Managing SSL/TLS automation endpoints

Orchestration gateways are deployed within your internal network to allow SSL certificate auto-installation on added endpoints.

Orchestration gateways can be configured for certificate installation in the following ways:

  • Local — An orchestration gateway is installed on the same host as the endpoint. The orchestration gateway uses local commands to interact with the endpoint software and configuration.

  • Remote — A single orchestration gateway is installed on a central server and configured with the details of the other endpoints on your network. The orchestration gateway uses remote connections that require authentication to interact with the endpoint software and configuration.

Orchestration gateway connection types are limited as outlined in the following table.

Endpoint Type Gateway Installation on Windows OS Gateway Installation on Linux OS Gateway Installation on Docker

Apache 2.4

Remote auto-installation

Local/Remote auto-installation

Remote auto-installation

Tomcat 9.x, 10.x, 11.x

Local/Remote auto-installation

Local/Remote auto-installation

Remote auto-installation

Microsoft IIS 10

Local/Remote auto-installation

Remote auto-installation

Remote auto-installation

Windows certificate store

Local/Remote auto-installation

Remote auto-installation

Remote auto-installation

F5 BIG-IP 15.1, 16.1, 17.1

Remote auto-installation

Remote auto-installation

Remote auto-installation

F5 XC

Remote auto-installation

Remote auto-installation

Remote auto-installation

Imperva

Remote auto-installation

Remote auto-installation

Remote auto-installation

Nginx

Local/Remote auto-installation

Local/Remote auto-installation

Remote auto-installation

P12, JKS, PEM

Local/Remote auto-installation

Local/Remote auto-installation

Remote auto-installation

Citrix

Remote auto-installation

Remote auto-installation

Remote auto-installation

Cloudflare

Remote auto-installation

Remote auto-installation

Remote auto-installation
Windows certificate store, P12, JKS, and PEM endpoints support the use of custom scripts following certificate installation or endpoint restart. For more information, see Custom scripts.

Adding endpoints to an orchestration gateway

Endpoint requirements

  • Microsoft IIS

  • Windows certificate store

  • Apache

  • Apache Tomcat

  • F5 BIG-IP

  • F5 XC

  • Imperva

  • Nginx

  • P12 / JKS / PEM

  • Citrix

  • Cloudflare

To add Microsoft IIS servers to an orchestration gateway, the following requirements must be satisfied:

  • The Microsoft IIS server type is enabled for your account.

  • User is part of local Administrators Group.

To add Windows certificate store endpoints to an orchestration gateway, the following requirements must be satisfied:

  • The Windows certificate store endpoint type is enabled for your account.

  • User is part of local Administrators Group

    • (Optional) When using custom scripts, the following requirements must be satisfied:

    • The script must be manually added to each connected endpoint machine.

    • For local connections, scripts must be run by the root or administrator user.

    • For remote connections, the specified user account must have sufficient permissions to access and execute the custom script on the endpoint machine(s).

To add Apache servers to an orchestration gateway, the following requirements must be satisfied:

  • The Apache server type is enabled for your account.

  • Local:

    • The sectigo-orchestration-gateway service has, by default, all required permissions to manage an Apache web server.

  • Remote:

    • The account specified for remote access must have permissions on the remote Apache web server to do the following:

      • Execute apachectl

      • Read and write site configuration files in ServerRoot

      • Write certificate files to a remote certificates directory (default /var/sectigo-orchestration-gateway-certs)

To add Apache Tomcat servers to an orchestration gateway, the following requirements must be satisfied:

  • The Apache Tomcat server type is enabled for your account.

  • Local:

    • The sectigo-orchestration-gateway service has, by default, all required permissions to manage an Apache Tomcat web server.

  • Remote:

    • The account specified for remote access must have permissions on the remote Apache Tomcat web server to do the following:

      • Start and stop the Apache Tomcat service

      • Read and write site configuration files in the Tomcat installation folder

      • Write JKS certificate files to the Tomcat installation folder

To add F5 BIG-IP endpoints to an orchestration gateway, the following requirements must be satisfied:

  • The F5 BIG-IP endpoint type is enabled for your account.

  • User must have the Administrator role with CLI enabled in the F5 BIG-IP application.

  • User must add a valid certificate and ensure it is trusted by the orchestration gateway machine.

To add F5 XC endpoints to an orchestration gateway, the following requirements must be satisfied:

  • The F5 XC endpoint type is enabled for your account.

  • User must have an F5 XC API token with access to the required namespace.

To add Imperva endpoints to an orchestration gateway, the following requirements must be satisfied:

  • The Imperva endpoint type is enabled for your account.

  • An API ID and API Key are generated in the Imperva management console with the following permissions:

    • View account SSL settings

    • Manage account SSL settings

    • View SSL Certificates

    • Manage custom certificates

    • View delivery settings

After changing permissions, regenerate the API key for the changes to take effect.

  • The Imperva site is created in the Imperva account.

  • Outbound HTTPS access from the orchestration gateway to the Imperva cloud:

    • Certificate metadata API: https://api.imperva.com

    • Sites list and custom certificate upload API: https://my.imperva.com

EC:384 certificates require additional configuration. Contact Imperva Support to enable this option for your Imperva endpoints.

To add Nginx servers to an orchestration gateway, the following requirements must be satisfied:

  • The Nginx server type is enabled for your account.

  • Local:

    • The sectigo-orchestration-gateway service has, by default, all required permissions to manage an Nginx web server.

  • Remote:

    • The account specified for remote access must have permissions on the remote Nginx web server to do the following:

      • Manage the nginx systemd unit, for example by running systemctl reload nginx.service

      • Read and write site configuration files in nginx_config_path (by default /etc/nginx/)

      • Write certificate files to the remote certificates directory (by default the Nginx configuration directory, for example /etc/nginx/)

To add p12, jks, or pem endpoints to an orchestration gateway, the following requirements must be satisfied:

  • The p12, jks, or pem endpoint type is enabled for your account.

  • The required p12, jks, or pem file already exists on the orchestration gateway machine.

    For information about enabling file-based endpoints, contact your Sectigo account manager.

  • (Optional) When using custom scripts, the following requirements must be satisfied:

    • The script must be manually added to each connected endpoint machine.

    • For local connections, scripts must be run by the root or administrator user.

    • For remote connections, the specified user account must have sufficient permissions to access and execute the custom script on the endpoint machine(s).

To add Citrix endpoints to an orchestration gateway, the following requirements must be satisfied:

  • The Citrix endpoint type is enabled for your account.

  • User must have access to a valid Citrix ADC instance.

  • User must have valid credentials for the Citrix ADC instance, including a username and password.

  • User must have a Citrix account with the following permissions:

    • Allowed Management Interface: API

    • Command Policy: partition-admin

Citrix virtual servers support multiple certificates only when Server Name Indication (SNI) is enabled

To add Cloudflare endpoints to an orchestration gateway, the following requirements must be satisfied:

  • A Cloudflare API Token with the following permissions on the target zone(s):

    • Zone: Read

    • SSL and Certificates: Edit

Add an endpoint

Endpoints added through the SCM UI do not currently support credential stores. In order to use credential stores, you must add the endpoint using the CLI. For more information, see Add an endpoint (CLI).

  • Microsoft IIS

  • Windows certificate store

  • Apache

  • Apache Tomcat

  • F5 BIG-IP

  • F5 XC

  • Imperva

  • Nginx

  • P12

  • JKS

  • PEM

  • Citrix

  • Cloudflare

If using WINRM HTTP, WINRM HTTPS, or WINRM HTTPS (INSECURE), WinRM must be configured on the target server. For more information, see Configure WinRM.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints and click the Add icon.

  2. In the Add SSL/TLS Automation Endpoint dialog, complete the details based on the information provided in the following table.

    Field Description

    Orchestration Gateway

    The selected orchestration gateway.

    SSL/TLS Automation Endpoint Type

    The type of the endpoint, based on the platform or certificate storage format.

    Select IIS for Microsoft IIS endpoints.

    Keystore

    The keystore associated with the endpoint.

    Organization

    The organization associated with the endpoint.

    Department

    The department associated with the endpoint.

    Comments

    Any additional comments.

  3. Click Next.

  4. Complete the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    The valid types are:

    • LOCAL

    • SSH(WINDOWS)

    • WINRM HTTP

    • WINRM HTTPS

    • WINRM HTTPS (INSECURE)

    Remote hostname/address

    The hostname or IP address of the target system.

    Remote port

    The remote port.

    Authenticate with

    The authentication method for the remote system.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Required if selecting User/Password for the Authenticate with option.

    Private key file path

    The path to the SSH key file.

    Required if selecting SSH Key for the Authenticate with option.

    Passphrase

    The password for the SSH key.

    Required if selecting SSH Key for the Authenticate with option.

  5. Click Save.

The endpoint should now be listed on the SSL/TLS Automation Endpoints page.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints and click the Add icon.

  2. In the Add SSL/TLS Automation Endpoint dialog, complete the details based on the information provided in the following table.

    Field Description

    Orchestration Gateway

    The selected orchestration gateway.

    SSL/TLS Automation Endpoint Type

    The type of the endpoint, based on the platform or certificate storage format.

    Select WCS for Windows certificate store endpoints.

    Keystore

    The keystore associated with the endpoint.

    Organization

    The organization associated with the endpoint.

    Department

    The department associated with the endpoint.

    Comments

    Any additional comments.

  3. Click Next.

  4. Complete the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Key provider model

    The key storage provider used for the endpoint’s private keys.

    Scope

    Specifies whether the certificate store is created for a specific user or for the entire machine.

    Certificate Store

    The name of the certificate store.

    Whether the private key is exportable

    Specifies whether the private key is exportable.

    Connection Type

    The connection type.

    The valid types are:

    • LOCAL

    • SSH(WINDOWS)

    • WINRM HTTP

    • WINRM HTTPS

    • WINRM HTTPS (INSECURE)

    Remote hostname/address

    The hostname or IP address of the target system.

    Remote port

    The remote port.

    Authenticate with

    The authentication method for the remote system.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Required if selecting User/Password for the Authenticate with option.

    Private key file path

    The path to the SSH key file.

    Required if selecting SSH Key for the Authenticate with option.

    Passphrase

    The password for the SSH key.

    Required if selecting SSH Key for the Authenticate with option.

    Authenticate with

    The authentication method for the remote system.

    Install Script

    The path to the install script.

    For more information about custom scripts, see Custom scripts.

    Restart Script

    The path to the restart script.

    For more information about custom scripts, see Custom scripts.

  5. Click Save.

The endpoint should now be listed on the SSL/TLS Automation Endpoints page.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints and click the Add icon.

  2. In the Add SSL/TLS Automation Endpoint dialog, complete the details based on the information provided in the following table.

    Field Description

    Orchestration Gateway

    The selected orchestration gateway.

    SSL/TLS Automation Endpoint Type

    The type of the endpoint, based on the platform or certificate storage format.

    Select Apache for Apache endpoints.

    Keystore

    The keystore associated with the endpoint.

    Organization

    The organization associated with the endpoint.

    Department

    The department associated with the endpoint.

    Comments

    Any additional comments.

  3. Click Next.

  4. Complete the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    The valid types are:

    • LOCAL

    • SSH

    Certificate storage directory

    The certificate directory.

