- Overview
- Reference Guide
- Setup & Architecture
- Release Notes
- Workflow
- API Reference
- Integration Guide
- Discovery Agent Setup Guide
Windows
This section explains how to install CertSecure Manager v3.3 on Windows Server 2025 with the CertSecure Manager Installer 3.3 wizard. The whole stack (backend, frontend, Keycloak and Nginx) is installed on a single server, and the installation runs offline.
The installation has four stages:
- Before You Begin: check the requirements, and plan the host names, TLS certificate and ports.
- Prepare the Installation Media: copy the ISO to the server and mount it.
- Run the Installation Wizard: complete the seven wizard steps (about 15 minutes).
- After Installation: verify the services, store the Keycloak credentials and replace the TLS certificate.
When the installation is finished, continue with First Login to create the administrator account and activate the license. To upgrade an existing installation, see Upgrade > Windows.
This section covers preparation, every page of the wizard, what the installer configures, and how to check the result.
It is written for system administrators who install and run CertSecure Manager. You should be comfortable with Windows Server administration, DNS, and TLS certificates.
What Gets Installed
The installer sets up the complete CertSecure Manager stack on one server. It works offline: every component is on the installation media, and no internet access is required.
Table 1: Installed Components
| Component | Purpose | Installed when |
|---|---|---|
| CertSecure Manager Backend | API server for certificate lifecycle management | Always (fresh install or upgrade) |
| CertSecure Manager Frontend | Web user interface, served by Nginx | Always (ships with the backend) |
| Keycloak | Identity server that handles sign-in and access control | Always, unless an existing Keycloak is reused |
| Nginx | Reverse proxy. Handles TLS on port 443 for the frontend, the API and Keycloak | Always |
| MongoDB Server and MongoDB Shell | Database for CertSecure Manager | Only if not already present |
| OpenSSL (64-bit) | Cryptographic toolkit used by CertSecure Manager | Only if not already present |
| Java (JDK) | Runtime required by Keycloak | Only if not already present |
| Python 3.12 | Runtime for the backend's Python environment | Only if the matching version is not present |
Note: All third-party components install silently. You do not need to click through separate MongoDB, OpenSSL, Java or Python setup wizards.
Architecture at a Glance
Users reach CertSecure Manager only through Nginx on port 443. Nginx picks the destination by host name, so the frontend, the API and Keycloak each need their own host name:
Table 2: Host Names and Routing
| Host name (example) | Nginx forwards to | Listens on |
|---|---|---|
| certsecure.com (frontend) | Static web UI files | Served directly by Nginx |
| api.certsecure.com (backend) | CertSecure backend | https://127.0.0.1:5000 (local only) |
| auth.certsecure.com (Keycloak) | Keycloak | https://127.0.0.1:8443 |
MongoDB listens on localhost:27017. The examples in this section use the host names above; replace them with your own.
Before You Begin
Requirements Checklist
Table 3: Requirements Checklist
| Requirement | Details |
|---|---|
| Operating system | Windows Server 2025 (Standard or Datacenter). These steps were validated on Windows Server 2025 Datacenter, build 26100. |
| Hardware | One server with at least 16 CPU cores, 16 GB RAM and 100 GB free disk space. |
| Account | A local or domain account in the Administrators group. The installer asks for elevation (UAC) when it starts. |
| .NET Framework | 4.7.2 or later. Windows Server 2025 includes this by default. |
| Port 443 | Must be free. If IIS or another web server is bound to 443, stop it or move it before you install. The installer stops at the Nginx step if port 443 is in use. |
| Ports 5000, 8080, 8443, 9000, 27017 | Must be free on the server. They are used locally by the backend, Keycloak and MongoDB. |
| Host names | Three different host names: frontend, backend (API) and Keycloak. See Plan Your Host Names. |
| TLS certificate | Optional at install time. You can replace the default certificate afterwards. See TLS Certificate. |
| Installation media | CertSecure Manager v3.3 - Windows Installation Suite.iso, about 2 GB. |
| Internet access | Not required. |
Important: The installation folder is fixed at C:\Program Files (x86)\CertSecure and cannot be changed in the wizard. Make sure drive C: has enough free space for the application, MongoDB data and logs.
