Grant certificate requests automatically

Nodes that you manage with HTTPS agents require certificates. Certificates enable nodes to communicate securely with the management server and other nodes. Unless you install the certificates manually, the node requests them from the management server. Before you can start to manage the node, you need to grant this certificate request.

You can configure the certificate server to automatically grant the following types of certificate request:

• Certificate requests that are encrypted with a valid installation key.
• Certificate requests from nodes that the management server recently deployed the HTTPS agent to.
• Certificate requests from specific nodes that you flag (by selecting Automatically grant certificate in the system properties of the node).

To grant certificate requests automatically

1. In the console tree, right-click Operations Manager, and then click ConfigureServer.... The Server Configuration dialog appears.

2. Click Namespaces, and then click Agent Certificate Autogranting. A list of values appears.

3. Set the value of Enable autogranting to True. The management server grants all certificate requests that were made manually using an installation key.

   If you set this value to false, the management server does not grant any certificate requests automatically.

4. Configure one or more of the following options to automatically grant certificate requests from recently deployed or flagged nodes:
   • Certificate requests from nodes with a recently deployed HTTPS agent

     To automatically grant certificate requests from nodes to which the management server recently deployed the HTTPS agent:

     1. Set the value of Enable autogranting by time interval to True.
     2. Set the value of Time interval for autogranting to a number of seconds. The management server automatically grants certificate requests that arrive this number of seconds after the start of the agent deployment job or sooner.
   • Certificate requests from flagged nodes

     To automatically grant certificate requests from specific nodes that you flag:

     1. Set the value of Enable autogranting of flagged nodes to True.
     2. Set the flag to automatically grant certificate requests when you create each node.
        

        Alternatively, to set the flag for an existing node:

        1. In the console tree, right-click a node, and then click Properties. The node properties dialog appears.
        2. Click the System tab.
        3. Select or clear Automatically grant certificate, and then click OK.
   • TIP:
     To change the default value of this flag, set the value of Default for the 'Automatically grant certificate' flag of new nodes in the Server Configuration dialog.
   • Combination mode for recently deployed or flagged nodes

     Set the value of Combination mode of autogranting conditions to AND or OR. Use AND to automatically grant any certificate request that not only arrives in the specified time but also comes from a flagged node. Use OR if certificate requests must meet just one of these criteria.

     For the AND operation to function properly, set both Enable autogranting by time interval and Enable autogranting of flagged nodes to true.

5. Click OK.
6. Use the Windows service manager to restart the OvSecurityServer service.

Related Topics:

• Configure system information for managed nodes
• Request certificates with an installation key
• Request certificates automatically