    Path to apachectl

    The path to the apachectl.

    Remote hostname/address

    The hostname or IP address of the target system.

    Remote port

    The remote port.

    Authenticate with

    The authentication method for the remote system.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Required if selecting User/Password for the Authenticate with option.

    Private key file path

    The path to the SSH key file.

    Required if selecting SSH Key for the Authenticate with option.

    Passphrase

    The password for the SSH key.

    Required if selecting SSH Key for the Authenticate with option.

  5. Click Save.

The endpoint should now be listed on the SSL/TLS Automation Endpoints page.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints and click the Add icon.

  2. In the Add SSL/TLS Automation Endpoint dialog, complete the details based on the information provided in the following table.

    Field Description

    Orchestration Gateway

    The selected orchestration gateway.

    SSL/TLS Automation Endpoint Type

    The type of the endpoint, based on the platform or certificate storage format.

    Select Apache Tomcat for Apache Tomcat endpoints.

    Keystore

    The keystore associated with the endpoint.

    Organization

    The organization associated with the endpoint.

    Department

    The department associated with the endpoint.

    Comments

    Any additional comments.

  3. Click Next.

  4. Complete the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Path to Tomcat directory

    The path to the Tomcat directory, for example, /opt/tomcat.

    Connection Type

    The connection type.

    The valid types are:

    • LOCAL

    • SSH

    • SSH(WINDOWS)

    • WINRM HTTP

    • WINRM HTTPS

    • WINRM HTTPS (INSECURE)

    Remote hostname/address

    The hostname or IP address of the target system.

    Remote port

    The remote port.

    Authenticate with

    The authentication method for the remote system.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Required if selecting User/Password for the Authenticate with option.

    Private key file path

    The path to the SSH key file.

    Required if selecting SSH Key for the Authenticate with option.

    Passphrase

    The password for the SSH key.

    Required if selecting SSH Key for the Authenticate with option.

  5. Click Save.

The endpoint should now be listed on the SSL/TLS Automation Endpoints page.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints and click the Add icon.

  2. In the Add SSL/TLS Automation Endpoint dialog, complete the details based on the information provided in the following table.

    Field Description

    Orchestration Gateway

    The selected orchestration gateway.

    SSL/TLS Automation Endpoint Type

    The type of the endpoint, based on the platform or certificate storage format.

    Select F5 BIG-IP for F5 BIG-IP endpoints.

    Keystore

    The keystore associated with the endpoint.

    Organization

    The organization associated with the endpoint.

    Department

    The department associated with the endpoint.

    Comments

    Any additional comments.

  3. Click Next.

  4. Complete the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    The valid types are:

    • REST

    • REST (Insecure)

    Server hostname

    The server hostname.

    Server port

    The server port.

    Authenticate with

    The authentication method for the remote system.

    Username

    The username for authentication.

    Password

    The password for authentication.

  5. Click Save.

The endpoint should now be listed on the SSL/TLS Automation Endpoints page.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints and click the Add icon.

  2. In the Add SSL/TLS Automation Endpoint dialog, complete the details based on the information provided in the following table.

    Field Description

    Orchestration Gateway

    The selected orchestration gateway.

    SSL/TLS Automation Endpoint Type

    The type of the endpoint, based on the platform or certificate storage format.

    Select F5 XC for F5 XC endpoints.

    Keystore

    The keystore associated with the endpoint.

    Organization

    The organization associated with the endpoint.

    Department

    The department associated with the endpoint.

    Comments

    Any additional comments.

  3. Click Next.

  4. Complete the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    The valid types are:

    • REST

    • REST (Insecure)

    Host

    The server hostname.

    Authenticate with

    The authentication method for the remote system.

    API Token

    The API token.

    Namespace

    The F5 distributed cloud namespace.

    If omitted, it defaults to all the namespaces you have access to.

    Route requires through configured proxy

    Specifies whether to route requests through a configured proxy.

    To add proxy configuration, see Add a proxy.

  5. Click Save.

The endpoint should now be listed on the SSL/TLS Automation Endpoints page.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints and click the Add icon.

  2. In the Add SSL/TLS Automation Endpoint dialog, complete the details based on the information provided in the following table.

    Field Description

    Orchestration Gateway

    The selected orchestration gateway.

    SSL/TLS Automation Endpoint Type

    The type of the endpoint, based on the platform or certificate storage format.

    Select Imperva for Imperva endpoints.

    Keystore

    The keystore associated with the endpoint.

    Organization

    The organization associated with the endpoint.

    Department

    The department associated with the endpoint.

    Comments

    Any additional comments.

  3. Click Next.

  4. Complete the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    The valid types are:

    • REST

    • REST (Insecure)

    Imperva API host

    Overrides the default Imperva certificate-management endpoint. Set it only if Imperva’s endpoint changes or you need to point the gateway at a specific Imperva environment.

    Public-facing HTTPS port

    Public-facing HTTPS port on Imperva sites.

    Authenticate with

    The authentication method for the remote system.

    API ID

    The Imperva API ID.

    API Key

    The Imperva API Key.

    Imperva account ID

    The Imperva account ID.

    Route request through configured proxy

    Specifies whether to route requests through a configured proxy.

    To add proxy configuration, see Add a proxy.

  5. Click Save.

The endpoint should now be listed on the SSL/TLS Automation Endpoints page.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints and click the Add icon.

  2. In the Add SSL/TLS Automation Endpoint dialog, complete the details based on the information provided in the following table.

    Field Description

    Orchestration Gateway

    The selected orchestration gateway.

    SSL/TLS Automation Endpoint Type

    The type of the endpoint, based on the platform or certificate storage format.

    Select Nginx for Nginx endpoints.

    Keystore

    The keystore associated with the endpoint.

    Organization

    The organization associated with the endpoint.

    Department

    The department associated with the endpoint.

    Comments

    Any additional comments.

  3. Click Next.

  4. Complete the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    The valid types are:

    • LOCAL

    • SSH

    Remote hostname/address

    The hostname or IP address of the target system.

    Remote port

    The remote port.

    Authenticate with

    The authentication method for the remote system.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Required if selecting User/Password for the Authenticate with option.

    Private key file path

    The path to the SSH key file.

    Required if selecting SSH Key for the Authenticate with option.

    Passphrase

    The password for the SSH key.

    Required if selecting SSH Key for the Authenticate with option.

    Path to Nginx config file

    The path to the Nginx config file.

  5. Click Save.

The endpoint should now be listed on the SSL/TLS Automation Endpoints page.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints and click the Add icon.

  2. In the Add SSL/TLS Automation Endpoint dialog, complete the details based on the information provided in the following table.

    Field Description

    Orchestration Gateway

    The selected orchestration gateway.

    SSL/TLS Automation Endpoint Type

    The type of the endpoint, based on the platform or certificate storage format.

    Select P12 for P12 endpoints.

    Keystore

    The keystore associated with the endpoint.

    Organization

    The organization associated with the endpoint.

    Department

    The department associated with the endpoint.

    Comments

    Any additional comments.

  3. Click Next.

  4. Complete the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Path

    The path to the keystore or certificate file.

    The filename must be included in this option.

    Keystore password

    The keystore password.

    Connection Type

    The connection type.

    The valid types are:

    • LOCAL

    • SSH

    • SSH(WINDOWS)

    • WINRM HTTP

    • WINRM HTTPS

    • WINRM HTTPS (INSECURE)

    Remote hostname/address

    The hostname or IP address of the target system.

    Remote port

    The remote port.

    Authenticate with

    The authentication method for the remote system.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Required if selecting User/Password for the Authenticate with option.

    Private key file path

    The path to the SSH key file.

    Required if selecting SSH Key for the Authenticate with option.

    Passphrase

    The password for the SSH key.

    Required if selecting SSH Key for the Authenticate with option.

    Install Script

    The path to the install script.

    For more information about custom scripts, see Custom scripts.

    Restart Script

    The path to the restart script.

    For more information about custom scripts, see Custom scripts.

    Is legacy

    Specifies which password-based encryption (PBE) scheme is used to encrypt the PKCS#8 private key inside the PKCS#12 ShroudedKeyBag.

    If toggled on, the legacy PKCS#12 PBE scheme is used. If toggled off, the PKCS#5 PBE scheme is used.

  5. Click Save.

The endpoint should now be listed on the SSL/TLS Automation Endpoints page.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints and click the Add icon.

  2. In the Add SSL/TLS Automation Endpoint dialog, complete the details based on the information provided in the following table.

    Field Description

    Orchestration Gateway

    The selected orchestration gateway.

    SSL/TLS Automation Endpoint Type

    The type of the endpoint, based on the platform or certificate storage format.

    Select JKS for JKS endpoints.

    Keystore

    The keystore associated with the endpoint.

    Organization

    The organization associated with the endpoint.

    Department

    The department associated with the endpoint.

    Comments

    Any additional comments.

  3. Click Next.

  4. Complete the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Path

    The path to the keystore or certificate file.

    The filename must be included in this option.

    Keystore password

    The keystore password.

    Connection Type

    The connection type.

    The valid types are:

    • LOCAL

    • SSH

    • SSH(WINDOWS)

    • WINRM HTTP

    • WINRM HTTPS

    • WINRM HTTPS (INSECURE)

    Remote hostname/address

    The hostname or IP address of the target system.

    Remote port

    The remote port.

    Authenticate with

    The authentication method for the remote system.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Required if selecting User/Password for the Authenticate with option.

    Private key file path

    The path to the SSH key file.

    Required if selecting SSH Key for the Authenticate with option.

    Passphrase

    The password for the SSH key.

    Required if selecting SSH Key for the Authenticate with option.

    Install Script

    The path to the install script.

    For more information about custom scripts, see Custom scripts.

    Restart Script

    The path to the restart script.

    For more information about custom scripts, see Custom scripts.

  5. Click Save.

The endpoint should now be listed on the SSL/TLS Automation Endpoints page.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints and click the Add icon.

  2. In the Add SSL/TLS Automation Endpoint dialog, complete the details based on the information provided in the following table.

    Field Description

    Orchestration Gateway

    The selected orchestration gateway.

    SSL/TLS Automation Endpoint Type

    The type of the endpoint, based on the platform or certificate storage format.

    Select PEM for PEM endpoints.

    Keystore

    The keystore associated with the endpoint.

    Organization

    The organization associated with the endpoint.

    Department

    The department associated with the endpoint.

    Comments

    Any additional comments.

  3. Click Next.

  4. Complete the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Path

    The path to the keystore or certificate file.

    The filename must be included in this option.

    Connection Type

    The connection type.

    The valid types are:

    • LOCAL

    • SSH

    • SSH(WINDOWS)

    • WINRM HTTP

    • WINRM HTTPS

    • WINRM HTTPS (INSECURE)

    Remote hostname/address

    The hostname or IP address of the target system.

    Remote port

    The remote port.

    Authenticate with

    The authentication method for the remote system.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Required if selecting User/Password for the Authenticate with option.

    Private key file path

    The path to the SSH key file.

    Required if selecting SSH Key for the Authenticate with option.

    Passphrase

    The password for the SSH key.

    Required if selecting SSH Key for the Authenticate with option.

