How to:

How to configure default IWA root cert for on-premises Centrify Privilege Service to perform cenroll?

Answer:

1) Trust the “root_ca_public_certificate” on the Linux Box:

• On the on-premises CPS server, get the "root_ca_public_certificate.cer" from location: “<installdir>/config”

• Place the certificate to the Linux box and convert the certificate format from “der” to “pem” by running the following command

• Place the pem-format certificate to the following location by running the following command:
  #sudo cat root_ca_public_certificate.pem >> /etc/pki/tls/certs/ca-bundle.crt

2) Create role for computers to perform cenroll:

• On Cloud manager portal, create a new role

• Under Member > Check the “Computer” filter and look up the Linux machine that has been configured with steps above, then add them as member of the role

• Under Administrative Rights > Assign the “Privilege Management” Rights for this role then save

3) Once completed all the steps mentioned above, the Linux machine should be able to perform cenroll successfully.
 
4) For Https IWA, trust the “IwaTrustRoot” certificate on the machines:

• On Cloud Manager portal, download the “IWA root CA Certificate” from the following location:
  Cloud Manager portal -> Settings -> Network -> Cloud Connectors -> Select the Cloud Connector to connect -> Download your IWA root CA certificate

• Place the IWA root CA certificate to the trusted certificate store:
  For RedHat:
  #sudo cp IwaTrustRoot.cer /usr/share/ssl/certs/ca-bundle.crt