Documentation

 

 

Introduction

Use this guide to create a workaround for integrations with devices (VPNs, Gateways, etc.) that do not support the SHA-2 infrastructure.

SecureAuth recently moved its cloud services and environment to SHA256 and away from SHA-1. Though still supporting SHA-1 integrations for now, per Microsoft's Security Recommendation, SHA-1 support will cease on January 1, 2017.

Not all vendors have enabled their products for SHA-2 support, and so this guide is to enable integrations with such devices to utilize SHA-1 certificates while still upholding the SecureAuth IdP SHA-2 infrastructure.

Applies to

SecureAuth IdP appliances version 8.1+, and / or SecureAuth IdP appliances post-ACRU and utilizing SHA-2 infrastructure

Devices (VPNs, Gateways, etc.) that do not support SHA-2 ECDSA Certificates

Ensure that the current SHA-1 CA Public Certificates (expiration March 30, 2017) are uploaded to the device for the integration

If this is an existing integration, then the certificates are likely already uploaded and no changes are required; if this is a new integration, then download and upload the MFA Root 3, MFC Issuer 3 Nevada, and MFC Issuer 3 Sierra certificates to the device (download the certificates from the SecureAuth CA Public Certificates page, in the SHA-1 Public Certificates tab)

For iOS or Android Mobile Realms that use PFX, the current SHA-1 Intermediate Certificates (Sierra and Nevada - expiration March 30, 2017) must be placed into the SecureAuth IdP Appliances Certificate store

The current SHA-1 MFA Root 3 certificate is also needed for proper operation and should already be present on the appliance, but SecureAuth recommends validating that this certificate is present in the trusted roots section of the certificate store

Download the certificates from the SecureAuth CA Public Certificates page, in the SHA-1 Public Certificates tab

SecureAuth IdP Configuration Steps
System Info

1. In the SecureAuth IdP Certificate Enrollment realms for devices that do not support SHA-2 ECDSA certificates, the Certificate URL in the WSE 3.0 / WCF Configuration section of the System Info tab must be changed to utilize SHA-1 certificates instead of SHA-2

If Certificate Use WSE 3.0 is set to True, then set the Certificate URL to http://cloud.secureauth.com/legacycertservice/cert.svc/msg

If the Certificate Use WSE 3.0 is set to False (using Proxy, for example), then set the Certificate URL to https://cloud.secureauth.com/legacycertservice/cert.svc

Click Save once the configurations have been completed and before leaving the System Info page to avoid losing changes

The next required steps come in two forms: Manual and Automatic

For Manual, follow steps 2 - 4; for Automatic, utilize the SecureAuth Certificate Installer (Windows / Mac) to update SHA 1 Intermediate and Root Certificates in the SecureAuth IdP web.config files with the renewed SHA 1 certificates

Links

 

2. Select Click to edit Web Config file

Web Config Editor

 

3. Search for (CTRL + F or CMD + F) RootCert, and replace the <add key="RootCert" value="CERT" /> with the below code (RootCert Key Value)

 

4. Search for (CTRL + F or CMD + F) InterCert, and replace the <add key="InterCert" value="CERT" /> with the below code (InterCert Key Value)