    Install Script

    The path to the install script.

    For more information about custom scripts, see Custom scripts.

    Restart Script

    The path to the restart script.

    For more information about custom scripts, see Custom scripts.

  5. Click Save.

The endpoint should now be listed on the SSL/TLS Automation Endpoints page.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints and click the Add icon.

  2. In the Add SSL/TLS Automation Endpoint dialog, complete the details based on the information provided in the following table.

    Field Description

    Orchestration Gateway

    The selected orchestration gateway.

    SSL/TLS Automation Endpoint Type

    The type of the endpoint, based on the platform or certificate storage format.

    Select NetScaler ADC for Citrix endpoints.

    Keystore

    The keystore associated with the endpoint.

    Organization

    The organization associated with the endpoint.

    Department

    The department associated with the endpoint.

    Comments

    Any additional comments.

  3. Click Next.

  4. Complete the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    The valid types are:

    • REST

    • REST (Insecure)

    Server hostname

    The server hostname.

    Server port

    The server port.

    Is running in cloud

    Specifies whether the endpoint is a cloud endpoint.

    Authenticate with

    The authentication method for the remote system.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Route request through configured proxy

    Specifies whether to route requests through a configured proxy.

    For more information about proxy configuration, see Add a proxy.

  5. Click Save.

The endpoint should now be listed on the SSL/TLS Automation Endpoints page.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints and click the Add icon.

  2. In the Add SSL/TLS Automation Endpoint dialog, complete the details based on the information provided in the following table.

    Field Description

    Orchestration Gateway

    The selected orchestration gateway.

    SSL/TLS Automation Endpoint Type

    The type of the endpoint, based on the platform or certificate storage format.

    Select Cloudflare for Cloudflare endpoints.

    Keystore

    The keystore associated with the endpoint.

    Organization

    The organization associated with the endpoint.

    Department

    The department associated with the endpoint.

    Comments

    Any additional comments.

  3. Click Next.

  4. Complete the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    The valid types are:

    • REST

    • REST (Insecure)

    Route request through configured proxy

    Specifies whether to route requests through a configured proxy.

    To add proxy configuration, see Update proxy server details.

    Authenticate with

    The authentication method for the remote system.

    API Token

    The Cloudflare API token.

    Zone ID

    The Cloudflare zone ID.

    If specified, discovery is scoped to this zone only.

    If omitted, all zones accessible by the API token are discovered.

  5. Click Save.

The endpoint should now be listed on the SSL/TLS Automation Endpoints page.

Once an endpoint is added to an orchestration gateway, you must complete the following steps:

  • Delegate the endpoint to the appropriate organization or department. For more information, see Delegate an endpoint.

  • Discover nodes associated with the endpoint. For more information, see Discover nodes.

Add an endpoint (CLI)

  • Microsoft IIS

  • Windows certificate store

  • Apache

  • Apache Tomcat

  • F5 BIG-IP

  • F5 XC

  • Imperva

  • Nginx

  • P12

  • JKS

  • PEM

  • Citrix

  • Cloudflare

If using winrm_http, winrm_https, or winrm_https_insecure, WinRM must be configured on the target server. For more information, see Configure WinRM.

  1. Open the command line.

    If using Windows, you must open the command line as an administrator.

  2. Navigate to the orchestration gateway installation directory.

  3. Modify and run the following command to add a Microsoft IIS server using the orchestration gateway based on your system.

    Remove any unused options from the command.

    The command options are outlined in the following table.

    • Windows

      sectigo-og.exe tls add iis --name <endpoint-name> --connection_type <connection_type> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id>

    • Linux

      ./sectigo-og tls add iis --name <endpoint-name> --connection_type <connection_type> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id>

    • Docker

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og tls add iis --name <endpoint-name> --connection_type <connection_type> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id>
      One of the following authentication options is required when the connection type is not local: --user and --password, --ssh_key_path and --ssh_key_password, or --store and --store_cred_id.
      Option Requirement Description

      --name

      required

      The name of the endpoint.

      Must be between 1 and 32 characters.

      --connection_type

      required

      The connection type.

      The valid types are:

      • local

      • ssh_windows

      • winrm_http

      • winrm_https

      • winrm_https_insecure

      --host

      conditional

      The hostname or IP address of the target system.

      Required if --connection_type is not local.

      Must be between 1 and 255 characters.

      --port

      conditional

      The remote port.

      Required if --connection_type is not local.

      Must be an integer between 1 and 65535.

      --user

      conditional

      The username for authentication.

      Required if username and password authentication is used.

      The username may vary depending on the operating system and the terminal used to execute the CLI.

      For example:

      • Windows (cmd.exe):

        --user scm2022.ccmqa.com\administrator

      • Linux (bash):

        --user 'scm2022.ccmqa.com\administrator'
--user "scm2022.ccmqa.com\\administrator"

      --password

      conditional

      The password for authentication.

      Required if --user is specified.

      --ssh_key_path

      conditional

      The path to the SSH key file.

      Required if SSH key authentication is used.

      --ssh_key_password

      conditional

      The password for the SSH key.

      Required if --ssh_key_path is specified.

      --store

      conditional

      The credential store ID.

      Required if credential store authentication is used.

      --store_cred_id

      conditional

      The credential ID.

      Required if --store is specified.

      --help, -h

      optional

      Displays help information.
      After you run the command, the terminal should return a success message and instance ID.

  4. In SCM, navigate to Integrations  Orchestration Gateways.

  5. Select your orchestration gateway and click Sync Endpoints.

If using winrm_http, winrm_https, or winrm_https_insecure, WinRM must be configured on the target endpoint. For more information, see Configure WinRM.

  1. Open the command line.

    If using Windows, you must open the command line as an administrator.

  2. Navigate to the orchestration gateway installation directory.

  3. Modify and run the following command to add Windows certificate store endpoint using the orchestration gateway based on your system.

    Remove any unused options from the command.

    The command options are outlined in the following table.

    • Windows

      sectigo-og.exe tls add wcs --name <endpoint-name> --key_provider <key-provider> --cert_store <cert-store> --exportable <true-or-false> --connection_type <connection_type> --scope <user-or-machine> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --install_script <custom-install-script-path> --restart_script <custom-restart-script-path>

    • Linux

      ./sectigo-og tls add wcs --name <endpoint-name> --key_provider <key-provider> --cert_store <cert-store> --exportable <true-or-false> --connection_type <connection_type> --scope <user-or-machine> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --install_script <custom-install-script-path> --restart_script <custom-restart-script-path>

    • Docker

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og tls add wcs --name <endpoint-name> --key_provider <key-provider> --cert_store <cert-store> --exportable <true-or-false> --connection_type <connection_type> --scope <user-or-machine> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --install_script <custom-install-script-path> --restart_script <custom-restart-script-path>
      One of the following authentication options is required when the connection type is not local: --user and --password, --ssh_key_path and --ssh_key_password, or --store and --store_cred_id.
      Option Requirement Description

      --name

      required

      The name of the endpoint.

      Must be between 1 and 32 characters.

      --key_provider

      required

      The key storage provider used for the endpoint’s private keys.

      The possible values are:

      • CSP

      • KSP

      --cert_store

      required

      The name of the certificate store.

      --exportable

      required

      Specifies whether the private key is exportable.

      The possible values are:

      • true — The private key is exportable.

      • false — The private key is not exportable.

      --connection_type

      required

      The connection type.

      The valid types are:

      • local

      • ssh

      • ssh_windows

      • winrm_http

      • winrm_https

      • winrm_https_insecure

      --scope

      required

      Specifies whether the certificate store is created for a specific user or for the entire machine.

      The possible values are:

      • user

      • machine

      When using the local connection type, only the machine scope is supported. The user scope is supported for any remote connection type.

      --host

      conditional

      The hostname or IP address of the target system.

      Required if --connection_type is not local.

      Must be between 1 and 255 characters.

      --port

      conditional

      The remote port.

      Required if --connection_type is not local.

      Must be an integer between 1 and 65535.

      --user

      conditional

      The username for authentication.

      Required if username and password authentication is used.

      The username may vary depending on the operating system and the terminal used to execute the CLI.

      For example:

      • Windows (cmd.exe):

        --user scm2022.ccmqa.com\administrator

      • Linux (bash):

        --user 'scm2022.ccmqa.com\administrator'
--user "scm2022.ccmqa.com\\administrator"

      --password

      conditional

      The password for authentication.

      Required if --user is specified.

      --ssh_key_path

      conditional

      The path to the SSH key file.

      Required if SSH key authentication is used.

      --ssh_key_password

      conditional

      The password for the SSH key.

      Required if --ssh_key_path is specified.

      --store

      conditional

      The credential store ID.

      Required if credential store authentication is used.

      --store_cred_id

      conditional

      The credential ID.

      Required if --store is specified.

      --install_script

      optional

      The path to the install script.

      For more information about custom scripts, see Custom scripts.

      --restart_script

      optional

      The path to the restart script.

      For more information about custom scripts, see Custom scripts.

      --help, -h

      optional

      Displays the help information.
      After you run the command, the terminal should return a success message and instance ID.

  4. In SCM, navigate to Integrations  Orchestration Gateways.

  5. Select your orchestration gateway and click Sync Endpoints.

  1. Open the command line.

    If using Windows, you must open the command line as an administrator.

  2. Navigate to the orchestration gateway installation directory.

  3. Modify and run the following command to add an Apache server using the orchestration gateway based on your system.

    Remove any unused options from the command.

    • Windows

      sectigo-og.exe tls add apache --name <endpoint-name> --connection_type <connection_type> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --apachectl_path <apachectl-path> --cert_storage_dir <cert-storage-dir>

    • Linux

      ./sectigo-og tls add apache --name <endpoint-name> --connection_type <connection_type> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --apachectl_path <apachectl-path> --cert_storage_dir <cert-storage-dir>

    • Docker

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og tls add apache --name <endpoint-name> --connection_type <connection_type> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --apachectl_path <apachectl-path> --cert_storage_dir <cert-storage-dir>
      One of the following authentication options is required when the connection type is not local: --user and --password, --ssh_key_path and --ssh_key_password, or --store and --store_cred_id.
      Option Requirement Description

      --name

      required

      The name of the endpoint.

      Must be between 1 and 32 characters.

      --connection_type

      required

      The connection type.

      The valid types are:

      • local

      • ssh

      --host

      conditional

      The hostname or IP address of the target system.

      Required if --connection_type is not local.

      Must be between 1 and 255 characters.

      --port

      conditional

      The remote port.

      Required if --connection_type is not local.

      Must be an integer between 1 and 65535.

      --user

      conditional

      The username for authentication.

      Required if username and password authentication is used.

      The username may vary depending on the operating system and the terminal used to execute the CLI.

      For example:

      • Windows (cmd.exe):

        --user scm2022.ccmqa.com\administrator

      • Linux (bash):

        --user 'scm2022.ccmqa.com\administrator'
--user "scm2022.ccmqa.com\\administrator"

      --password

      conditional

      The password for authentication.

      Required if --user is specified.

      --ssh_key_path

      conditional

      The path to the SSH key file.

      Required if SSH key authentication is used.

      --ssh_key_password

      conditional

      The password for the SSH key.