For the configuration steps after installation, also have these ready:
- A valid CertSecure Manager license key.
- A Microsoft ADCS Certificate Authority reachable from the server, for certificate issuance.
- An Active Directory service account for the LDAP bind, with read access to the user and group containers.
- An Azure AD (Microsoft Entra) tenant with permission to create an app registration, if single sign-on is required.
- An SMTP server or internal mail relay for notification delivery.
Plan Your Host Names
Decide the three host names before you start. You type them on the Configure Server Settings page of the wizard.
Table 4: Host Name Settings
| Setting | Example value | Rules |
|---|---|---|
| Frontend URL | https://certsecure.com | Must be an absolute https URL. The port (if any) becomes the public Nginx port; 443 if omitted. |
| Backend URL | https://api.certsecure.com | Must use a different host name from the frontend. The port (if any) is the backend's local port; 5000 if omitted. |
| Keycloak URL | https://auth.certsecure.com | Must use https, have no port of its own, and use a host name different from the frontend and backend. |
| Keycloak realm name | auth.certsecure.com | Letters, digits, dot, dash and underscore only. |
Important: The wizard pre-fills https://localhost:443 and https://localhost:5000. These defaults share the same host name and are rejected. Replace them with your own host names.
Make the Host Names Resolve
Users' browsers and the server itself must resolve all three names to this server. The recommended approach for production is to create DNS A records (or CNAMEs) that point to the server's IP address.
During installation, the installer also checks name resolution on the server itself:
- If a name does not resolve, the installer adds 127.0.0.1 <name> to the server's hosts file, marked # Added by the CertSecure installer.
- If a name resolves to another machine, the installer asks whether to add a local override (see Step 6: Install).
For a lab or a single-server evaluation, you can add the entries yourself before you install:
- Open Notepad as Administrator.
- Open C:\Windows\System32\drivers\etc\hosts.
-
Add one line per host name, as shown below, and save the file.
127.0.0.1 certsecure.com 127.0.0.1 api.certsecure.com 127.0.0.1 auth.certsecure.com
Note: Hosts file entries only affect the computer they are on. Client computers that browse to CertSecure Manager need DNS records or their own hosts file entries that point to the server's IP address, not 127.0.0.1.
TLS Certificate
Nginx terminates TLS for all three host names with a single certificate. The installer does not create a certificate. It uses the first certificate it finds, in this order:
- The certificate already used by a previous installation (upgrades only).
- An existing cert.pem and privkey.pem in the Nginx conf folder.
- The cert.pem and key.pem included with the CertSecure application package.
On a fresh install, the certificate included in the package is used, so browsers may show a certificate warning. For production, replace it after installation with a certificate from your organization's CA. The certificate must cover all three host names, for example through Subject Alternative Names or a wildcard. Replace the TLS Certificate explains how.
Ports Used
Table 5: Ports Used
| Port | Used by | Exposure |
|---|---|---|
| 443 (TCP) | Nginx: frontend, API and Keycloak | Public. The installer adds an inbound firewall rule. |
| 5000 (TCP) | CertSecure backend (default) | Local only (127.0.0.1) |
| 8080 (TCP) | Keycloak HTTP | Local only (127.0.0.1) |
| 8443 (TCP) | Keycloak HTTPS (reached through Nginx) | No firewall rule is added. Keep it blocked inbound. |
| 9000 (TCP) | Keycloak health and management | Used locally for health checks |
| 27017 (TCP) | MongoDB | Local (default connection string) |
Port 80 is not used. There is no HTTP listener and no HTTP-to-HTTPS redirect.
Prepare the Installation Media
- Copy the ISO image CertSecure Manager v3.3 - Windows Installation Suite.iso to the server, for example to the Downloads folder.
- Double-click the ISO, or right-click it and choose Mount.
- If the Open File - Security Warning dialog appears, confirm the file is from Encryption Consulting and click Open.