RootCert Key Value
<add key="RootCert" value="MIIEATCCAumgAwIBAgIQSbISC8FA6KxOWeQbp7sjrTANBgkqhkiG9w0BAQUFADCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExDzANBgNVBAcTBklydmluZTEpMCcGA1UEChMgTXVsdGktRmFjdG9yIEF1dGhlbnRpY2F0aW9uIEluYy4xHTAbBgNVBAsTFENlcnRpZmljYXRlIFNlcnZpY2VzMRMwEQYDVQQDEwpNRkEgUm9vdCAzMB4XDTA3MDMzMDIzNDMzMVoXDTE3MDMzMDIzNTIwNFowgZIxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMQ8wDQYDVQQHEwZJcnZpbmUxKTAnBgNVBAoTIE11bHRpLUZhY3RvciBBdXRoZW50aWNhdGlvbiBJbmMuMR0wGwYDVQQLExRDZXJ0aWZpY2F0ZSBTZXJ2aWNlczETMBEGA1UEAxMKTUZBIFJvb3QgMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALS8HZLFf9z51Md7m53np7MOGuWYhkq7EvI/SnuKmLJkRW0Xi+yxHq9qSf9dDKrUkY2vY1bOj26MmmGhkRBFcYuSxcGk+SuuI8IZDwDis6YZdBuFXO2AOmlqivBPF84y1MAzhXqh8ZsmUzCoXNFgJSAbDdX0TPtqOKNWb2tyADLcZ9fmWxhwq46NLTNVxKEHCVFFDhETtI+A2zvkVTNzL5mKhqwWvAH7p86fugEAOmioIOXnVzeeWmeNMAfb3KQrcHUUB/0l7fPpeAE/cCpPhNWswkYd/0nHXOjcFpf44tsIq7XqTR2nc8ZQGawpX+Re5H2X820H/nNvBELwlEeYkAUCAwEAAaNRME8wCwYDVR0PBAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFOb9IFp2VyytQ+gk2DiXFO0Km/m/MBAGCSsGAQQBgjcVAQQDAgEAMA0GCSqGSIb3DQEBBQUAA4IBAQCqpLCRhvOVjHEAw987A0SAC6RcVK73haBaqUaq2DM1sAf+9kF6DYlScWzYB3+ewXlFoF14EZYliJ4qmH0gIdPjH8Axjm64oI7uXd/X7T0VCpLydXW/le1pMRiqDjQ/zCdp7uwHUg7xBBLLR0pi0g9P9ulNQ1SVG5O2oXe2tu4ElJGi8a1VZ+mfaVypgT2zcNV4cJlgVRRk8d7BMafFXmhCLiiyl2+TKKB4mUa4Dkq7BpyRUBHPAJ3tIH36eslYAoi/xDc5eMzyhGAAdSj4ojOUSzaq6lwbwjoLnAzMD8uexcX05NAWO8BdPlBS7sJtJ8xJH14rQRHqFpQFaiF+vnWE,MIIHbzCCBVegAwIBAgIQI/QhpKIAQ5RAlGki8mrPjzANBgkqhkiG9w0BAQUFADCBzzELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExHzAdBgNVBAoTFlNlY3VyZUF1dGggQ29ycG9yYXRpb24xOzA5BgNVBAsTMihjKSAyMDEyIFNlY3VyZUF1dGggQ29ycCAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MR0wGwYDVQQLExRDZXJ0aWZpY2F0ZSBTZXJ2aWNlczEuMCwGA1UEAxMlU2VjdXJlQXV0aCBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xMjAzMDkwNjUyMzRaFw00MjAzMDkwNzAyMzJaMIHPMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEfMB0GA1UEChMWU2VjdXJlQXV0aCBDb3Jwb3JhdGlvbjE7MDkGA1UECxMyKGMpIDIwMTIgU2VjdXJlQXV0aCBDb3JwIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxHTAbBgNVBAsTFENlcnRpZmljYXRlIFNlcnZpY2VzMS4wLAYDVQQDEyVTZWN1cmVBdXRoIFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAqOoiAeCyzX4z7Xawh1uL9LrjTLhOME9ydZ7+baWYhbz//0/oxa9QTQEODmQUw0eXuc6YFvUZtrOm4+fms/A2if7UrE6mnZl1HrB30eUiorFlMelqGemtKhiiTK/Eleov/8GjpA69TaFxnF8vCdZyJLQZ6pFiW5sM+tP5vSd72+Hk38ps7moHkFmd3QcRy/9iY6PTo0pVs73galW+KG4EwlPWGY4Wlu/OPDX9hbLI0eS1baiHLitYp5pawxhynvvkeZRr+MkZN7ukOYc11hnSPIvX3ZKYKnnYUeqjzIWmDQdP0xBF/5pDwB64u1