How to export a Windows 2008 certificate from a DC acting as CA, then importing the cert into the SSIM Agent

Products

• Security Information Manager

Issue/Introduction

One needs information on how to export a DC certificate, in addtion to importing the certificate to be used for the SSIM Agent/Collector for encrypted communications.

Resolution

When setting up a DC: Under Server Manager > Role Summary > Add Roles in Windows Server 2008, “Active Directory Certificate Services” and “Active Directory Domain Services” need to be installed prior to the steps below. You may need to add one role at a time since adding both at the same time is not possible. May require reboots in between adding roles.

Receive the Certificate

1. Install the agent and bootstrap to the Symantec Security Information Manager (SSIM).
2. Click Start > Run and type mmc in the Open text box and click OK.
3. In the console, go to File > "Add/Remove Snap-in".
4. Select Computer account, click Next
5. Select Local computer, and click Finish.
6. in the "Add/Remove Snap-ins" window verify that the "Certificates (local computer)" is present in the Selected snap-ins pane, then click OK.
7. In the mmc, expand the "Certificates (local computer)" tree and select the Personal subfolder.
8. Right click on the Personal folder and select All tasks > Request new certificate
9. Select Domain Controller as seen in the screenshot below, then click Enroll.



1. On the right, click Details before Finish.
2. Click View Certificate and go to the Details tab.
3. At the bottom right, click Copy to File.
   
   
   The export wizard displays. The exported cert is needed later.
   
4. At the "Export Private Key" window, do not export the private key
5. On the Export File Format, select DER encoded binary X.509 (CER).
6. For File to Export, click Browse and choose a location and name to save the certificate by.
   By default certificates are saved to: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
7. Click Save.
8. Exit the mmc window and save the console, in case you need to access it later.

Now Install the Symantec Event Agent (if it is not already) and the Symantec Microsoft Vista Collector.
 

Run the keytool command

1. Click Start > Run.
2. In the Open text box, type cmd and click OK.
3. Change directories into the Event Agent\jre\bin directory.
   By default this is C:\Program Files\Symantec\Event Agent\jre\bin
4. Run the command:
   
   keytool.exe -importcert -trustcacerts -alias <cert-alias-name> -file <Location of exported certificat file> -keystore "C:\Program Files\Symantec\Event Agent\jre\lib\security\cacerts" -storepass changeit
   
   Note: The <cert-alias-name> can be anything you want.