      Required if --ssh_key_path is specified.

      --store

      conditional

      The credential store ID.

      Required if credential store authentication is used.

      --store_cred_id

      conditional

      The credential ID.

      Required if --store is specified.

      --apachectl_path

      required

      The path to apachectl.

      Must be between 1 and 4096 characters.

      --cert_storage_dir

      required

      The certificate directory.

      Must be between 1 and 4096 characters.

      --help, -h

      optional

      Displays help information.
      After you run the command, the terminal should return a success message and instance ID.

  4. In SCM, navigate to Integrations  Orchestration Gateways.

  5. Select your orchestration gateway and click Sync Endpoints.

  1. Open the command line.

    If using Windows, you must open the command line as an administrator.

  2. Navigate to the orchestration gateway installation directory.

  3. Modify and run the following command to add an Apache Tomcat server using the orchestration gateway based on your system.

    Remove any unused options from the command.

    • Windows

      sectigo-og.exe tls add tomcat --name <endpoint-name> --tomcat_dir <tomcat-path> --connection_type <connection_type> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id>

    • Linux

      ./sectigo-og tls add tomcat --name <endpoint-name> --tomcat_dir <tomcat-path> --connection_type <connection_type> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id>

    • Docker

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og tls add tomcat --name <endpoint-name> --tomcat_dir <tomcat-path> --connection_type <connection_type> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id>
      One of the following authentication options is required when the connection type is not local: --user and --password, --ssh_key_path and --ssh_key_password, or --store and --store_cred_id.
      Option Requirement Description

      --name

      required

      The name of the endpoint.

      Must be between 1 and 32 characters.

      --tomcat_dir

      required

      The path to the Tomcat directory, for example /opt/tomcat.

      Must be at least 1 character long.

      --connection_type

      required

      The connection type.

      The valid types are:

      • local

      • ssh

      • winrm_http

      • winrm_https

      • winrm_https_insecure

      --host

      conditional

      The hostname or IP address of the target system.

      Required if --connection_type is not local.

      Must be between 1 and 255 characters.

      --port

      conditional

      The remote port.

      Required if --connection_type is not local.

      Must be an integer between 1 and 65535.

      --user

      conditional

      The username for authentication.

      Required if username and password authentication is used.

      The username may vary depending on the operating system and the terminal used to execute the CLI.

      For example:

      • Windows (cmd.exe):

        --user scm2022.ccmqa.com\administrator

      • Linux (bash):

        --user 'scm2022.ccmqa.com\administrator'
--user "scm2022.ccmqa.com\\administrator"

      --password

      conditional

      The password for authentication.

      Required if --user is specified.

      --ssh_key_path

      conditional

      The path to the SSH key file.

      Required if SSH key authentication is used.

      --ssh_key_password

      conditional

      The password for the SSH key.

      Required if --ssh_key_path is specified.

      --store

      conditional

      The credential store ID.

      Required if credential store authentication is used.

      --store_cred_id

      conditional

      The credential ID.

      Required if --store is specified.

      --help, -h

      optional

      Displays help information.
      After you run the command, the terminal should return a success message and instance ID.

  4. In SCM, navigate to Integrations  Orchestration Gateway.

  5. Select your orchestration gateway and click Sync Endpoints.

  1. Open the command line.

    If using Windows, you must open the command line as an administrator.

  2. Navigate to the orchestration gateway installation directory.

  3. Modify and run the following command to add an F5 BIG-IP endpoint using the orchestration gateway based on your system.

    Remove any unused options from the command.

    • Windows

      sectigo-og.exe tls add f5 --name <endpoint-name> --connection_type <connection_type> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id>

    • Linux

      ./sectigo-og tls add f5 --name <endpoint-name> --connection_type <connection_type> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id>

    • Docker

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og tls add f5 --name <endpoint-name> --connection_type <connection_type> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id>
      One of the following authentication options is required when the connection type is not rest_insecure: --user and --password, --ssh_key_path and --ssh_key_password, or --store and --store_cred_id.
      Option Requirement Description

      --name

      required

      The name of the endpoint.

      Must be between 1 and 32 characters.

      --connection_type

      required

      The connection type.

      The valid types are:

      • rest

      • rest_insecure

      --host

      conditional

      The server hostname.

      Required if --connection_type is not local.

      Must be between 1 and 255 characters.

      --port

      conditional

      The server port.

      Required if --connection_type is not local.

      Must be an integer between 1 and 65535.

      --user

      conditional

      The username for authentication.

      Required if username and password authentication is used.

      The username may vary depending on the operating system and the terminal used to execute the CLI.

      For example:

      • Windows (cmd.exe):

        --user scm2022.ccmqa.com\administrator

      • Linux (bash):

        --user 'scm2022.ccmqa.com\administrator'
--user "scm2022.ccmqa.com\\administrator"

      --password

      conditional

      The password for authentication.

      Required if --user is specified.

      --ssh_key_path

      conditional

      The path to the SSH key file.

      Required if SSH key authentication is used.

      --ssh_key_password

      conditional

      The password for the SSH key.

      Required if --ssh_key_path is specified.

      --store

      conditional

      The credential store ID.

      Required if credential store authentication is used.

      --store_cred_id

      conditional

      The credential ID.

      Required if --store is specified.

      --help, -h

      optional

      Displays help information.
      After you run the command, the terminal should return a success message and instance ID.

  4. In SCM, navigate to Integrations  Orchestration Gateway.

  5. Select your orchestration gateway and click Sync Endpoints.

  1. Open the command line.

    If using Windows, you must open the command line as an administrator.

  2. Navigate to the orchestration gateway installation directory.

  3. Modify and run the following command to add an F5 XC endpoint using the orchestration gateway based on your system.

    Remove any unused options from the command.

    • Windows

      sectigo-og.exe tls add f5xc --name <endpoint-name> --connection_type <connection_type> --host <hostname-or-ip> --api_token <api-token> --store <credential-store-id> --store_cred_id <credential-id> --namespace <namespace> --use_proxy <true-or-false>

    • Linux

      ./sectigo-og tls add f5xc --name <endpoint-name> --connection_type <connection_type> --host <hostname-or-ip> --api_token <api-token> --store <credential-store-id> --store_cred_id <credential-id> --namespace <namespace> --use_proxy <true-or-false>

    • Docker

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og tls add f5xc --name <endpoint-name> --connection_type <connection_type> --host <hostname-or-ip> --api_token <api-token> --store <credential-store-id> --store_cred_id <credential-id> --namespace <namespace> --use_proxy <true-or-false>
      One of the following authentication options is required: --api_token, or --store and --store_cred_id.
      Option Requirement Description

      --name

      required

      The name of the endpoint.

      Must be between 1 and 32 characters.

      --connection_type

      required

      The connection type.

      The valid types are:

      • rest

      • rest_insecure

      --host

      required

      The server hostname.

      Must be between 1 and 255 characters.

      --api_token

      conditional

      The API token.

      Required if --store and --store_cred_id are not specified.

      --store

      conditional

      The credential store ID.

      Required if credential store authentication is used.

      --store_cred_id

      conditional

      The credential ID.

      Required if --store is specified.

      --namespace

      optional

      The F5 XC namespace.

      If omitted, it defaults to all the namespaces you have access to.

      --use_proxy

      optional

      Specifies whether to route requests through a configured proxy.

      The possible values are:

      • true — Route requests through the configured proxy.

      • false — Do not route requests through the proxy.

      If omitted, it defaults to false.

      To add proxy configuration, see Update proxy server details.

      --help, -h

      optional

      Displays help information.
      After you run the command, the terminal should return a success message and instance ID.

  4. In SCM, navigate to Integrations  Orchestration Gateway.

  5. Select your orchestration gateway and click Sync Endpoints.

  1. Open the command line.

    If using Windows, you must open the command line as an administrator.

  2. Navigate to the orchestration gateway installation directory.

  3. Modify and run the following command to add an Imperva endpoint using the orchestration gateway based on your system.

    Remove any unused options from the command.

    • Windows

      sectigo-og.exe tls add imperva --name <endpoint-name> --connection_type <connection-type> --api_id <api-id> --api_key <api-key> --account_id <account-id> --base_url <base-url> --port <port> --store <credential-store-id> --store_cred_id <credential-id> --use_proxy <true-or-false>

    • Linux

      ./sectigo-og tls add imperva --name <endpoint-name> --connection_type <connection-type> --api_id <api-id> --api_key <api-key> --account_id <account-id> --base_url <base-url> --port <port> --store <credential-store-id> --store_cred_id <credential-id> --use_proxy <true-or-false>

    • Docker

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og tls add imperva --name <endpoint-name> --connection_type <connection-type> --api_id <api-id> --api_key <api-key> --account_id <account-id> --base_url <base-url> --port <port> --store <credential-store-id> --store_cred_id <credential-id> --use_proxy <true-or-false>
      One of the following authentication options is required when the connection type is not rest_insecure: --user and --password, or --store and --store_cred_id.
      Option Requirement Description

      --name

      required

      The name of the endpoint.

      Must be between 1 and 32 characters.

      --connection_type

      required

      The connection type.

      The valid types are:

      • rest

      • rest_insecure

      Use rest_insecure only when TLS verification needs to be skipped (for example, when used in a test environment).

      --api_id

      required

      The Imperva API ID.

      --api_key

      required

      The Imperva API key.

      --account_id

      required

      The Imperva account ID.

      --base_url

      optional

      Overrides the default Imperva certificate-management endpoint. Leave blank to use the standard cloud endpoint. Set it only if Imperva’s endpoint changes or you need to point the gateway at a specific Imperva environment.

      --port

      optional

      Public-facing HTTPS port on Imperva sites.

      The default value is 443.

      --store

      conditional

      The credential store ID.

      --store_cred_id

      conditional

      The credential ID.

      Required if --store is specified.

      --use_proxy

      optional

      Specifies whether to route requests through a configured proxy.

      The possible values are:

      • true — Route requests through the configured proxy.

      • false — Do not route requests through the proxy.

      If omitted, it defaults to false.

      To add proxy configuration, see Update proxy server details.

      --help, -h

      optional

      Displays help information.
      After you run the command, the terminal should return a success message and instance ID.

  4. In SCM, navigate to Integrations  Orchestration Gateway.

  5. Select your orchestration gateway and click Sync Endpoints.

  1. Open the command line.

    If using Windows, you must open the command line as an administrator.

  2. Navigate to the orchestration gateway installation directory.

  3. Modify and run the following command to add an Nginx server using the orchestration gateway based on your system.

    Remove any unused options from the command.

    • Windows

      sectigo-og.exe tls add nginx --name <endpoint-name> --connection_type <connection_type> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --nginx_config_path <nginx-config-file-path>

    • Linux

      ./sectigo-og tls add nginx --name <endpoint-name> --connection_type <connection_type> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --nginx_config_path <nginx-config-file-path>

    • Docker

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og tls add nginx --name <endpoint-name> --connection_type <connection_type> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --nginx_config_path <nginx-config-file-path>
      One of the following authentication options is required when the connection type is not local: --user and --password, --ssh_key_path and --ssh_key_password, or --store and --store_cred_id.
      Option Requirement Description

      --name

      required

      The name of the endpoint.

      Must be between 1 and 32 characters.