DIWgE3TNTOB+gDMrppGN80R9nTx1ibl/lQExwUVGyFUMYfV8L+vIBfaKyW8G1mT0cNGiTeXDX97P8j53Eqvl2GIEjUAhcUEAeCXpVhRnNfne8p1X0noxoKamn79TfPvnvUYzc3ync1+7yf0e24TSVUhEnRomjly4OAAJHfb0Tnxw5rLQW/1ICK1jGWMpfNE25DxCM3fH2CiQR6lyB6oVLjSAVbAUKfjy29BbVQqhtEdTloXNGVRoCL4YYqnMa7SeN5tITNkVxfLFz8FvUkzH8QIuJXO/rh1m+t3X6V3Gz43WnxUmdxzcIdPNN0MPbR9BDvRfY/XoIGWtJPgqC5V9gWQo6ORkIJqNu7gknU18uoqstKJWECAwEAAaOCAUMwggE/MAsGA1UdDwQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRODBo1MytT+Wq3bXwu5u/O4s7yXTAQBgkrBgEEAYI3FQEEAwIBADCB7QYDVR0gBIHlMIHiMIHfBiArBgEEAYI3FQiC1IUbgabJTYeNmyaH99kbgoXiQwGDEjCBujB0BggrBgEFBQcCAjBoHmYAUwBlAGMAdQByAGUAQQB1AHQAaAAgAEMAbwByAHAAbwByAGEAdABpAG8AbgAgAEMAZQByAHQAaQBmAGkAYwBhAHQAZQAgAFAAbwBsAGkAYwB5ACAAUwB0AGEAdABlAG0AZQBuAHQwQgYIKwYBBQUHAgEWNmh0dHA6Ly94NTA5Lm11bHRpZmFjdG9ydHJ1c3QzLmNvbS9DZXJ0SW5mby9Qb2xpY3kuYXNweDANBgkqhkiG9w0BAQUFAAOCAgEAmPb2uaGyAmnij1yspbgR7M5A+YMz1cTSd8dizrhtc7x+nstLSj+fNTqOoX+OBFbOBmL9o3ZxJBcezJ9KhEnCpuHy/Uq5P9AconW0X3dlpiWUt8WyLAi0x/WTsXn4FyhE2bH8MIf+m9VeXENbnwdnimUMSrq1ekrFu6WReEbdYvxbFmpH5MVt6t0YlFt/Ll7sNkZjmcKEsmf82Ci79a3fQh0XBVdZFrJGCiKKW8RD+s7luyOo9G52qiZN86uWCAQ96u1Wi1cygJN0acCdHcjGqBwgRXmouSH/OsUdPZo9b0xoX8174cEHJh9oFj8VRhYtuQoqou5I9UPYlTaGkZOJSCAxE/UBE6rNEi3E0yFACaadq8xGfQ1odaHQ48+vWsA5th5acbBL9SOgxH9nGnpHxsuofROf7wxiadi4Ty/JJtBxDN7tBw2Vc8B7r6teS5yVn4SPDPIcmnvzcJOShFz7HViHxZQbqHIcpVXiaR6hLOB7ksFZjOvQvvnJWtNDt811VudeB+ok6q6pAI2C2T2Zh4Wi7ZtC96pysvLv24j8Zf/iGwhhlqkHRbxr+TkIUCoY3P94qSUuROXmM5zG0GqZpd1IkAnoPqD28/M7kTc6Rcl3NCtaDV2AWHIRjIl94kGMS476/6+OhQmWiqQjjlyN5y6Q4uEAHIFkb7QfyW2tgoU=" /> 
InterCert Key Value
<add key="InterCert" value="MIIEuzCCA6OgAwIBAgIKYQdFYwAAAAAA3jANBgkqhkiG9w0BAQUFADCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExDzANBgNVBAcTBklydmluZTEpMCcGA1UEChMgTXVsdGktRmFjdG9yIEF1dGhlbnRpY2F0aW9uIEluYy4xHTAbBgNVBAsTFENlcnRpZmljYXRlIFNlcnZpY2VzMRMwEQYDVQQDEwpNRkEgUm9vdCAzMB4XDTE0MDYyNDA2NTgyNFoXDTE3MDMzMDIzNTIwNFowODE2MDQGA1UEAxMtTUZDSXNzdWVyM05ldmFkYS5iYW5uZXIubXVsdGlmYWN0b3J0cnVzdDMuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwMwbkrVESRfpNmHyrYTlN4AfSw+6AEJabvZ05R1bJTPNVOHtd/yrwwrUTLp5RxXiJh+EIPiIH3iixisIzBaPUQfuYxwBgqeVZPkUmXD243twn3ZlHSNHhFItE9s5UJQYVjy5wPMCs104qCJnt88TGhe9IE59qN7lEUCzwEbaXjag2n/oIOx6QQozP5tOJr6WidIqOfr9QMQjuplDK1FxeOGR6Cdf+yz1GTrZnwIyHrAhO5aZYyTiUXOMyLEnbKbnIhPaLDshQ5AGauk7dt52kUyGdMvcFz6NJGVVp8jHnEitfyksgHAmYPEqnu6h9Mf+fLcIYvZnKyIn75SCB/oCJwIDAQABo4IBajCCAWYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUMde0USejRa5/UeslLdbIrb2GdD4wCwYDVR0PBAQDAgGGMBAGCSsGAQQBgjcVAQQDAgECMCMGCSsGAQQBgjcVAgQWBBQCJ2xSPxp