Passwordstate Documentation

KB: How to set up a internal Certificate Authority ​

If you do not intend on accessing Passwordstate from outside your network, the best type of free certificate you can use is one that is generated from an internal Certificate Authority. A Certificate Authority is easy to set up, and is just another "Role" that your Domain Controller provides. Below are some instructions on how to set up a Certificate Authority on your Domain, if you do not already have one:

All steps below are performed on your domain controller.

Open Server Manager, and Add a new Role:

Server Manager

Click Next

Server Manager Wizard

Click Next

Server Manager Wizard 2

Click Next

Server Manager Wizard 3

Select Active Directory Certificate Services

Server Manager Wizard 4

Click Add Features and then click Next

Server Manager Wizard 5

Click Next

Server Manager Wizard 6

Click Next

Server Manager Wizard 7

Select Certificate Authority and click Next

Server Manager Wizard 8

Click Install

Server Manager Wizard 9

When Feature Installation finishes, click Close

Server Manager Wizard 10

Click Notifications and select Click Configure Active Directory Certificate Services

Server Manager 2

Ensure the user you are logged in with is an Enterprise Admin and click Next

Server Manager 3

Select Certificate Authority and click Next

Server Manager 4

Select Enterprise CA and click Next

Server Manager 5

Select Root CA and click Next

Server Manager 6

Select Create New Private Key and click Next

Server Manager 7

Select SHA256, Key Length of 2048 bits, and click Next

Server Manager 8S

Leave all the fields as default, and click Next

Server Manager 9

Choose 5 years for the validity period, or what’s relevant for your organization, and click Next

Server Manager 10

Leave defaults and click Next

Server Manager 11

Click Configure

Server Manager 12

Click Close

Server Manager 13

Now reboot your domain controller, and your Certificate Authority is now configured. You can now create a wildcard certificate that can be used for your Passwordstate website, which will mean any computer joined to your domain will automatically trust the certificate making for a nicer end user experience.

You can also use this certificate for your Browser Based Gateway, if you intend on using that feature inside Passwordstate.

For detailed instructions on how generate a certificate from your Certificate Authority, see this KB Article: Generate a New Certificate from Active Directory Certificate Authority

If you are changing the certificate, you may need to also change the URL of your Passwordstate website.

To be completely trusted, the certificate name needs to match the bindings in IIS, which also needs to match the DNS record you have for your site. This KB Article describes how to change your URL: Changing the Passwordstate URL