      --connection_type

      required

      The connection type.

      The valid types are:

      • local

      • ssh

      --host

      conditional

      The hostname or IP address of the target system.

      Required if --connection_type is not local.

      Must be between 1 and 255 characters.

      --port

      conditional

      The remote port.

      Required if --connection_type is not local.

      Must be an integer between 1 and 65535.

      --user

      conditional

      The username for authentication.

      Required if username and password authentication is used.

      The username may vary depending on the operating system and the terminal used to execute the CLI.

      For example:

      • Windows (cmd.exe):

        --user scm2022.ccmqa.com\administrator

      • Linux (bash):

        --user 'scm2022.ccmqa.com\administrator'
--user "scm2022.ccmqa.com\\administrator"

      --password

      conditional

      The password for authentication.

      Required if --user is specified.

      --ssh_key_path

      conditional

      The path to the SSH key file.

      Required if SSH key authentication is used.

      --ssh_key_password

      conditional

      The password for the SSH key.

      Required if --ssh_key_path is specified.

      --store

      conditional

      The credential store ID.

      Required if credential store authentication is used.

      --store_cred_id

      conditional

      The credential ID.

      Required if --store is specified.

      --nginx_config_path

      required

      The path to the Nginx config file.

      Must be between 1 and 4096 characters.

      --help, -h

      optional

      Displays help information.
      After you run the command, the terminal should return a success message and instance ID.

  4. In SCM, navigate to Integrations  Orchestration Gateway.

  5. Select your orchestration gateway and click Sync Endpoints.

  1. Open the command line.

    If using Windows, you must open the command line as an administrator.

  2. Navigate to the orchestration gateway installation directory.

  3. Modify and run the following command to add a P12 endpoint using the orchestration gateway based on your system.

    Remove any unused options from the command.

    • Windows

      sectigo-og.exe tls add p12 --name <endpoint-name> --connection_type <connection_type> --path <file-path> --store_password <password> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --install_script <custom-install-script-path> --restart_script <custom-restart-script-path> --is_legacy <true-or-false>

    • Linux

      ./sectigo-og tls add p12 --name <endpoint-name> --connection_type <connection_type> --path <file-path> --store_password <password> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --install_script <custom-install-script-path> --restart_script <custom-restart-script-path> --is_legacy <true-or-false>

    • Docker

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og tls add p12 --name <endpoint-name> --connection_type <connection_type> --path <file-path> --store_password <password> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --install_script <custom-install-script-path> --restart_script <custom-restart-script-path> --is_legacy <true-or-false>
      One of the following authentication options is required when the connection type is not local: --user and --password, --ssh_key_path and --ssh_key_password, or --store and --store_cred_id.
      Option Requirement Description

      --name

      required

      The name of the endpoint.

      Must be between 1 and 32 characters.

      --path

      required

      The path to the keystore or certificate file.

      The filename must be included in this option.

      --store_password

      required

      The keystore password.

      --connection_type

      required

      The connection type.

      The valid types are:

      • local

      • ssh

      • ssh_windows

      • winrm_http

      • winrm_https

      • winrm_https_insecure

      --host

      conditional

      The hostname or IP address of the target system.

      Required if --connection_type is not local.

      Must be between 1 and 255 characters.

      --port

      conditional

      The remote port.

      Required if --connection_type is not local.

      Must be an integer between 1 and 65535.

      --user

      conditional

      The username for authentication.

      Required if username and password authentication is used.

      The username may vary depending on the operating system and the terminal used to execute the CLI.

      For example:

      • Windows (cmd.exe):

        --user scm2022.ccmqa.com\administrator

      • Linux (bash):

        --user 'scm2022.ccmqa.com\administrator'
--user "scm2022.ccmqa.com\\administrator"

      --password

      conditional

      The password for authentication.

      Required if --user is specified.

      --ssh_key_path

      conditional

      The path to the SSH key file.

      Required if SSH key authentication is used.

      --ssh_key_password

      conditional

      The password for the SSH key.

      Required if --ssh_key_path is specified.

      --store

      conditional

      The credential store ID.

      Required if credential store authentication is used.

      --store_cred_id

      conditional

      The credential ID.

      Required if --store is specified.

      --install_script

      optional

      The path to the install script.

      For more information about custom scripts, see Custom scripts.

      --restart_script

      optional

      The path to the restart script.

      For more information about custom scripts, see Custom scripts.

      --is_legacy

      optional

      Specifies which password-based encryption (PBE) scheme is used to encrypt the PKCS#8 private key inside the PKCS#12 ShroudedKeyBag.

      The valid values are:

      • true: old PKCS#12 legacy PBE.

      • false: (recommended) modern PKCS#5 PBES2.

      The value defaults to false.

      --help, -h

      optional

      Displays help information.
      After you run the command, the terminal should return a success message and instance ID.

  4. In SCM, navigate to Integrations  Orchestration Gateway.

  5. Select your orchestration gateway and click Sync Endpoints.

  1. Open the command line.

    If using Windows, you must open the command line as an administrator.

  2. Navigate to the orchestration gateway installation directory.

  3. Modify and run the following command to add a JKS endpoint using the orchestration gateway based on your system.

    Remove any unused options from the command.

    • Windows

      sectigo-og.exe tls add jks --name <endpoint-name> --connection_type <connection-type> --path <file-path> --store_password <password> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --install_script <custom-install-script-path> --restart_script <custom-restart-script-path>

    • Linux

      ./sectigo-og tls add jks --name <endpoint-name> --connection_type <connection-type> --path <file-path> --store_password <password> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --install_script <custom-install-script-path> --restart_script <custom-restart-script-path>

    • Docker

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og tls add jks --name <endpoint-name> --connection_type <connection-type> --path <file-path> --store_password <password> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --install_script <custom-install-script-path> --restart_script <custom-restart-script-path>
      One of the following authentication options is required when the connection type is not local: --user and --password, --ssh_key_path and --ssh_key_password, or --store and --store_cred_id.
      Option Requirement Description

      --name

      required

      The name of the endpoint.

      Must be between 1 and 32 characters.

      --path

      required

      The path to the keystore or certificate file.

      The filename must be included in this option.

      --store_password

      required

      The keystore password.

      --connection_type

      required

      The connection type.

      The valid types are:

      • local

      • ssh

      • ssh_windows

      • winrm_http

      • winrm_https

      • winrm_https_insecure

      --host

      conditional

      The hostname or IP address of the target system.

      Required if --connection_type is not local.

      Must be between 1 and 255 characters.

      --port

      conditional

      The remote port.

      Required if --connection_type is not local.

      Must be an integer between 1 and 65535.

      --user

      conditional

      The username for authentication.

      Required if username and password authentication is used.

      The username may vary depending on the operating system and the terminal used to execute the CLI.

      For example:

      • Windows (cmd.exe):

        --user scm2022.ccmqa.com\administrator

      • Linux (bash):

        --user 'scm2022.ccmqa.com\administrator'
--user "scm2022.ccmqa.com\\administrator"

      --password

      conditional

      The password for authentication.

      Required if --user is specified.

      --ssh_key_path

      conditional

      The path to the SSH key file.

      Required if SSH key authentication is used.

      --ssh_key_password

      conditional

      The password for the SSH key.

      Required if --ssh_key_path is specified.

      --store

      conditional

      The credential store ID.

      Required if credential store authentication is used.

      --store_cred_id

      conditional

      The credential ID.

      Required if --store is specified.

      --install_script

      optional

      The path to the install script.

      For more information about custom scripts, see Custom scripts.

      --restart_script

      optional

      The path to the restart script.

      For more information about custom scripts, see Custom scripts.

      --help, -h

      optional

      Displays help information.
      After you run the command, the terminal should return a success message and instance ID.

  4. In SCM, navigate to Integrations  Orchestration Gateway.

  5. Select your orchestration gateway and click Sync Endpoints.

  1. Open the command line.

    If using Windows, you must open the command line as an administrator.

  2. Navigate to the orchestration gateway installation directory.

  3. Run the following command to add a PEM endpoint using the orchestration gateway based on your system.

    Remove any unused options from the command.

    • Windows

      sectigo-og.exe tls add pem --name <endpoint-name> --connection_type <connection-type> --path <file-path> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --install_script <custom-install-script-path> --restart_script <custom-restart-script-path>

    • Linux

      ./sectigo-og tls add pem --name <endpoint-name> --connection_type <connection-type> --path <file-path> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --install_script <custom-install-script-path> --restart_script <custom-restart-script-path>

    • Docker

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og tls add pem --name <endpoint-name> --connection_type <connection-type> --path <file-path> --host <hostname-or-ip> --port <port> --user <user> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password> --store <credential-store-id> --store_cred_id <credential-id> --install_script <custom-install-script-path> --restart_script <custom-restart-script-path>
      One of the following authentication options is required when the connection type is not local: --user and --password, --ssh_key_path and --ssh_key_password, or --store and --store_cred_id.
      Option Requirement Description

      --name

      required

      The name of the endpoint.

      Must be between 1 and 32 characters.

      --path

      required

      The path to the file.

      The filename must be included in this option.

      --connection_type

      required

      The connection type.

      The valid types are:

      • local

      • ssh

      • ssh_windows

      • winrm_http

      • winrm_https

      • winrm_https_insecure

      --host

      conditional

      The hostname or IP address of the target system.

      Required if --connection_type is not local.

      Must be between 1 and 255 characters.

      --port

      conditional

      The remote port.

      Required if --connection_type is not local.

      Must be an integer between 1 and 65535.

      --user

      conditional

      The username for authentication.

      Required if username and password authentication is used.

      The username may vary depending on the operating system and the terminal used to execute the CLI.

      For example:

      • Windows (cmd.exe):

        --user scm2022.ccmqa.com\administrator

      • Linux (bash):

        --user 'scm2022.ccmqa.com\administrator'
--user "scm2022.ccmqa.com\\administrator"

      --password

      conditional

      The password for authentication.

      Required if --user is specified.

      --ssh_key_path

      conditional

      The path to the SSH key file.

      Required if SSH key authentication is used.

      --ssh_key_password

      conditional

      The password for the SSH key.

      Required if --ssh_key_path is specified.

      --store

      conditional

      The credential store ID.

      Required if credential store authentication is used.

      --store_cred_id

      conditional

      The credential ID.

      Required if --store is specified.

      --install_script

      optional

      The path to the install script.

      For more information about custom scripts, see Custom scripts.

      --restart_script

      optional

      The path to the restart script.

      For more information about custom scripts, see Custom scripts.

      --help, -h

      optional

      Displays help information.
      After you run the command, the terminal should return a success message and instance ID.

  4. In SCM, navigate to Integrations  Orchestration Gateway.

  5. Select your orchestration gateway and click Sync Endpoints.

  1. Open the command line.

    If using Windows, you must open the command line as an administrator.

  2. Navigate to the orchestration gateway installation directory.

  3. Modify and run the following command to add a Citrix endpoint using the orchestration gateway based on your system.

    Remove any unused options from the command.