Windows mounts the image as a new DVD drive labelled CSM-CLM (for example E:) and opens it. The root of the drive contains:
Table 6: Contents of the Installation Media
| Item | Description |
|---|---|
| CertSecure Manager Installer 3.3.exe | The installation wizard |
| src\ | Component packages: CertSecure, MongoDB, OpenSSL, Java, Python, Nginx, Keycloak |
| icons\ | Images used by the wizard |
| install\ | Keycloak realm template |
| LICENSE, manifest.json | License text and build manifest |
Tip: If a .sha256 checksum file came with the ISO, check the image before you mount it. Run the command below in PowerShell, then compare the result with the value in the file.
Get-FileHash .\<iso-name>.iso -Algorithm SHA256Important: Run the installer from the root of the mounted drive. Do not copy the .exe to another folder on its own, because it reads its packages from the src and install folders next to it.
Run the Installation Wizard
Step 1: Start the Installer
- In the mounted drive, double-click CertSecure Manager Installer 3.3.
- When User Account Control asks for permission, click Yes.
The CertSecure Manager Installation Wizard window opens. If you close the window at any point, the wizard asks you to confirm before it exits.
Note: The installer starts writing a log as soon as it opens, to C:\Users\Public\Documents\CertSecureLogs\<date-time>\InstallationLog.log.
Step 2: Welcome
Read the welcome text and click Next.
Step 3: License Agreement
- Read the license agreement.
- Select I accept the terms and conditions. The Next button stays disabled until you do.
- Click Next.
Step 4: Choose Installation Options
This page shows the installation folder and the components that will be installed:
- Installation folder: C:\Program Files (x86)\CertSecure (fixed)
- CertSecure Manager - Backend and Frontend
- Keycloak - Identity Server
- Nginx - Reverse Proxy (serves the frontend, fronts the API and Keycloak)
- MongoDB, OpenSSL, Python and Java (installed only if not already present)
You cannot deselect components; all of them are required.
If an Existing Installation Is Found
If CertSecure Manager is already installed, an Existing Installation Found dialog appears when this page opens:
- Click Yes to upgrade. Your configuration, certificates and Keycloak realm are carried forward, and the page shows Upgrade mode. See Upgrade > Windows.
- Click No to continue without reusing the existing configuration. The existing application files are left in place and are not replaced.
Confirm
- Click Next.
- In the Confirmation dialog, check the path C:\Program Files (x86)\CertSecure\CertSecure Manager and click Yes.
Step 5: Configure Server Settings
Enter the connection details planned in Plan Your Host Names.
Table 7: Server Settings
| Field | What to enter | Default |
|---|---|---|
| MongoDB Connection String | URI of the MongoDB server. Keep the default to use the local MongoDB the installer sets up. | mongodb://localhost:27017 |
| CertSecure Frontend URL | Public URL of the web interface, e.g. https://certsecure.com | https://localhost:443 (must be changed) |
| CertSecure Backend URL | Public URL of the API, e.g. https://api.certsecure.com | https://localhost:5000 (must be changed) |
| Keycloak URL | Public URL of Keycloak, e.g. https://auth.certsecure.com | Filled in automatically as https://kc.<base domain> |
| Keycloak Realm Name | Name of the Keycloak realm, e.g. auth.certsecure.com | Filled in automatically as <base domain> |
- When you leave the Frontend URL box, the wizard suggests the Keycloak URL and realm name from the frontend host name. The base domain is the host name with its first label removed: for example, portal.example.com gives kc.example.com and realm example.com. You can overwrite both suggestions.
- The TLS Certificate note on this page is information only. The certificate is configured automatically (see TLS Certificate).
- Next is enabled once the Frontend, Backend, Keycloak URL and realm fields are all filled in. When you click it, the wizard validates the values. If something is wrong, an Invalid Configuration dialog explains it:
Table 8: Validation Messages
| Message | How to fix it |
|---|---|
| The MongoDB connection string is not a valid URI. | Use the form mongodb://host:port. |
| The frontend / backend URL is not a valid absolute URL. | Include https:// and a host name. |
| The frontend and backend host names must differ - nginx routes between them by server_name. | Use different host names, e.g. certsecure.com and api.certsecure.com. |
| The Keycloak URL must use https. | Start the URL with https://. |
| Nginx serves Keycloak on port 443 ... Remove the ':port' from the Keycloak URL ... | Remove the port from the Keycloak URL. |
| The Keycloak realm name may only contain letters, digits, dot, dash and underscore. | Remove spaces and other characters. |
| The Keycloak host name must differ from the frontend and backend host names. | Give Keycloak its own host name, e.g. auth.certsecure.com. |
Step 6: Install
The Installing CertSecure Manager page shows a progress bar and a live log.
