HydrantId operates a PKI as a service platform for customers around the globe. The AnyGateway solution for HydrantId is designed to allow Keyfactor Command the ability to: - Sync certificates issued from the CA - Request new certificates from the CA - Revoke certificates directly from Keyfactor Command -Renew or Reissue Certificates from the CA
This repository contains an AnyGateway CA Connector, which is a plugin to the Keyfactor AnyGateway. AnyGateway CA Connectors allow Keyfactor Command to be used for inventory, issuance, and revocation of certificates from a third-party certificate authority.
HydrantId is supported by Keyfactor for Keyfactor customers. If you have a support issue, please open a support ticket with your Keyfactor representative.
To report a problem or suggest a new feature, use the Issues tab. If you want to contribute actual bug fixes or proposed enhancements, use the Pull requests tab.
To begin, you must have the CA Gateway Service 21.3.2 installed and operational before attempting to configure the HydrantId plugin. This integration was tested with Keyfactor 9.3.0.0. To install the gateway follow these instructions.
-
Gateway Server - run the installation .msi obtained from Keyfactor
-
Gateway Server - If you have the rights to install the database (usually in a Non SQL PAAS Environment) Using Powershell, run the following command to create the gateway database.
SQL Server Windows Auth
%InstallLocation%\DatabaseManagementConsole.exe create -s [database server name] -d [database name]Note if you are using SQL Authentication, then you need to run
SQL Server SQL Authentication
%InstallLocation%\DatabaseManagementConsole.exe create -s [database server name] -d [database name] -u [sql user] -p [sql password]If you do not have rights to created the database then have the database created ahead of time by the support team and just populate the database
Windows Authentication
%InstallLocation%\DatabaseManagementConsole.exe populate -s [database server name] -d [database name]SQL Server SQL Authentication
%InstallLocation%\DatabaseManagementConsole.exe populate -s [database server name] -d [database name] -u [sql user] -p [sql password] -
Gateway Server - run the following Powershell to import the Cmdlets
C:\Program Files\Keyfactor\Keyfactor AnyGateway\ConfigurationCmdlets.dll (must be imported into Powershell)
Import-Module C:\Program Files\Keyfactor\Keyfactor AnyGateway\ConfigurationCmdlets.dll
-
Gateway Server - Run the Following Powershell script to set the gateway encryption cert
This cmdlet will generate a self-signed certificate used to encrypt the database connection string. It populates a registry value with the serial number of the certificate to be used. The certificate is stored in the LocalMachine Personal Store and the registry key populated is:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvcProxy\Parameters\EncryptSerialNumberNo parameters are required to run this cmdlet. -
Gateway Server - Run the following Powershell Script to Set the Database Connection
This cmdlet will set and encrypt the database connection string used by the AnyGateway service.
Windows Authentication
Set-KeyfactorGatewayDatabaseConnection -Server [db server name] -Database [database name]
SQL Authentication
$KeyfactorCredentials = Get-Credentials Set-KeyfactorGatewayDatabaseConnection -Server [db server name] -Database [database name] -Account [$KeyfactorCredentials]
It is important to note that importing the HydrantId configuration into the CA Gateway after installing the binaries must be completed. Additionally, the CA Gateway service must be running in order to succesfully import the configuation. When the CA Gateway service starts it will attempt to validate the connection information to the CA. Without the imported configuration, the service will fail to start.
- Get the Latest Zip File from Here
- Gateway Server - Copy the HawkNet.dll, The HydrantIdProxy.dll and the HydrantIdProxy.dll.config to the location where the Gateway Framework was installed (usually C:\Program Files\Keyfactor\Keyfactor AnyGateway)
-
Gateway Server - Edit the CAProxyServer.exe.config file and replace the line that says "NoOp" with the line below:
<alias alias="CAConnector" type="Keyfactor.HydrantId.HydrantIdProxy, HydrantIdProxy"/> -
Gateway Server - Install the Root HydrantId Certificate that was received from HydrantId
-
Gateway Server - Install the Intermediate HydrantId Certificate that was received from HydrantId
-
Gateway Server - Take the sample Config.json located Here and make the following modifications
- Security Settings Modifications (Swap this out for the typical Gateway Security Settings for Test or Prod)
"Security": {
"KEYFACTOR\\administrator": {
"READ": "Allow",
"ENROLL": "Allow",
"OFFICER": "Allow",
"ADMINISTRATOR": "Allow"
},
"KEYFACTOR\\SVC_AppPool": {
"READ": "Allow",
"ENROLL": "Allow",
"OFFICER": "Allow",
"ADMINISTRATOR": "Allow"
},
"KEYFACTOR\\SVC_TimerService": {
"READ": "Allow",
"ENROLL": "Allow",
"OFFICER": "Allow",
"ADMINISTRATOR": "Allow"
}
- Hydrant Environment Settings (Modify these with the keys and Urls obtained from HydrantId)
"CAConnection": {
"HydrantIdBaseUrl": "https://acm-stage.hydrantid.com",
"AuthId": "SomeAuthId",
"AuthKey": "SomeAuthPassword",
"TemplateSync": "On"
}
- Service Settings (Modify these to be in accordance with Keyfactor Standard Gateway Production Settings)
"ServiceSettings": {
"ViewIdleMinutes": 1,
"FullScanPeriodHours": 1,
"PartialScanPeriodMinutes": 1
}
- Gateway Server - Save the newly modified config.json to the following location "C:\Program Files\Keyfactor\Keyfactor AnyGateway"
The Template section will map the CA's products to an AD template.
ProductIDThis is the ID of the HydrantId product to map to the specified template. If you don't know the available product IDs in your Hydrant account, put a placeholder value here and run the Set-KeyfactorGatewayConfig cmdlet according to the AnyGateway documentation. The list of available product IDs will be returned.ValidityPeriodREQUIRED: The period to use when requesting certs. It could be, Days, Months, Years depending on the Template.ValidityUnitsREQUIRED: The numeric value corresponding to the ValidityPeriod. For years 1 would be 1 year, for days 7 would be 7 days.
"Templates": {
"AutoEnrollment - RSA": {
"ProductID": "AutoEnrollment - RSA",
"Parameters": {
"ValidityPeriod": "Years",
"ValidityUnits": 1
}
},
"AutoEnrollment - RSA - 7 Day": {
"ProductID": "AutoEnrollment - RSA - 7 Day",
"Parameters": {
"ValidityPeriod": "Days",
"ValidityUnits": 7
}
}
}=======
- Command Server - Copy and Unzip the Template Setup Files located Here
- Command Server - Change the Security Settings in the CaTemplateUserSecurity.csv file to the appropriate settings for Test or Production
- Command Server - Run the CreateTemplate.ps1 file and choose option 1 to create the templates in active directory. Note if you get errors the URL to the API or Security is likely wrong. Make sure the API calls are run with an administrator user in KF Command
- Command Server - Use the Keyfactor Portal to Import the Templates created in Active Directory in step #3 above Note there are default values for the API Url, UserId, and Password. You will have to override the default API Questions to the appropriate values.
- Gateway Server - Start the Keyfactor Gateway Service
- Run the set Gateway command similar to below
Set-KeyfactorGatewayConfig -LogicalName "HydrantId" -FilePath [path to json file] -PublishAd- Command Server - Import the certificate authority in Keyfactor Portal