English
  2. Administration and security
  3. Administration
  4. Security certificates
  5. Procure CA certificates
Security certificates

Procure CA certificates

This section describes the way in which to procure Certificate Authority (CA) certificates.

Certificate requirements

Certificate Authority (CA) certificates must:

  • Be an S/MIME certificate (also known as a Client certificate or Personal Authentication certificate).
  • Contain a certificate chain that starts from the user's certificate to the root CA and end in a supported Public Root CA.
  • Conform to the X.509  format of public key certificates.
  • Be generated using the RSA-2048 or stronger algorithm.
  • Be in .PEM format.
  • Contain the user's email address. The email address must be present in either:
    • The X509v3 Subject Alternative Name field (preferred).
    • The EMAILADDRESS field in the Subject. Set the email address with the EMAILADDRESS attribute, and not the CommonName (CN) attribute.
  • Contain a X509v3 Key Usage Digital Signature bit. Other bits can be present, but are ignored by Anaplan.
  • Provide a way to check for revocation using the Certificate Revocation List (CRL) or Online Certificate Status Protocol (OCSP).

Note: Anaplan does not support SSL or Server certificates.

Obtain a certificate and private key

When you obtain an S/MIME certificate from a CA, you can either:

  • Submit the certificate request and get a certificate from the CA.
  • Submit your request with a Certificate Signing Request (CSR) that contains your private key.

Note: Contact your certificate vendor to confirm what the vendor requires.

Obtain a certificate from a CA

Contact your IT or Security Operations organization to determine if your company already has an existing relationship with a CA or intermediary CA.

  • If your organization has an existing relationship with a CA or Intermediate CA you can request a client certificate be issued for your integration user.
  • If your organization doesn't have an existing CA relationship, you should contact a valid CA to procure a client certificate.

Note: There are many categories of certificates that a CA offers (for example: SAN certificates, wildcard certificates, code-signing certificates, and others). You should request a client certificate only. The process for procuring the certificate may take a few weeks for some validation that the CA must perform. We recommend you allow time for the procurement process. Once the CA issues the certificate file, follow their documented steps for making this file available in your environment.

Generate a private key and Certificate Signing Request (CSR)

If you have your own private key and public key, use them to generate a Certificate Signing Request (CSR) in which you will include the public key.

Note: The procedure below describes how to manage and create the CSR to register with a Certificate Authority using the OpenSSL  tool in a Windows environment. You can use alternate tools to manage and create these files to register with a Certificate Authority, but note other tools have not been tested nor are they supported by Anaplan.

Prepare the openssl.cnf file.

  1. Create a text file and add the these content in it:
    [ req ]
    default_md = sha256
    default_bits = 2048
    utf8 = yes
    string_mask = utf8only
    distinguished_name = req_distinguished_name
    #attributes = req_attributes
    #x509_extensions = v3_ca_req
    req_extensions = v3_user_req
    [ req_distinguished_name ]
    countryName = Country Name (2 letter code)
    countryName_default = US
    countryName_min = 2
    countryName_max = 2
    stateOrProvinceName = State or Province Name (full name)
    stateOrProvinceName_default = CA
    localityName = Locality Name (eg, city)
    localityName_default = San Francisco
    0.organizationName = Organization Name (eg, company)
    0.organizationName_default = CompanyNameGoesHere, Inc.
    organizationalUnitName = Organizational Unit Name (eg, section)
    organizationalUnitName_default = YourOrganizationalUnitGoesHere
    commonName = Common Name (eg, YOUR name)
    commonName_default = EmployeeNameGoesHere
    commonName_max = 64
    emailAddress = Email Address
    emailAddress_default = EmployeeEmailAddressGoesHere
    emailAddress_max = 40
    [ v3_user_req ]
    basicConstraints = CA:FALSE
    subjectKeyIdentifier = hash
    keyUsage = digitalSignature
    nsCertType = client
    extendedKeyUsage = clientAuth
  2. Edit the values of these elements for your organization:
ElementValue
countryName_defaultThe country name.
stateOrProvinceName_defaultThe name of the state or province.
0.organizationName_defaultThe organization name.
organizationalUnitName_defaultThe organizational unit name.
commonName_defaultThe name of the user associated with the certificate.
emailAddress_defaultThe user's email address associated with the Anaplan login.


We further recommend setting default_md = sha512.

  1. Save the file as openssl.cnf.
  2. Generate the private key and the certificate signing request (CSR) based on the openssl.cnf file:
    $openssl req -nodes -config openssl.cnf -new -out cert-request.csr -keyout <key name>
  3. In the above command, replace <key name> with the name of your private key (e.g. private.key). The command outputs your private key and a cert-request.csr file, which is your CSR.

Note: Do not run the command multiple times in the same folder, as that will overwrite the private.key and the cert-request.csr files. If you need to issue certificates for multiple users, we recommend creating separate folders for each employee to contain the relevant file.

  1. Validate the CSR (certificate signing request) using the following openssl command:
    $openssl req -in cert-request.csr -noout -text
    This outputs the content of the certificate signing request. Double-check that the data in the certificate signing request is for the correct organization and user.
  2. Store the private key file securely.

Note: If you need to distribute the private key we recommend using an encrypted method, such as GPG, using a keysize of 4096 bits to exchange the files. GPGtools can be downloaded from https://gpgtools.org/ .

Extract the certificate key and public key

Note: The following procedure describes the process to manage and create the CSR to register with a Certificate Authority using the OpenSSL  tool in a Windows environment. You can use alternate tools to manage and create these files to register with a Certificate Authority, but note other tools have not tested nor are supported by Anaplan.

  1. Open a terminal window and navigate to the directory where you have your p12 certificate.
  2. Extract the certificate by running this openssl command in the terminal window: openssl pkcs12 -in <name of your p12 cert>.p12 -nokeys -out client_certificate.pem Where <name of your p12 cert> is the name of the certificate saved in p12 format.
  3. Extract the private key by running this openssl command in the terminal window. openssl pkcs12 -in <name of your p12 cert>.p12 -nocerts -out private.key -nodes Where <name of your p12 cert> is the name of the certificate saved in p12 format.
  4. In a text editor, edit the client_certificate.pem file to remove any content before "-----BEGIN CERTIFICATE----- " or after "-----END CERTIFICATE-----".

Note: Do not remove the certificate content between the "-----BEGIN CERTIFICATE----- " or after "-----END CERTIFICATE-----" lines!

Register your certificate with a Certificate Authority

  1. Log into your CA account.
    If necessary, perform any validation steps required by the CA.
  2. Order a client certificate.
    Certificates must meet the certificate requirements. See the Certificate requirements section above.
  3. When prompted, upload the cert-request.csr file generated previously.
    See the Generate a private key and Certificate Signing Request (CSR) section above.
  4. At the Recipient CSR prompt, upload the cert-request.csr file generated previously.
  5. Submit your request to the CA.
  6. The user is then responsible to perform any steps to confirm the email address associated with the certificate.
    When you receive the certificate, extract it and register it with Anaplan.  For more information, see Manage your certificates.

Disclaimer

We update Anapedia content regularly to provide the most up-to-date instructions.