navigate to your RADIUSaaS instance and upload the server certificate file. Subsequently, provide the password and click Save.

Please note: By default, SCEPman Certificate Master issues certificates that are valid for 730 days. If you'd like to change this, please refer to SCEPman's documentation.

Add the Certificate

To add your own server certificate, e.g. one issued by SCEPman, please follow those steps.

  1. Click Add

  2. Choose PEM encoded Certificate

  3. Copy & Paste your certificate or use the Browse File option

  4. Enter the password of your Private Key

  5. Click Save

Certificate Activation

As certificates expire from time to time or your preference on which certificates you would like to use change, it is important that you can control the certificate that your server is using. The Active column shows you the certificate your server is currently using. To change the certificate your server is using, expand the row of the certificate you would like to choose and click Activate.

Download

To download your Server Certificate click Download in the corresponding row.

It will open a dialog, and show the complete certificate path. The root certificate will always be marked in green.

RadSec Connection Certificates

RadSec itself works with certificate authentication as well. Hence, your RADIUS server has to know who is allowed to establish a valid RadSec connection. Due to this requirement, you will always see at least one certificate in this table, which is the one related to your RADIUS proxy. To ensure that your proxies are able to start up properly and are able to establish a connection to your instance, you cannot delete it.

Add a new Certificate

To allow new clients to establish a RadSec connection to your instance, follow these steps:

  1. Click Add

  2. Copy & Paste your certificate (or the CA that has issued it) or use the Browse File option

  3. Click Save

After this you should see your imported certificate in your table.

Delete

To delete a certificate, expand the corresponding row, click Delete and confirm your choice.

Certificate Expiration

Certificates will expire from time to time. Five months before your certificate is going to be expired, you dashboard will give you a hint that your certificate is about to expire.

If you're seeing this triangle, follow this guide how you can change your server certificate:

pageServer Certificate Renewal

Last updated