- Click Start. Installation does not begin until you do.
- Wait for the installation to finish. On the test server it took about 15 minutes. Building Keycloak and setting up the Python environment are the slowest steps. Do not close the wizard while it runs.
The installer works through these stages. Every stage is written to the log box and to InstallationLog.log.
Table 9: Installation Stages
| # | Stage | What happens |
|---|---|---|
| 1 | MongoDB | Installs MongoDB Server 8.0 as the MongoDB Windows service (data in C:\Program Files\MongoDB\data) and the MongoDB Shell, if not already present. |
| 2 | OpenSSL | Installs OpenSSL 64-bit to C:\Program Files\OpenSSL-Win64 and adds it to the system PATH, if not already present. |
| 3 | Java | Finds an existing JDK, or installs the bundled one for Keycloak. |
| 4 | Python | Installs Python 3.12 for all users and adds it to the system PATH, if not already present. |
| 5 | CertSecure application | Extracts the backend and frontend to ...\CertSecure Manager\Backend. |
| 6 | Nginx | Checks that port 443 is free, extracts Nginx, deploys the TLS certificate, writes the site configuration, tests it, and registers the EC_CSM_FE service and a firewall rule. |
| 7 | Keycloak | Extracts Keycloak, builds it, imports the realm, creates the administrator accounts, registers the EC_CSM_KC service, and waits until it reports healthy (up to 5 minutes). |
| 8 | Configuration | Writes the backend configuration, creates the Python environment, registers the EC_CSM_BE service, runs pre-flight checks, starts all services, checks host names and sets up log rotation. |
Dialogs That May Appear During Installation
| Dialog | Meaning and action |
|---|---|
| Host Names Point Elsewhere | One or more host names resolve to an address that is not on this server. Click Yes to add local hosts-file overrides that point them to 127.0.0.1. Click No if your DNS is intentionally pointing elsewhere, for example to a load balancer. |
| Pre-flight Check Failed | A prerequisite was not met, so the backend service was not started. The dialog lists the failed checks. Fix them, then start the service from Services. |
| Service Start Failed | One or more CertSecure services did not start. Check the installer log (C:\Users\Public\Documents\CertSecureLogs\<date-time>\InstallationLog.log) for the cause. |
When installation succeeds, the log shows ===== All services started successfully =====, confirms that each host name resolves on this machine, and prints Browse to https://certsecure.com/ (your frontend URL). The message CertSecure Manager was successfully installed! appears. Click OK, then Next.
Tip: Click Open Logs... at any time after the run finishes to open the folder with this run's log files.
Step 7: Finish
The Installation Completed Successfully page confirms the installation. Click Finish to close the wizard, then eject the mounted ISO.
If installation failed, the Installation Failed page appears instead. Click Open Logs... on the previous page to review the logs, then click Close.
Important: A failed fresh installation is not rolled back automatically. Components installed before the failure remain on the server. Fix the cause and run the installer again; it skips components that are already present.
What the Installer Configures
Windows Services
Table 10: Windows Services
| Service name | Display name | Runs |
|---|---|---|
| MongoDB | MongoDB Database Server (MongoDB) | MongoDB database |
| EC_CSM_KC | EC_CertSecure_Keycloak_Service | Keycloak identity server |
| EC_CSM_FE | EC_CertSecure_Frontend_Service | Nginx (web UI and reverse proxy) |
| EC_CSM_BE | EC_CertSecure_Backend_Service | CertSecure Manager backend |
- All services start automatically when Windows starts.
- EC_CSM_BE depends on MongoDB and EC_CSM_KC.
- The three EC services restart automatically if they fail: after 10 seconds, then 30 seconds, then 60 seconds.
- Start order: MongoDB, EC_CSM_KC, EC_CSM_FE, EC_CSM_BE.
