Updating the PAM Custom Connector keystore with a new certificate

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

The Deploy the Custom Connector Software documentation page was previously used to initially configure the Privileged Access Manager (PAM) Custom Connector on Windows. A new certificate was generated since the previous one expired and the JWT keystore was updated using the instructions from the documentation, but the documentation does not include instructions to create the HTTPS communication keystore from the certificate. How can the expired certificate be replaced?

Resolution

First, open Powershell and use the certutil command to create a pkcs12 formatted bundle from the certificate and key.

> certutil -MergePFX example.crt example.pfx

For the certutil command to work, the following 3 things must be true.

1. The private key for the certificate must have the .key extension
2. The certificate and key files must have the same base name
3. The certificate and key must be in the same directory

Once the pfx file is generated, use the keytool command to create the keystore.

> keytool -importkeystore -srckeystore example.pfx -srcstoretype PKCS12 -srcalias <alias> -srcstorepass <password> -destkeystore example.jks -deststoretype JKS -destalias pam -deststorepass <password>

Now that the jks file has been generated, continue with the Configure the Custom Connector Server section of the Deploy the Custom Connector documentation page to update the configuration files.