How to Obtain the RSA Root CA Certificate from RSA Authentication Manager 8.x — Browser or SSH
8 days ago
Originally Published: 2016-01-17
Article Number
000048109
Applies To
RSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.x
Issue
Administrators may need to obtain the RSA root CA certificate from an Authentication Manager 8.x instance for trust configuration, agent integration, or certificate validation purposes. This article covers two methods: a browser-based UI method and an SSH-based command-line method. Choose the method that best suits your environment and access level.
Prerequisites:
  • Admin access to the Authentication Manager Operations Console or Security Console (UI method)
  • SSH access enabled on the Authentication Manager server and an SSH client such as PuTTY (SSH method)
  • Operations Console administrator credentials (SSH method)
ℹ️ NOTE: For exporting root certificates from Identity Router or Cloud Authentication Service, see How to Export Root Certificates via Web Browser — RSA Authentication Manager, Identity Router, or Cloud Authentication Service.
Resolution

 

ℹ️ NOTE: Both methods produce the RSA root CA certificate. The easiest approach for an administrator to obtain the  RSA root CA certificate is by using a supported web browser.
 

Task 1: Browser-Based Export

Step 1: Open Microsoft Edge and browse to either the Operations Console or Security Console URL for your Authentication Manager instance.
 
 
Step 2: Click the lock icon in the browser address bar.
 
Step 3: Click Connection is secure.
 
 
Step 4: Click the Details tab and select the RSA root CA certificate at the top of the list.
 
 
Step 5: Click Export. 
Step 6: Rename it .cer
Step 7: The certificate has been saved and is now accessible at the specified location.
 
     

      Task 2: SSH-Based Export

      Step 1: Enable SSH on the RSA Authentication Manager server if not already enabled.
      Step 2: Launch an SSH client (e.g., PuTTY) and connect to the primary Authentication Manager server.
      Step 3: Log in as rsaadmin (or the username configured during Quick Setup) and enter the operating system password.
      Step 4: Navigate to the utils directory:
      cd /opt/rsa/am/utils/

       

      Step 5: Retrieve the Root Certificate Keystore File Password by running:
       
      ./rsautil manage-secrets -a listall
       
      Enter your Operations Console administrator username and password when prompted. 
      Note the Root Certificate Keystore File Password from the output — you will need it in the next step.
       
      6: Export the RSA root CA certificate by running:
       
      /opt/rsa/am/appserver/jdk/bin/keytool -export -alias rsa-am-ca -file rsa-am-ca.crt -keystore /opt/rsa/am/server/security/caStore.jks
       
      Enter the Root Certificate Keystore File Password retrieved in Step 5 when prompted
       
      Step 7: Use a secure FTP client to copy rsa-am-ca.crt from the Authentication Manager server to your local machine.
       
      ✅ Verification: Confirm the rsa-am-ca.crt file has been successfully transferred to your local machine and is non-zero in size.
      Notes

      For a step-by-step walkthrough, please refer to the following video: How to Obtain the RSA Root CA Certificate from RSA Authentication Manager 8.x

       

      Related Articles

      Trending Articles

      Don't see what you're looking for?