Folders and Files
Installation root: C:\Program Files (x86)\CertSecure\CertSecure Manager
Table 11: Folders and Files
| Path | Contents |
|---|---|
| Backend\ | CertSecure application, Python environment (venv) and configuration |
| Backend\conf.ini, Backend\conf\server.yaml | Backend settings (database, URLs, ports, identity server) |
| Backend\conf\certsecure-nginx.conf | Nginx site configuration for the three host names |
| Backend\conf\keycloak-credentials.txt | Generated Keycloak credentials (Administrators and SYSTEM only) |
| Backend\UI\cert-secure-manager\ | Frontend web files (config.js holds the URLs) |
| Nginx\conf\cert.pem, privkey.pem | TLS certificate and private key used by Nginx, Keycloak and the backend |
| Nginx\logs\ | Nginx access and error logs |
| Keycloak\conf\keycloak.conf | Keycloak settings |
| Keycloak\logs\keycloak.log | Keycloak log |
| rotate-logs.ps1, uninstall.ps1 | Log rotation and uninstall scripts |
Other locations:
- MongoDB data and logs: C:\Program Files\MongoDB\data and C:\Program Files\MongoDB\log
- Installer logs: C:\Users\Public\Documents\CertSecureLogs\<date-time>\
Other System Changes
Table 12: Other System Changes
| Change | Details |
|---|---|
| Firewall rule | CertSecure Manager (HTTPS): inbound TCP on the frontend port (443 by default) |
| Scheduled task | CertSecure Manager Log Rotation: runs daily at 00:30 as SYSTEM. Rotates MongoDB and Nginx logs once they reach 20 MB, keeping 10 copies, and keeps the 10 newest installer log folders. |
| System PATH | OpenSSL bin, Python and Python Scripts folders added |
| Hosts file | Entries for any host names that did not resolve, marked # Added by the CertSecure installer |
| Apps & Features | CertSecure Manager entry (publisher Encryption Consulting LLC) with an uninstall option |
After Installation
Verify the Services
Open Services (services.msc) and check that MongoDB, EC_CSM_KC, EC_CSM_FE and EC_CSM_BE are Running with startup type Automatic. Or run this in PowerShell:
Get-Service MongoDB, EC_CSM_KC, EC_CSM_FE, EC_CSM_BE |
Format-Table Name, Status, StartTypeOptional health checks from the server:
# Keycloak readiness (expect HTTP 200)
curl.exe -k https://127.0.0.1:9000/health/ready
# Backend (expect HTTP 200; use your backend port if not 5000)
curl.exe -k https://localhost:5000/checkAccess CertSecure Manager
Table 13: Access URLs
| What | URL (example) |
|---|---|
| CertSecure Manager web interface | https://certsecure.com/ |
| CertSecure API | https://api.certsecure.com/ |
| Keycloak administration console | https://auth.certsecure.com/admin/ |
Open the frontend URL in a browser. If the default certificate is still in use, the browser shows a certificate warning until you install a trusted certificate (see Replace the TLS Certificate).
Keycloak Credentials
The installer generates all Keycloak passwords and secrets at random. There are no default passwords. They are saved in:
C:\Program Files (x86)\CertSecure\CertSecure Manager\Backend\conf\keycloak-credentials.txtOnly Administrators and SYSTEM can read this file. It contains:
- The Keycloak admin console URL
- The master realm administrator: username admin-certsecure and its password
- The realm name
- The realm service account admin-svc, with its email and password
- The client ID (certsecure.<realm>) and client secret used by the backend
Important: Store these credentials in your organization's password vault, then restrict or remove the file. Changing the admin-svc password or the client secret in Keycloak also requires updating the backend configuration (server.yaml).
Sign in to the Keycloak admin console as admin-certsecure to create CertSecure Manager users and set up identity federation (for example Active Directory/LDAP or SSO) as your organization needs.
Replace the TLS Certificate
To use a certificate issued by your organization:
- Get a certificate and private key in PEM format that cover the frontend, backend and Keycloak host names.
- Back up the existing files in C:\Program Files (x86)\CertSecure\CertSecure Manager\Nginx\conf\.
- Replace cert.pem with the certificate (including the intermediate chain) and privkey.pem with the unencrypted private key.