    • Windows

      sectigo-og.exe tls add citrix --name <endpoint-name> --host <hostname-or-ip> --connection_type <connection-type> --is_cloud <true-or-false> --user <user> --password <password> --store <credential-store-id> --store_cred_id <credential-id> --use_proxy <true-or-false>

    • Linux

      ./sectigo-og tls add citrix --name <endpoint-name> --host <hostname-or-ip> --connection_type <connection-type> --is_cloud <true-or-false> --user <user> --password <password> --store <credential-store-id> --store_cred_id <credential-id> --use_proxy <true-or-false>

    • Docker

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og tls add citrix --name <endpoint-name> --host <hostname-or-ip> --connection_type <connection-type> --is_cloud <true-or-false> --user <user> --password <password> --store <credential-store-id> --store_cred_id <credential-id> --use_proxy <true-or-false>
      One of the following authentication options is required: --user and --password, or --store and --store_cred_id.
      Option Requirement Description

      --name

      required

      The name of the endpoint.

      Must be between 1 and 32 characters.

      --host

      required

      The hostname or IP address of the target system.

      Must be between 1 and 255 characters.

      --connection_type

      required

      The connection type.

      The valid types are:

      • rest

      • rest_insecure

      Use rest_insecure only when TLS verification needs to be skipped (for example, when used in a test environment).

      --is_cloud

      required

      Specifies whether the endpoint is a cloud endpoint.

      The valid values are:

      • true: the endpoint is a cloud endpoint.

      • false: the endpoint is on premises.

      --user

      conditional

      The username for authentication.

      Required if username and password authentication is used.

      The username may vary depending on the operating system and the terminal used to execute the CLI.

      For example:

      • Windows (cmd.exe):

        --user scm2022.ccmqa.com\administrator

      • Linux (bash):

        --user 'scm2022.ccmqa.com\administrator'
--user "scm2022.ccmqa.com\\administrator"

      --password

      conditional

      The password for authentication.

      Required if --user is specified.

      --store

      conditional

      The credential store ID.

      Required if credential store authentication is used.

      --store_cred_id

      conditional

      The credential ID.

      Required if --store is specified.

      --use_proxy

      optional

      Specifies whether to route requests through a configured proxy.

      The possible values are:

      • true — Route requests through the configured proxy.

      • false — Do not route requests through the proxy.

      If omitted, it defaults to false.

      To add proxy configuration, see Update proxy server details.

      --help, -h

      optional

      Displays help information.
      After you run the command, the terminal should return a success message and instance ID.

  4. In SCM, navigate to Integrations  Orchestration Gateway.

  5. Select your orchestration gateway and click Sync Endpoints.

  1. Open the command line.

    If using Windows, you must open the command line as an administrator.

  2. Navigate to the orchestration gateway installation directory.

  3. Modify and run the following command to add a Cloudflare endpoint using the orchestration gateway based on your system.

    Remove any unused options from the command.

    • Windows

      sectigo-og.exe tls add cloudflare --name <endpoint-name> --connection_type --api_token <api-token> --store <credential-store-id> --store_cred_id <credential-id> --zone_id <zone-id>

    • Linux

      ./sectigo-og tls add cloudflare --name <endpoint-name> --connection_type --api_token <api-token> --store <credential-store-id> --store_cred_id <credential-id> --zone_id <zone-id>

    • Docker

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og tls add cloudflare --name <endpoint-name> --api_token <api-token> --store <credential-store-id> --store_cred_id <credential-id> --zone_id <zone-id>
      One of the following authentication options is required: --api_token, or --store and --store_cred_id.
      Option Requirement Description

      --name

      required

      The name of the endpoint.

      Must be between 1 and 32 characters.

      --api_token

      conditional

      The Cloudflare API Token.

      Required if credential store authentication is not used.

      --store

      conditional

      The credential store ID.

      Required if credential store authentication is used.

      --store_cred_id

      conditional

      The credential ID.

      Required if --store is specified.

      --zone_id

      optional

      The Cloudflare Zone ID.

      If specified, discovery is scoped to this zone only.

      If omitted, all zones accessible by the API token are discovered.

      --help, -h

      optional

      Displays help information.
      After you run the command, the terminal should return a success message and instance ID.

  4. In SCM, navigate to Integrations  Orchestration Gateway.

  5. Select your orchestration gateway and click Sync Endpoints.

Once an endpoint is added to an orchestration gateway, you must complete the following steps:

  • Delegate the endpoint to the appropriate organization or department. For more information, see Delegate an endpoint.

  • Discover nodes associated with the endpoint. For more information, see Discover nodes.

Edit an endpoint

  • Microsoft IIS

  • Windows certificate store

  • Apache

  • Apache Tomcat

  • F5 BIG-IP

  • F5 XC

  • Imperva

  • Nginx

  • P12

  • JKS

  • PEM

  • Citrix

  • Cloudflare

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select the endpoint you want to edit and click the Edit icon.

  3. In the Edit SSL/TLS Automation Endpoint dialog, edit the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    The valid types are:

    • LOCAL

    • SSH(WINDOWS)

    • WINRM HTTP

    • WINRM HTTPS

    • WINRM HTTPS (INSECURE)

    Remote hostname/address

    The hostname or IP address of the target system.

    Remote port

    The remote port.

    Authenticate with

    The authentication method for the remote system.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Required if selecting User/Password for the Authenticate with option.

    Private key file path

    The path to the SSH key file.

    Required if selecting SSH Key for the Authenticate with option.

    Passphrase

    The password for the SSH key.

    Required if selecting SSH Key for the Authenticate with option.

  4. Click Save.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select the endpoint you want to edit and click the Edit icon.

  3. In the Edit SSL/TLS Automation Endpoint dialog, edit the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Key provider model

    The key storage provider used for the endpoint’s private keys.

    Scope

    Specifies whether the certificate store is created for a specific user or for the entire machine.

    Certificate Store

    The name of the certificate store.

    Whether the private key is exportable

    Specifies whether the private key is exportable.

    Connection Type

    The connection type.

    The valid types are:

    • LOCAL

    • SSH(WINDOWS)

    • WINRM HTTP

    • WINRM HTTPS

    • WINRM HTTPS (INSECURE)

    Remote hostname/address

    The hostname or IP address of the target system.

    Remote port

    The remote port.

    Authenticate with

    The authentication method for the remote system.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Required if selecting User/Password for the Authenticate with option.

    Private key file path

    The path to the SSH key file.

    Required if selecting SSH Key for the Authenticate with option.

    Passphrase

    The password for the SSH key.

    Required if selecting SSH Key for the Authenticate with option.

    Authenticate with

    The authentication method for the remote system.

    Install Script

    The path to the install script.

    For more information about custom scripts, see Custom scripts.

    Restart Script

    The path to the restart script.

    For more information about custom scripts, see Custom scripts.

  4. Click Save.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select the endpoint you want to edit and click the Edit icon.

  3. In the Edit SSL/TLS Automation Endpoint dialog, edit the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    The valid types are:

    • LOCAL

    • SSH

    Certificate storage directory

    The certificate directory.

    Path to apachectl

    The path to the apachectl.

    Remote hostname/address

    The hostname or IP address of the target system.

    Remote port

    The remote port.

    Authenticate with

    The authentication method for the remote system.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Required if selecting User/Password for the Authenticate with option.

    Private key file path

    The path to the SSH key file.

    Required if selecting SSH Key for the Authenticate with option.

    Passphrase

    The password for the SSH key.

    Required if selecting SSH Key for the Authenticate with option.

  4. Click Save.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select the endpoint you want to edit and click the Edit icon.

  3. In the Edit SSL/TLS Automation Endpoint dialog, edit the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Path to Tomcat directory

    The path to the Tomcat directory, for example, /opt/tomcat.

    Connection Type

    The connection type.

    The valid types are:

    • LOCAL

    • SSH

    • SSH(WINDOWS)

    • WINRM HTTP

    • WINRM HTTPS

    • WINRM HTTPS (INSECURE)

    Remote hostname/address

    The hostname or IP address of the target system.

    Remote port

    The remote port.

    Authenticate with

    The authentication method for the remote system.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Required if selecting User/Password for the Authenticate with option.

    Private key file path

    The path to the SSH key file.

    Required if selecting SSH Key for the Authenticate with option.

    Passphrase

    The password for the SSH key.

    Required if selecting SSH Key for the Authenticate with option.

  4. Click Save.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select the endpoint you want to edit and click the Edit icon.

  3. In the Edit SSL/TLS Automation Endpoint dialog, edit the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    The valid types are:

    • REST

    • REST (Insecure)

    Server hostname

    The server hostname.

    Server port

    The server port.

    Authenticate with

    The authentication method for the remote system.

    Username

    The username for authentication.

    Password

    The password for authentication.

  4. Click Save.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select the endpoint you want to edit and click the Edit icon

  3. In the Edit SSL/TLS Automation Endpoint dialog, edit the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    The valid types are:

    • REST

    • REST (Insecure)

    Host

    The server hostname.

    Authenticate with

    The authentication method for the remote system.

    API Token

    The API token.

    Namespace

    The F5 distributed cloud namespace.

    If omitted, it defaults to all the namespaces you have access to.

    Route requires through configured proxy

    Specifies whether to route requests through a configured proxy.

    To add proxy configuration, see Add a proxy.

  4. Click Save.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select the endpoint you want to edit and click the Edit icon

  3. In the Edit SSL/TLS Automation Endpoint dialog, complete the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    The valid types are:

    • REST

    • REST (Insecure)

    Imperva API host

    Overrides the default Imperva certificate-management endpoint. Set it only if Imperva’s endpoint changes or you need to point the gateway at a specific Imperva environment.

    Public-facing HTTPS port

    Public-facing HTTPS port on Imperva sites.

    Authenticate with

    The authentication method for the remote system.

    API ID

    The Imperva API ID.

    API Key

    The Imperva API Key.

    Imperva account ID

    The Imperva account ID.

    Route request through configured proxy

    Specifies whether to route requests through a configured proxy.

    To add proxy configuration, see Add a proxy.

  4. Click Save.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select the endpoint you want to edit and click the Edit icon

  3. In the Edit SSL/TLS Automation Endpoint dialog, edit the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    The valid types are:

    • LOCAL

    • SSH

    Remote hostname/address

    The hostname or IP address of the target system.

    Remote port

    The remote port.

    Authenticate with

    The authentication method for the remote system.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Required if selecting User/Password for the Authenticate with option.

    Private key file path

    The path to the SSH key file.

    Required if selecting SSH Key for the Authenticate with option.

    Passphrase

    The password for the SSH key.

    Required if selecting SSH Key for the Authenticate with option.

    Path to Nginx config file

    The path to the Nginx config file.

  4. Click Save.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select the endpoint you want to edit and click the Edit icon

  3. In the Edit SSL/TLS Automation Endpoint dialog, edit the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Path

    The path to the keystore or certificate file.

    The filename must be included in this option.

    Keystore password

    The keystore password.

    Connection Type

    The connection type.

    The valid types are:

    • LOCAL

    • SSH

    • SSH(WINDOWS)

    • WINRM HTTP

    • WINRM HTTPS

    • WINRM HTTPS (INSECURE)

    Remote hostname/address

    The hostname or IP address of the target system.

    Remote port

    The remote port.

    Authenticate with

    The authentication method for the remote system.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Required if selecting User/Password for the Authenticate with option.

    Private key file path

    The path to the SSH key file.

