This section describes the way in which to procure Certificate Authority (CA) certificates.
Certificate Requirements
Certificate Authority (CA) certificates must:
- be an S/MIME certificate (also known as a Client certificate or Personal Authentication certificate).
- contain a certificate chain starting from the user's certificate to the root CA and end in a supported Public Root CA.
- conform to the X.509 format of public key certificates.
- be generated using the RSA-2048 or stronger algorithm.
- be in .PEM format.
- contain the user's email address. The email address must be present in either:
- The X509v3 Subject Alternative Name field (preferred)
or - The EMAILADDRESS field in the Subject. Set the email address using the EMAILADDRESS attribute, NOT the CommonName (CN) attribute.
- The X509v3 Subject Alternative Name field (preferred)
- contain a X509v3 Key Usage Digital Signature bit. Other bits can be present, but are ignored by Anaplan.
- provide a way to check for revocation using the Certificate Revocation List (CRL) or Online Certificate Status Protocol (OCSP).
Obtain a Certificate and Private Key
When you obtain an S/MIME certificate from a CA, you can either:
- submit the certificate request and get a certificate from the CA,
or - you can submit your request with a Certificate Signing Request (CSR) containing your private key.
Obtain a Certificate from a CA
Contact your IT or Security Operations organization to determine if your company already has an existing relationship with a CA or intermediary CA.
- If your organization has an existing relationship with a CA or Intermediate CA you can request a client certificate be issued for your integration user.
- If your organization does not have an existing CA relationship, you should contact a valid CA to procure a client certificate.
Generate a Private Key and Certificate Signing Request (CSR)
If you have your own private key and public key, use them to generate a Certificate Signing Request (CSR) in which you will include the public key.
Prepare the openssl.cnf file.
- Create a text file and add the following content in it:
[ req ] default_md = sha256 default_bits = 2048 utf8 = yes string_mask = utf8only distinguished_name = req_distinguished_name #attributes = req_attributes #x509_extensions = v3_ca_req req_extensions = v3_user_req [ req_distinguished_name ] countryName = Country Name (2 letter code) countryName_default = US countryName_min = 2 countryName_max = 2 stateOrProvinceName = State or Province Name (full name) stateOrProvinceName_default = CA localityName = Locality Name (eg, city) localityName_default = San Francisco 0.organizationName = Organization Name (eg, company) 0.organizationName_default = CompanyNameGoesHere, Inc. organizationalUnitName = Organizational Unit Name (eg, section) organizationalUnitName_default = YourOrganizationalUnitGoesHere commonName = Common Name (eg, YOUR name) commonName_default = EmployeeNameGoesHere commonName_max = 64 emailAddress = Email Address emailAddress_default = EmployeeEmailAddressGoesHere emailAddress_max = 40 [ v3_user_req ] basicConstraints = CA:FALSE subjectKeyIdentifier = hash keyUsage = digitalSignature nsCertType = client extendedKeyUsage = clientAuth
- Edit the values of these elements for your organization:
Element Value countryName_default The country name stateOrProvinceName_default The name of the state or province 0.organizationName_default The organization name organizationalUnitName_default The organizational unit name commonName_default The name of the user associated with the certificate. emailAddress_default The user's email address associated with the Anaplan login We further recommend setting default_md = sha512.
- Save the file as openssl.cnf.
- Generate the private key and the certificate signing request (CSR) based on the openssl.cnf file:
$openssl req -nodes -config openssl.cnf -new -out cert-request.csr -keyout <key name>
In the above command, replace <key name> with the name of your private key (e.g. private.key). The command outputs your private key and a cert-request.csr file, which is your CSR.
Note: Do not run the command multiple times in the same folder, as that will overwrite the private.key and the cert-request.csr files. If you need to issue certificates for multiple users, we recommend creating separate folders for each employee to contain the relevant file. - Validate the CSR (certificate signing request) using the following openssl command:
$openssl req -in cert-request.csr -noout -text
This outputs the content of the certificate signing request. Double-check that the data in the certificate signing request is for the correct organization and user.
- Store the private key file securely.
Extract the Certificate Key and Public Key
- Open a terminal window and navigate to the directory where you have your p12 certificate.
- Extract the certificate by running this openssl command in the terminal window:
openssl pkcs12 -in <name of your p12 cert>.p12 -nokeys -out client_certificate.pem
Where <name of your p12 cert> is the name of the certificate saved in p12 format.
- Extract the private key by running this openssl command in the terminal window.
openssl pkcs12 -in <name of your p12 cert>.p12 -nocerts -out private.key -nodes
Where <name of your p12 cert> is the name of the certificate saved in p12 format.
- In a text editor, edit the client_certificate.pem file to remove any content before "-----BEGIN CERTIFICATE----- " or after "-----END CERTIFICATE-----".
Do not remove the certificate content between the "-----BEGIN CERTIFICATE----- " or after "-----END CERTIFICATE-----" lines!
Register your Certificate with a Certificate Authority
- Log into your CA account. If necessary, perform any validation steps required by the CA.
- Order a client certificate. Certificates must meet the certificate requirements.
- When prompted, upload the cert-request.csr file generated previously.
- At the Recipient CSR prompt, upload the cert-request.csr file generated previously.
- Submit your request to the CA.
- The user is then responsible to perform any steps to confirm the email address associated with the certificate. Upon receiving the certificate, extract it and register it with Anaplan. For more information, see Managing Certificates.