-
Restart the services so that Nginx, Keycloak and the backend all load the new certificate:
Restart-Service EC_CSM_KC, EC_CSM_FE, EC_CSM_BE
Make sure client computers trust the issuing CA, then browse to the frontend URL and confirm that no warning appears.
Security Recommendations
- Replace the default TLS certificate before production use.
- Move the generated credentials to a password vault, as described in Keycloak Credentials.
- Delete or restrict access to C:\Program Files (x86)\CertSecure\CertSecure Manager\Backend\conf\kc-realm-init.json. It is a copy of the imported realm and contains the generated secrets.
- Keep only port 443 open inbound. Ports 5000, 8080, 8443, 9000 and 27017 should not be reachable from other machines.
- Back up C:\Program Files\MongoDB\data and the Backend\conf folder regularly.
First Login
Page 2: Admin Configuration
- Because Keycloak is enabled, the Realm Initialization step is skipped automatically.
| Field | Description |
|---|---|
| First Name | The administrator's first name. |
| Last Name | The administrator's last name. |
| The administrator's email address. This becomes the login username. | |
| Password | Create a strong password for the admin account. |
| Select Realm | Choose the realm created during installation. |
- Click Sign In to continue.
Page 3: License Activation
- Enter the license key in the activation key field.
- Click Activate to apply the license.
Post Setup: Sign In to CertSecure Manager
- Enter your email ID and password on the CertSecure Manager sign-in page.
- Click Sign In to access the dashboard.
Service Integrations
Email (SMTP) Configuration
CertSecure Manager supports two types of SMTP servers:
Authenticated SMTP servers require a username and password, such as Office 365 or Gmail, and typically operate on port 587 with TLS.
Anonymous relays are internal mail relays that require no credentials and instead control access by sender IP address. Common in enterprise environments, these typically operate on port 25 without TLS.
To configure:
- Navigate to Misc > Service Setup
- Click on the SMTP tab
- Configure email service settings:
| Setting | Description |
|---|---|
| SMTP Host | Your email server or relay hostname (for example, smtp.office365.com or relay.corp.local). |
| Port | SMTP port number. Typically 587 for authenticated servers with TLS, or 25 for internal anonymous relays. |
| The sender ("From") address for all CertSecure notifications. For authenticated servers this is the login mailbox with MFA disabled; for anonymous relays it must be permitted by the relay's sender policy. | |
| Password | The email account password. Leave blank for anonymous relays. When no password is provided, CertSecure connects without authenticating. |
| Use TLS (STARTTLS) | Enabled by default. Disable for internal relays that do not support STARTTLS, including most port-25 anonymous relays. Leaving it enabled against such a relay will cause sends to fail. |
- Click "Save" to apply SMTP settings
- Click "Test", enter a valid email address, and then click "Test" again to verify the configuration. The result is reported immediately; if the test fails, the error message indicates the cause (e.g., connection refused, relay access denied, authentication rejected)
Notes:
The SMTP server must be reachable from the CertSecure Manager backend server on
the configured port. Verify both host and network firewall rules.
For
anonymous relays, the backend server's IP address must be added to the relay's
permitted-senders list: the receive connector's remote IP ranges on Microsoft
Exchange, or mynetworks on Postfix. Without this, sends fail with "550 5.7.1
Unable to relay".
SSL-only ports such as 465/SMTPS are not supported. Use
STARTTLS on port 587 instead.
Microsoft Teams Integration
- Navigate to Misc > Service Setup
- Click on the Teams tab
-
Configure Microsoft Teams notifications:
- Microsoft Teams Webhook: Paste your Teams webhook URL
- Click "Configure" to enable Teams integration
ServiceNow Integration
- Navigate to Misc > Service Setup
- Click on the Service Now tab
- Configure ServiceNow connection:
| Field | Description |
|---|---|
| Service Now Instance URL | Your ServiceNow instance URL (for example, https://yourinstance.servicenow.com). |
| Username | ServiceNow service account username. |
| Password | ServiceNow service account password. |
- Click "Save" then “Sync” to finalize ServiceNow integration
Azure AD Settings Configuration
Generate Azure AD Credentials
- Go to Microsoft Entra
- Navigate to Identity > Applications > App registrations.
- Click “New registration”.