    Required if selecting SSH Key for the Authenticate with option.

    Passphrase

    The password for the SSH key.

    Required if selecting SSH Key for the Authenticate with option.

    Install Script

    The path to the install script.

    For more information about custom scripts, see Custom scripts.

    Restart Script

    The path to the restart script.

    For more information about custom scripts, see Custom scripts.

    Is legacy

    Specifies which password-based encryption (PBE) scheme is used to encrypt the PKCS#8 private key inside the PKCS#12 ShroudedKeyBag.

    If toggled on, the legacy PKCS#12 PBE scheme is used. If toggled off, the PKCS#5 PBE scheme is used.

  4. Click Save.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select the endpoint you want to edit and click the Edit icon.

  3. In the Edit SSL/TLS Automation Endpoint dialog, edit the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Path

    The path to the keystore or certificate file.

    The filename must be included in this option.

    Keystore password

    The keystore password.

    Connection Type

    The connection type.

    The valid types are:

    • LOCAL

    • SSH

    • SSH(WINDOWS)

    • WINRM HTTP

    • WINRM HTTPS

    • WINRM HTTPS (INSECURE)

    Remote hostname/address

    The hostname or IP address of the target system.

    Remote port

    The remote port.

    Authenticate with

    The authentication method for the remote system.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Required if selecting User/Password for the Authenticate with option.

    Private key file path

    The path to the SSH key file.

    Required if selecting SSH Key for the Authenticate with option.

    Passphrase

    The password for the SSH key.

    Required if selecting SSH Key for the Authenticate with option.

    Install Script

    The path to the install script.

    For more information about custom scripts, see Custom scripts.

    Restart Script

    The path to the restart script.

    For more information about custom scripts, see Custom scripts.

  4. Click Save.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select the endpoint you want to edit and click the Edit icon

  3. In the Edit SSL/TLS Automation Endpoint dialog, edit the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Path

    The path to the keystore or certificate file.

    The filename must be included in this option.

    Connection Type

    The connection type.

    The valid types are:

    • LOCAL

    • SSH

    • SSH(WINDOWS)

    • WINRM HTTP

    • WINRM HTTPS

    • WINRM HTTPS (INSECURE)

    Remote hostname/address

    The hostname or IP address of the target system.

    Remote port

    The remote port.

    Authenticate with

    The authentication method for the remote system.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Required if selecting User/Password for the Authenticate with option.

    Private key file path

    The path to the SSH key file.

    Required if selecting SSH Key for the Authenticate with option.

    Passphrase

    The password for the SSH key.

    Required if selecting SSH Key for the Authenticate with option.

    Install Script

    The path to the install script.

    For more information about custom scripts, see Custom scripts.

    Restart Script

    The path to the restart script.

    For more information about custom scripts, see Custom scripts.

  4. Click Save.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select the endpoint you want to edit and click the Edit icon

  3. In the Edit SSL/TLS Automation Endpoint dialog, edit the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    The valid types are:

    • REST

    • REST (Insecure)

    Server hostname

    The server hostname.

    Server port

    The server port.

    Is running in cloud

    Specifies whether the endpoint is a cloud endpoint.

    Authenticate with

    The authentication method for the remote system.

    Username

    The username for authentication.

    Password

    The password for authentication.

    Route request through configured proxy

    Specifies whether to route requests through a configured proxy.

    For more information about proxy configuration, see Add a proxy.

  4. Click Save.

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. In the Edit SSL/TLS Automation Endpoint dialog, edit the connection details based on the information provided in the following table.

    Field Description

    Name

    The name of the endpoint.

    This field is not editable after the endpoint is created.

    Connection Type

    The connection type.

    The valid types are:

    • REST

    • REST (Insecure)

    Route request through configured proxy

    Specifies whether to route requests through a configured proxy.

    To add proxy configuration, see Update proxy server details.

    Authenticate with

    The authentication method for the remote system.

    API Token

    The Cloudflare API token.

    Zone ID

    The Cloudflare zone ID.

    If specified, discovery is scoped to this zone only.

    If omitted, all zones accessible by the API token are discovered.

  3. Click Save.

Delegate an endpoint

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select the endpoint you want to delegate.

  3. Click Edit.

  4. In the Edit SSL/TLS Automation Endpoint dialog, select the organization and department you want to assign to the endpoint.

  5. Click Save.

Delete an endpoint

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select the endpoint you want to delete.

  3. Click Delete and then click Delete again to confirm.

Managing nodes

Discover nodes

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select your endpoint.

  3. Click Discover Nodes.

    You need to assign an organization or a department to the endpoint before you can discover nodes.

View nodes

  1. Navigate to Integrations  SSL/TLS Automation Endpoints.

  2. Select your endpoint.

  3. Click Nodes to view the nodes associated with the endpoint.

    Each node is displayed as a collapsible heading that shows the name of the node, the vendor, and the node state.

    Column Name Description

    Name

    The name of the node.

    Alias

    The alias for the node (if available).

    Protocol

    Whether the node is connected through HTTP or HTTPS.

    IP Address

    The IP address of the node.

    Port

    The port used to connect to the node.

    SSL

    The order number of the SSL certificate associated with the node.

    Discovered certificates that have not been assigned to an organization or department are displayed as External.
Click the value in the SSL column for any given node to view or manage the associated SSL certificate.

Restart an endpoint

The auto-installation of an SSL certificate on Apache or Tomcat servers requires the web server to be restarted following certificate deployment. This is required for new certificates, and any time an auto-installation certificate is manually or automatically renewed.

Servers can be restarted from the SSL Certificates page.

  1. Navigate to Certificates  SSL Certificates.

  2. Select the certificate installed on the server you want to restart, and click View.

  3. In the SSL Certificate dialog, select the Management tab, and expand the Auto-Installation section.

  4. Locate the server you want to restart, and click Restart.

Configure WinRM

Microsoft IIS endpoints that use the winrm_http, winrm_https, or winrm_https_insecure connection types require WinRM to be configured before certificate installation can occur.

  1. Validate WinRM server connectivity.

    1. Copy the following script and save it as validate-winrm-server.ps1.

      Powershell script 
      # ================================================
# WinRM Server Configuration and Port Check Script
# ================================================

$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
$principal = New-Object Security.Principal.WindowsPrincipal($identity)

if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Write-Host "Script must be run as Administrator" -ForegroundColor Red
    exit 1
}

$serverName = $env:COMPUTERNAME
$computerAccount = "$env:USERDOMAIN\$serverName`$"

Write-Host "`n=== SERVER INFO ==="
Write-Host "Server name: $computerAccount"
Write-Host "User account: $(whoami)"
Write-Host "`n=== WINRM SERVICE STATUS ==="
$service = Get-Service WinRM -ErrorAction SilentlyContinue
if ($service -and $service.Status -eq "Running") {
    Write-Host "WinRM service is running" -ForegroundColor Green
} else {
    Write-Host "WinRM service is not running" -ForegroundColor Red
    exit 1
}

Write-Host "`n=== WINRM CONFIGURATION ==="
$config = winrm get winrm/config/service
($config | Out-String) | Write-Host
$basic = ($config | Select-String "Basic").ToString()
$allowUnencrypted = ($config | Select-String "AllowUnencrypted").ToString()
$basicEnabled = $basic -match "Basic\s*=\s*true"
$unencryptedEnabled = $allowUnencrypted -match "AllowUnencrypted\s*=\s*true"
if ($basicEnabled -and $unencryptedEnabled) {
    Write-Host "Insecure WinRM configuration detected: Disable Basic authentication or enforce HTTPS." -ForegroundColor Red
}

Write-Host "`n=== WINRM LISTENERS ==="
winrm enumerate winrm/config/listener

Write-Host "`n=== FIREWALL RULES (WINRM) ==="

$lines = netsh advfirewall firewall show rule name=all
$rule = @()
foreach ($line in $lines) {
    if ($line -match "^Rule Name:") {
        # print previous rule if it matched
        if ($rule -match "LocalPort:\s+(5985|5986)") {
            $rule -join "`n"
            Write-Host ""
        }
        $rule = @()
    }

    $rule += $line
}

# check last rule
if ($rule -match "LocalPort:\s+(5985|5986)") {
    $rule -join "`n"
}

Write-Host "`n=== TESTING PORT CONNECTIVITY ==="
$ports = @(5985, 5986)
foreach ($port in $ports) {
    $result = Test-NetConnection -ComputerName localhost -Port $port -WarningAction SilentlyContinue

    if ($result.TcpTestSucceeded) {
        Write-Host "Port $port is OPEN" -ForegroundColor Green
    } else {
        Write-Host "Port $port is CLOSED" -ForegroundColor Red
    }
}

Write-Host "`n=== SPN VALIDATION ==="
Write-Host "Checking SPN: */$serverName*"
$spnOutput = & cmd /c setspn -Q "*/$serverName*" 2>$null

# Extract only SPN lines (ignore CN=..., blank lines, etc.)
$spnLines = $spnOutput | Where-Object { $_ -match "^\s*(HTTP|HOST)/" }

# Check for HTTP or HOST specifically
$match = $spnLines | Where-Object { $_ -match "^\s*(HTTP|HOST)/$serverName([.\s]|$)" }

if ($match) {
    Write-Host "Valid SPN found (HTTP or HOST)" -ForegroundColor Green
    ($spnLines | Out-String) | Write-Host
} else {
    Write-Host "No valid HTTP/HOST SPN found" -ForegroundColor Red
    ($spnOutput | Out-String) | Write-Host
}

    2. Log in to the target server.

    3. Open PowerShell as Administrator.

    4. Navigate to the script location.

    5. Run the following command.

      powershell -ExecutionPolicy Bypass -File .\validate-winrm-server.ps1

  2. If server http connectivity validation fails, configure http connection.

    1. Copy the following script and save it as setup-winrm-server-http.ps1.

      Powershell script 
      param(
    [Parameter(
        Mandatory=$true,
        HelpMessage = "FQDN of this server (e.g. server01.domain.com). Should match DNS and the hostname used for WinRM connections."
    )]
    [string]$ServerFQDN
)

# ============================================
# Configure WinRM over HTTP
# ============================================

Write-Host "=== CONFIGURING WINRM HTTP FOR $ServerFQDN ==="
winrm quickconfig -q

# --------------------------------------------
# Step 1: Configure WinRM service settings
# --------------------------------------------
Write-Host "`nConfiguring WinRM service settings..."

Set-Item -Path WSMan:\localhost\Service\AllowUnencrypted -Value $true
Set-Item -Path WSMan:\localhost\Service\Auth\Basic -Value $false
Set-Item -Path WSMan:\localhost\Service\Auth\Kerberos -Value $true
Set-Item -Path WSMan:\localhost\Service\Auth\Negotiate -Value $true

# --------------------------------------------
# Step 2: Open firewall port 5985
# --------------------------------------------
Write-Host "`nOpening firewall port 5985..."

New-NetFirewallRule `
    -Name "WinRM-HTTP" `
    -DisplayName "WinRM HTTP" `
    -Protocol TCP `
    -LocalPort 5985 `
    -Direction Inbound `
    -Action Allow `
    -ErrorAction SilentlyContinue | Out-Null

# --------------------------------------------
# Step 3: Restart WinRM
# --------------------------------------------
Write-Host "`nRestarting WinRM service..."

