Trust a Custom CA

Required Tenable Security Center User Role: tns user

You can configure Tenable Security Center Director to trust a custom CA for certificate authentication or other uses. Common reasons to trust a custom CA include:

  • Your organization uses an internal certificate authority to sign TLS certificates, and Tenable Security Center Director must connect to services signed by that CA.

  • Your network uses an SSL inspection proxy that re-signs traffic with a corporate CA.

  • You are configuring certificate-based user authentication. For more information, see SSL Client Certificate Authentication.

To configure Tenable Security Center Director to trust a custom CA:

  1. Log in to Tenable Security Center Director via the user interface.

  2. Copy the required PEM-encoded CA certificate (and intermediate CA certificate, if needed) to the Tenable Security Center Director server’s /tmp directory. In this example, the file is named ROOTCA2.cer.

    Note: If you upload multiple certificates, upload each certificate individually in Privacy-Enhanced Mail (PEM) format. You must also upload certificate chain files individually in PEM format.

    PEM-encoded files begin with -----BEGIN CERTIFICATE-----. If your certificate file is in DER format (binary), convert it to PEM before proceeding:

    openssl x509 -inform DER -in ROOTCA2.cer -out ROOTCA2.pem

    Then use the converted .pem file in the following steps.

  3. Run the installCA.php script to create the required files for each CA in /opt/sc/data/CA:

    # /opt/sc/support/bin/php /opt/sc/src/tools/installCA.php /tmp/ROOTCA2.cer

    Tenable Security Center Director processes all the CAs in the file.

  4. Restart Tenable Security Center Director, as described in Start, Stop, or Restart Tenable Security Center Director.

  5. (Optional) Verify the CA was installed by confirming the certificate files exist in /opt/sc/data/CA/:

    ls /opt/sc/data/CA/

    The directory should contain the CA files created by the installCA.php script. If the files are not present, re-run the script and check for error output.