4Sf8BIIKafwam0C50LTAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTAfBgNVHSMEGDAWgBTm/SBadlcsrUPoJNg4lxTtCpv5vzBOBgNVHR8ERzBFMEOgQaA/hj1odHRwOi8veDUwOS5tdWx0aWZhY3RvcnRydXN0My5jb20vQ2VydEluZm8vTUZBJTIwUm9vdCUyMDMuY3JsMGQGCCsGAQUFBwEBBFgwVjBUBggrBgEFBQcwAoZIaHR0cDovL3g1MDkubXVsdGlmYWN0b3J0cnVzdDMuY29tL0NlcnRJbmZvL21mYXJvb3QzY2FfTUZBJTIwUm9vdCUyMDMuY3J0MA0GCSqGSIb3DQEBBQUAA4IBAQCa9WIQvx0iIVpAjGz9e4CNF1BABovqFa/Y0CUHkTg4eehFWOVQiJxjwBm2FtgeEv975Np7YppQ/NBed/SJrITTGbY5GVDbCuUoAmIaa1T3T3z1ZY/mev+SOb5ySa8uhMXjV4lpSkmgMEbGLQ4xHePrnarm6wTS3S4zYLKWQJChgjZcibszs5gzoDd0wU+d4zkCROybEvlFFUriVxhUgQS32NpVjAO7HjV9ZZp5JGKp0VOcrMByemCvYIcvQU9VpXZ9w7ZcZBYTsRITkiiN1YCYpnScABKon+ARqs1hNu2nOhFurhWjJISBixCxDep37QBwcx75CPOjSaF+G2oXLo72,MIIEuzCCA6OgAwIBAgIKYR/TxAAAAAAA3TANBgkqhkiG9w0BAQUFADCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExDzANBgNVBAcTBklydmluZTEpMCcGA1UEChMgTXVsdGktRmFjdG9yIEF1dGhlbnRpY2F0aW9uIEluYy4xHTAbBgNVBAsTFENlcnRpZmljYXRlIFNlcnZpY2VzMRMwEQYDVQQDEwpNRkEgUm9vdCAzMB4XDTE0MDYyMzA3MjkzM1oXDTE3MDMzMDIzNTIwNFowODE2MDQGA1UEAxMtTUZDSXNzdWVyM1NpZXJyYS5iYW5uZXIubXVsdGlmYWN0b3J0cnVzdDMuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz91CInV7yMs9BBG/o857e7tvCQV92PvZiUn6aE1XJ8BdxDCXMiEQQ687UoYmZHtGEKNv4ZDQRUQ+NWllme9YXvH9nT9YuBNKID3fRc3ij0WrKxhxX0xTffvSrH1rGjjzDBldIFVEaabiCCbAJytBymsBVM9C4DVitR5CRObBdyc5C87Hy/Ik2s2vjy90oIsWsmvnUqfCnMVKcwXWmtTefnKdd+kyzS3U3QSHHeChL7U5mtY3afyJ8Im5O/F8G7nXxRn4E6dE/ZMs0DwroFnBgtoSvt1YNTHuB/2CwKqxFl9zR7TjvZ/YIf5prC9fRhEPNR09tDe3BgqhUZ3LeuJsLwIDAQABo4IBajCCAWYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUjN5rKU4Rir/Df13Uw/2yIm4jn68wCwYDVR0PBAQDAgGGMBAGCSsGAQQBgjcVAQQDAgECMCMGCSsGAQQBgjcVAgQWBBT2L4i4NZBfeW/DmledbQPiqKuomDAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTAfBgNVHSMEGDAWgBTm/SBadlcsrUPoJNg4lxTtCpv5vzBOBgNVHR8ERzBFMEOgQaA/hj1odHRwOi8veDUwOS5tdWx0aWZhY3RvcnRydXN0My5jb20vQ2VydEluZm8vTUZBJTIwUm9vdCUyMDMuY3JsMGQGCCsGAQUFBwEBBFgwVjBUBggrBgEFBQcwAoZIaHR0cDovL3g1MDkubXVsdGlmYWN0b3J0cnVzdDMuY29tL0NlcnRJbmZvL21mYXJvb3QzY2FfTUZBJTIwUm9vdCUyMDMuY3J0MA0GCSqGSIb3DQEBBQUAA4IBAQA3XUzZAsABz8SFxwjKsIbBsfS3hupG3KR32qPD1QuRQvBGAYl4LNTeSBWlmvcYGesBOCVY/xGmIInTDuoYVxmoJQJppWoXdXOPNBctGzuKLlSIHBXS7fMaJdPrEWgtzJODejPHa9e48Y0MuK5EihQt595KGcsLhFJ4Antm6hdDNtirUDwamHYya+fyVKdJeSL/Lry/GGsKNG6PPxzWCQ6lqabxLxZH4OcS83S6YgHRF0H0rXpJCv9l1gWyIcb+xL8vEE/BN8tSMGlcc0rjicdmXlMszUQHIuXYIxwdNI4pub0bmpcsPSXBPJAPwK7rrudPRtaLRqbrjpA4gCBdbj0l" />

Click Save once the configurations have been changed and before leaving the Web Config Editor page to avoid losing changes