Restart-Service WinRM

# --------------------------------------------
# Step 4: Validate
# --------------------------------------------
Write-Host "`nValidating WinRM HTTP..."
try {
	Invoke-Command -ComputerName $ServerFQDN  -ScriptBlock { hostname } -ErrorAction Stop | Out-Null
    Write-Host "Remote WinRM over HTTP succeeded" -ForegroundColor Green
} catch {
    Write-Host "Remote WinRM over HTTP FAILED" -ForegroundColor Red
}

    2. Log in to the target server.

    3. Open PowerShell as Administrator.

    4. Navigate to the script location.

    5. Run the following command and modify <server-fqdn> to a fully qualified domain name of the WinRM server.

      powershell -ExecutionPolicy Bypass -File .\setup-winrm-server-http.ps1 -ServerFQDN <server-fqdn>

  3. If server https connectivity validation fails, configure https connection.

    1. Copy the following script and save it as setup-winrm-server-https.ps1.

      Powershell script 
      param(
    [Parameter(
        Mandatory=$true,
        HelpMessage = "FQDN of this server (e.g. server01.domain.com). Should match DNS and the hostname used for WinRM connections."
    )]
    [string]$ServerFQDN
)

# ============================================
# Configure WinRM over HTTPS
# ============================================

Write-Host "=== CONFIGURING WINRM HTTPS FOR $ServerFQDN ==="
winrm quickconfig -q

# --------------------------------------------
# Step 1: Secure WinRM settings
# --------------------------------------------
Write-Host "`nConfiguring WinRM service settings..."

Set-Item -Path WSMan:\localhost\Service\AllowUnencrypted -Value $true
Set-Item -Path WSMan:\localhost\Service\Auth\Basic -Value $false
Set-Item -Path WSMan:\localhost\Service\Auth\Kerberos -Value $true
Set-Item -Path WSMan:\localhost\Service\Auth\Negotiate -Value $true

# --------------------------------------------
# Step 2: Create certificate
# --------------------------------------------
Write-Host "`nCreating self-signed certificate..."

$cert = New-SelfSignedCertificate `
    -DnsName "$ServerFQDN" `
    -CertStoreLocation Cert:\LocalMachine\My

Write-Host "Certificate created with thumbprint: $($cert.Thumbprint)"

# --------------------------------------------
# Step 3: Create HTTPS listener
# --------------------------------------------
Write-Host "`nCreating WinRM HTTPS listener..."
winrm delete winrm/config/Listener?Address=*+Transport=HTTPS 2>$null
winrm create winrm/config/Listener?Address=*+Transport=HTTPS "@{Hostname=`"$ServerFQDN`"; CertificateThumbprint=`"$($cert.Thumbprint)`"}"

# --------------------------------------------
# Step 4: Open firewall port 5986
# --------------------------------------------
Write-Host "`nOpening firewall port 5986..."

New-NetFirewallRule `
    -Name "WinRM-HTTPS" `
    -DisplayName "WinRM HTTPS" `
    -Protocol TCP `
    -LocalPort 5986 `
    -Direction Inbound `
    -Action Allow `
	-ErrorAction SilentlyContinue | Out-Null

# --------------------------------------------
# Step 5: Restart WinRM
# --------------------------------------------
Write-Host "`nRestarting WinRM service..."

Restart-Service WinRM

# --------------------------------------------
# Step 6: Validate
# --------------------------------------------
Write-Host "`nValidating WinRM HTTPS..."
$options = New-PSSessionOption -SkipCACheck -SkipCNCheck
try {
	Invoke-Command -ComputerName $ServerFQDN -UseSSL -SessionOption $options -ScriptBlock { hostname } -ErrorAction Stop | Out-Null
    Write-Host "Remote WinRM over HTTPS succeeded" -ForegroundColor Green
} catch {
    Write-Host "Remote WinRM over HTTPS FAILED" -ForegroundColor Red
}

    2. Log in to the target server.

    3. Open PowerShell as Administrator.

    4. Navigate to the script location.

    5. Run the following command and modify <server-fqdn> to a fully qualified domain name of the WinRM server.

      powershell -ExecutionPolicy Bypass -File .\setup-winrm-server-https.ps1 -ServerFQDN <server-fqdn>

  4. Validate WinRM client connectivity.

    1. Copy the following script and save it as validate-winrm-client.ps1.

      Powershell script 
      param(
    [Parameter(
        Mandatory=$true,
        HelpMessage = "FQDN of WinRM server (e.g. server01.domain.com). Should match DNS and the hostname used for WinRM connections."
    )]
    [string]$WinRMServer
)

# ================================================
# WinRM Client Configuration and Port Check Script
# ================================================

$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
$principal = New-Object Security.Principal.WindowsPrincipal($identity)

if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Write-Host "Script must be run as Administrator" -ForegroundColor Red
    exit 1
}

$computerAccount = "$env:USERDOMAIN\$env:COMPUTERNAME`$"

Write-Host "`n=== SERVER INFO ==="
Write-Host "Client machine: $computerAccount"
Write-Host "Target WinRM server: $WinRMServer"
Write-Host "User account: $(whoami)"
Write-Host "`n=== WINRM SERVICE STATUS ==="
$service = Get-Service WinRM -ErrorAction SilentlyContinue
if ($service -and $service.Status -eq "Running") {
    Write-Host "WinRM service is running" -ForegroundColor Green
} else {
    Write-Host "WinRM service is not running" -ForegroundColor Red
    exit 1
}

Write-Host "`n=== WINRM CONFIGURATION (LOCAL CLIENT) ==="
winrm get winrm/config/client

Write-Host "`n=== WINRM LISTENERS (LOCAL CLIENT) ==="
winrm enumerate winrm/config/listener

Write-Host "`n=== FIREWALL RULES (LOCAL CLIENT - WINRM) ==="
(Get-NetFirewallRule -DisplayGroup "Windows Remote Management" -ErrorAction SilentlyContinue |
    Select-Object DisplayName, Enabled, Direction, Action |
    Out-String) | Write-Host

Write-Host "`n=== TESTING PORT CONNECTIVITY TO SERVER ==="
$ports = @(5985, 5986)

foreach ($port in $ports) {
    $result = Test-NetConnection -ComputerName $WinRMServer -Port $port -WarningAction SilentlyContinue

    if ($result.TcpTestSucceeded) {
        Write-Host "$WinRMServer : Port $port is OPEN" -ForegroundColor Green
    } else {
        Write-Host "$WinRMServer : Port $port is CLOSED" -ForegroundColor Red
    }
}

Write-Host "`n=== TESTING WINRM (HTTP) CONNECTIVITY ==="
try {
	Invoke-Command -ComputerName $WinRMServer -ScriptBlock { hostname } -ErrorAction Stop | Out-Null
    Write-Host "Remote WinRM over HTTP succeeded" -ForegroundColor Green
} catch {
    Write-Host "Remote WinRM over HTTP FAILED" -ForegroundColor Red
}


Write-Host "`n=== TESTING WINRM (HTTPS) CONNECTIVITY ==="
$options = New-PSSessionOption -SkipCACheck -SkipCNCheck
try {
	Invoke-Command -ComputerName $WinRMServer -UseSSL -SessionOption $options -ScriptBlock { hostname } -ErrorAction Stop | Out-Null
    Write-Host "Remote WinRM over HTTPS succeeded" -ForegroundColor Green
} catch {
    Write-Host "Remote WinRM over HTTPS FAILED" -ForegroundColor Red
}

Write-Host "`n=== SPN REGISTRATION ==="
Write-Host "Checking Kerberos ticket (klist)..."

# Purge tickets to ensure clean test
klist purge 2>$null | Out-Null

try {
    Invoke-Command -ComputerName $WinRMServer -Authentication Kerberos -ScriptBlock { hostname } -ErrorAction Stop | Out-Null
} catch {
    Write-Host "Kerberos connection attempt FAILED" -ForegroundColor Red
}

# Get tickets
$klistOutput = klist
$spn = "HTTP/$WinRMServer"
$spnPattern = $spn.ToLower()
if ($klistOutput -match $spnPattern) {
    Write-Host "Kerberos ticket FOUND for $spn" -ForegroundColor Green
} else {
    Write-Host "Kerberos ticket NOT found for $spn" -ForegroundColor Yellow
}

    2. Open PowerShell as Administrator.

    3. Navigate to the script location.

    4. Run the following command and modify <winrm-server> to a fully qualified domain name of the WinRM server.

      powershell -ExecutionPolicy Bypass -File .\validate-winrm-client.ps1 -WinRMServer <winrm-server>

  5. If client connectivity validation fails, configure WinRM client.

    1. Copy the following script and save it as setup-winrm-client.ps1.

      Powershell script 
      param(
    [Parameter(
        Mandatory=$true,
        HelpMessage = "FQDN of WinRM server (e.g. server01.domain.com). Should match DNS and the hostname used for WinRM connections."
    )]
    [string]$WinRMServer
)

# ==========================
# WinRM Client Configuration
# ==========================

$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
$principal = New-Object Security.Principal.WindowsPrincipal($identity)

if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Write-Host "Script must be run as Administrator" -ForegroundColor Red
    exit 1
}

winrm quickconfig -q

# Enable authentication (Kerberos / Negotiate)
Set-Item -Path WSMan:\localhost\Client\AllowUnencrypted -Value $true
Set-Item -Path WSMan:\localhost\Client\Auth\Basic -Value $false
Set-Item -Path WSMan:\localhost\Client\Auth\Kerberos -Value $true
Set-Item -Path WSMan:\localhost\Client\Auth\Negotiate -Value $true

# Read existing TrustedHosts
$existing = (Get-Item -Path WSMan:\localhost\Client\TrustedHosts).Value

if ([string]::IsNullOrWhiteSpace($existing)) {
    # Nothing set yet
    $newValue = $WinRMServer
}
elseif ($existing -notmatch "(^|,)\s*$WinRMServer\s*(,|$)") {
    # Append only if not already present
    $newValue = "$existing,$WinRMServer"
}
else {
    # Already present, keep as is
    $newValue = $existing
}

# Apply value
Set-Item -Path WSMan:\localhost\Client\TrustedHosts -Value $newValue -Force

    2. Open PowerShell as Administrator.

    3. Navigate to the script location.

    4. Run the following command and modify <winrm-server> to a fully qualified domain name of the WinRM server.

      powershell -ExecutionPolicy Bypass -File .\setup-winrm-client.ps1 -WinRMServer <winrm-server>

Custom scripts

When adding P12, JKS, or PEM endpoints to an orchestration gateway, you can optionally configure custom scripts for specific actions.

  • Installation script — When configured, the script runs after the certificate and private key entries have been successfully created in the target keystore. This script is invoked with the alias of the newly created keystore entry passed as a parameter. Custom scripts must be implemented to accept this parameter.

    The following is the example of how the installation script is invoked:

    • Windows:

      .\install.ps1 -Alias "<value>"

    • Linux:

      ./install.sh --alias=<value>

  • Restart script — When configured, this script runs when Restart is clicked in SCM. This script is for specific actions that should be triggered explicitly as an independent step rather than as part of the installation process.