Request or Renew a Symantec VIP certificate for Enterprise Gateway or AD FS using VIP Manager

Products

• VIP Service

Issue/Introduction

An expired or revoked VIP certificate could result in abrupt VIP authentication failures. Certificate expiry notifications are sent to the TECHNICAL contact listed on the VIP Manager account (Click here to update contact information). Visual warnings are also displayed in VIP Manager in the "Notifications" window:

Symantec recommends using a Distribution List email address in the technical contact information to allow delivery of VIP certificate expiration notifications to multiple people. 

(Note: Active VIP certificates aren't automatically revoked or expired if a VIP account service-end date lapses as long as the account is renewed within 30 days of expiration.)

 

Environment

VIP Manager

VIP Enterprise Gateway

Resolution

VIP certificates provide proof of identity between your Symantec VIP Service account and VIP application (Enterprise Gateway, third-party integration, or custom applications). Certificates management is performed from your VIP Manager account by an administrator with certificate permissions. 

Generating and downloading a VIP Certificate: 

1. Log into the VIP Manager portal, select Account, then click Manage VIP Certificates in the Links pane on the right-side of the page.
2. On the Manage VIP Certificates page, click Request a Certificate.
3. Read the instructions on the Certificate Instructions page, and click Continue.
4. Type a logical name for the certificate in the Certificate Name field. Symantec suggests using a naming format that identifies where the certificate is used. (e.g., EGW98_10.10.1.1)
5. Read the text in the Important Service Requirements area, then click Submit Request.
6. Select the PKCS #12 (Public-Key Cryptography Standards #12) file format unless your application requires a PEM format. Set a secure certificate password to download.
7. Click Download Certificate and save the VIP certificate to a secure location.

Installing the new VIP certificate on the VIP Enterprise Gateway: 

1. Download the VIP certificate in the .p12 format from VIP Manager and save the VIP Enterprise Gateway server.
2. Log in to the VIP Enterprise Gateway console.
3. Click the Settings tab from the top navigation bar.
4. Select VIP Certificate from the list of links in the left column.
5. Click Add VIP Certificate.
6. Select the certificate and certificate password.
7. Give the certificate an alias. This is simply a way to identify the certificate.
8. Click Submit.
9. The VIP certificate is now imported and appears in the list of installed VIP certificates. Locate the new certificate in the list and click Use this Key from the Action column to activate the new certificate.
10. Click the Home tab from the top navigation bar and restart any services that are in a pending restart state.

Installing the new VIP certificate on an AD FS server with VIP MFA integration:

1. Download the VIP certificate in the .p12 format from VIP Manager and save it to the folder where the AD FS (Active Directory Federation Services) module is installed (typically at \Program Files\Symantec\ADFS\).
2. Launch the VIP AD FS integration Settings module with administrative privilege (typically at \Program Files\Symantec\ADFS\adfs_config.exe)
3. In the VIP Certificate field, browse to the \Program Files\Symantec\ADFS\ folder, then select the VIP certificate. 
4. Click Test Settings.
5. Enter a valid VIP user name and security code that exactly matches a user name and VIP credential in your VIP Manager.
6. If a success message is seen, click OK. 
7. Restart the AD FS service.
8. Repeat these steps on each AD FS server in the farm where the VIP integration is in use.