There are two methods that can be used to obtain the Authentication Manager instance RSA root CA certificate. The easiest approach for an administrator to obtain the self-signed RSA root CA certificate is by using a supported web browser.

UI Steps

1. Access either the Operations Console or Security Console with a web browser (using Google Chrome for this example).
2. Click the padlock with the small red cross.

​Example:

3. The administrator is presented with the option to view the certification.  Click the Certificate information link

​

4. The server certificate is displayed:

​

5. Click the Certificate Path tab and select the RSA root CA certificate.
6. Click View Certificate.

​

7. After viewing the RSA root CA certificate click the Details tab.
8. Click Copy to File… to save the certificate to a file.

​

9. At the Certificate Export Wizard, click Next.

10. Select a format you want to use (leaving the default for this example) and click Next.

11. Enter a file name and click the Next.

12. Click Finish.

13. A confirmation appears:

14. In Windows Explorer double click the C:\RSA_root_CA.cer and the RSA root CA certificate is displayed:

​

SSH Steps

1. How to SSH to an RSA Authentication Manager version 8.x server
2. Launch an SSH client, such as PuTTY.
3. Login to the primary Authentication Manager server as rsaadmin and enter the operating system password.

Note that during Quick Setup another user name may have been selected. Use that user name to login.

4. Enter the following command and the keystore password when prompted:

login as: rsaadmin
Using keyboard-interactive authentication.
Password: <enter operating system password>
Last login: Thu Jan  9 18:06:47 2020 from jumphost.vcloud.local
RSA Authentication Manager Installation Directory: /opt/rsa/am 

5. Navigate to /opt/rsa/am /utils.
6. Viewing the contents or exporting data from caStore.jks requires the Root Certificate Keystore File Password.  Run ./rsautil manage-secrets -a listall to get the Root Certificate Keystore File Password:

rsaadmin@am82p:~> cd /opt/rsa/am/utils/
rsaadmin@am82p:/opt/rsa/am/utils> ./rsautil manage-secrets -a listall
Please enter OC Administrator username: <enter Operations Console administrator name>
Please enter OC Administrator password: <enter Operations Console administrator password>
Root Certificate Keystore File Password ...............: BB3aNkbU4uaEoNbURuTmnp5d7Kcuna

7. To list the contents of the caStore.jks file use the following command:

rsaadmin@am82p:~>/opt/rsa/am/appserver/jdk/bin/keytool -export -keystore /opt/rsa/am/server/security/caStore.jks
Enter keystore password: <enter Root Certificate Keystore File Password from step 6>

8. To export the RSA root CA certificate (with alias rsa_ca_am) use the command :

rsaadmin@am82p:/opt/rsa/am/utils> /opt/rsa/am/appserver/jdk/bin/keytool -export -alias rsa-am-ca -file rsa-am-ca.crt -keystore /opt/rsa/am/server/security/caStore.jks
Enter keystore password: <enter Root Certificate Keystore File Password from step 6>

9. Use a secure FTP client (where SSH access to the operating system has been enabled) to copy the rsa-am-ca.crt file from the Authentication Manager instance.