The key difference is ownership of the certificates:

• Authentication Manager on-premises: You own and manage all certificates.
• Cloud Authentication Service: RSA manages the service certificates. You manage only the certificates for your integrations.
• Hybrid: You manage the Authentication Manager certificates, RSA manages the CAS certificates, and Authentication Manager must trust CAS.

Comparison

Authentication Manager certificates

• Internal root CA Created when the primary instance is installed. It signs the server certificates for the primary and every replica. Clients should trust this root CA rather than an individual server's certificate, so they keep working when they connect to a different instance.
• Console certificate Used by the Security Console, Operations Console, Self-Service Console, and the RSA SecurID Authentication API (port 5555). You can replace the default certificate with one issued by your own CA in the Operations Console under Deployment Configuration > Certificates > Console Certificate Management.
• Virtual host certificate Used when Authentication Manager is accessed through a load balancer or virtual hostname. The certificate must match the hostname users connect to.
• Web tier Presents the virtual host certificate to users connecting through the DMZ.
• RADIUS server certificate Required only for EAP authentication methods, such as PEAP.
• Identity source certificates When Authentication Manager connects to Active Directory over LDAPS, import the certificate of the CA that issued the domain controllers' certificates under Deployment Configuration > Certificates > Identity Source Certificate Management.
• Classic authentication agents use the node secret, not certificates, to communicate with Authentication Manager.

Cloud Authentication Service certificates

• Tenant certificates RSA manages and renews the certificates for the Cloud Administration Console, the SSO Portal, and authentication endpoints. You don't need to install or renew them.
• SAML signing certificates SSO applications use signing certificates that you manage. When you rotate one, update the service provider with the new certificate.
• Identity Router certificates The Identity Router can use its own certificate, for example for a custom SSO Portal hostname. It must also trust your domain controllers' CA for LDAPS connections.
• MFA Agents and other clients Clients that connect directly to CAS rely on the public CA, so no certificate import is usually needed. The exception is a network proxy or firewall that inspects SSL traffic, since it replaces the certificate the client sees.

Hybrid deployments

In a hybrid deployment, Authentication Manager is connected to the Cloud Authentication Service. Keep in mind:

• Authentication Manager connects to CAS over HTTPS (port 443). It must trust the CAS certificate chain. If a proxy inspects this traffic, Authentication Manager must also trust the proxy's certificate, or the proxy must be configured to skip inspection for CAS traffic.
• The embedded Identity Router connects to Authentication Manager. Authentication Manager's certificates must match the hostnames it uses.
• Where the MFA Agent connects determines what it must trust. An agent connecting to Authentication Manager on port 5555 needs the Authentication Manager root CA. An agent connecting to CAS uses the public CA.
• There are two renewal schedules. RSA renews CAS certificates on its schedule, and you renew Authentication Manager certificates on yours. Track both.

Common problems and how to avoid them

Related information

• RSA Authenticaiton Manager ans self-signed certificates
• How to trust the RSA Authentication Manager Security Console self-signed root CA certificate and precent certificate warnings.
• Certificate management information in the RSA Authentication Manager Administrator's Guide for your product version.
• How to manage RSA Authentication Manager console and virtual host certificates with keytool]
• Documentation on Identity Router configuration.