- Name: <Azure_AD_Name>
- Supported account types: Single tenant
- Enter Redirect URI
- Select “Web” for Redirect URI
- Click Register
- Go to Certificates & secrets > Certificates > New client secret.
- Add a description for your client secret.
- Select an expiration for the secret.
- Select Add.
- Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.
API Permissions
- Go to API Permissions
- In the left menu, click API permissions
- Click + Add a permission
- Choose Microsoft Graph
Add the following Delegated permissions
- User.Read
- User.Read.All
- GroupMember.Read.All
- User.ReadBasic.All
Add the following Application permissions
- User.ReadBasic.All
- Group.Read.All
Grant Admin Consent
- In the API permissions page, click "Grant admin consent for <YourOrgName>"
- Confirm in the prompt
Setting up on CertSecure Manager
- Go to CertSecure Manager
- Navigate to Misc > Settings > Configure Realms
- Click on the Realms that you want to add Azure as Identity Providers.
- Click on Configure in Identity Providers
- Configure Azure AD integration:
| Field | Description |
|---|---|
| Redirect URI | Auto-generated by the CertSecure Manager Keycloak setup. Copy this value and add it as the Redirect URI in your Azure app registration. |
| Alias | A unique internal identifier for the identity provider (for example, ec-microsoft-sso). |
| Display Name | The name shown on the CertSecure Manager login page (for example, Encryption Consulting Azure SSO). |
| Client ID | Your Azure application (client) ID. |
| Client Secret | The client secret value you recorded from Azure. |
| Tenant ID | Your Azure directory (tenant) ID. |
- Click "Save" to apply Azure AD settings
Note: An AD admin may be required to log in to CertSecure Manager to grant necessary permissions before anyone else can log in.
Realm Setup
This is the post-initialization configuration for Keycloak. In this section you connect the CertSecure Manager realm to Azure AD to enable single sign-on, then bind the realm to Active Directory over LDAP so users and groups synchronize automatically.
Add Azure AD as an Identity Provider
- In CertSecure Manager, navigate to Misc > Settings > Configure Realms.
- Click the existing realm you want to configure.
- Click Identity Manager, then click Add New.
- Enter the Alias and Display Name
- Copy the generated Redirect URI and paste it into your Azure app registration.
- Enter the Client ID, Client Secret, and Tenant ID recorded from Azure.
- Click Save to apply the identity provider settings.
- In Azure, add the copied Redirect URI to the app registration and save it.
- Confirm the redirect type is set to Web and the configuration is applied.
Add LDAP as a Federated Authentication Method
- Add an LDAP user federation provider for the Microsoft ADCS Active Directory forest.
- Enter the Alias and Connection URL for the domain controller.
- Click Test connection and confirm it succeeds before continuing.
- Enter the Bind DN, the service account used to query the directory.
- Enter the Bind Credential, the password for that service account.
- Click Test authentication to verify the bind account.
- Enter the Users DN, the base distinguished name Keycloak searches for user accounts.
- Set Full Sync Period to 3600 seconds.
- Set Changed Users Sync Period to 3600 seconds.
- Click Save, then run a manual sync to populate users immediately.
Department Setup
Before any user can be added, a department must be created.
Page 1: Access Department Management
- Navigate to Administration > Departments
- Click on Add Department button
- This opens the department creation form
Page 2: Create New Department
-
Enter department information:
- Department Name: Enter a descriptive name for the department (e.g., "IT Support", "PKI", "Dev")
- Click Add to create the department.
- The new department will appear in the departments list.
- Repeat this process to add additional departments as needed.
- Assign Certificate Authorities (CAs) and certificate templates to departments by clicking on Add after the department has been created. Choose the CA from the drop-down, click Apply, choose templates and then click on Submit. Users in a particular department can access only the assigned CAs and templates.
User Management
Page 1: Access User Management
- Navigate to Administration > Users
- Click on the Users tab
Click Add User button to create a new user account
Page 2: Create New User
- Fill in the new user details:
| Field | Description |
|---|---|
| First Name | The user's first name. |
| Last Name | The user's last name. |
| The user's email address. This becomes their login username. | |
| Roles | Select the appropriate roles for the user from the dropdown menu. |
| Department | Assign the user to a department from the available options. |
- Click "Done" to complete user creation
