Enterprise Application Access (EAA) can use certificates to validate the communication between applications hosted on EAA servers and your users (clients). Certificates provide authentication between the client and server to securely send data with use of Transport Layer Security (TLS).

A server certificate is required for TLS communications between a user's browser and each application exposed through Enterprise Application Access.

The Certificates page shows the certificates from Certificate Authorities, Custom Certificates, and Self-Signed Certificates. The self-signed certificates you generate using your own domain for the external host for your applications appear in the Self-Signed Certificates section. The certificates you upload from a Certificate Authority (CA) appear in the Certificate Authorities section. The custom certificates you create appear in the Custom Certificates section.

Optionally you can enable mutually authenticated TLS connectivity between the user's device and Enterprise Application Access when you install certificates on user devices and a CA certificate for user authentication in Enterprise Application Access. For more information see Certificate-based authentication in the IdP, User-facing authentication mechanism for applications, and Configure the user-facing authentication mechanism.

Upload and deploy certificates

You can upload and deploy certificates in EAA. These certificates can be used for secure TLS communication between your Application and EAA Cloud, or for authentication between the identity provider (IdP) and EAA Cloud. It is not needed to redeploy the application or IdP, if the certificate is already associated with the application or IdP respectively.

When you upload a new certificate for the first time, it will be in Not Associated state and you must associate it with an application or an IdP.

When a certificate expires, and you renew or upload a new one and deploy it, you do not redeploy the application or the IdP. The newly deployed certificate automatically associates with the application or IdP, saving time for the administrator and downtime for the application.

To upload and deploy the certificate follow this procedure:

Log in to Enterprise Center.
In the Enterprise Center navigation menu, select Application Access > Certificates > Certificates.
Select the type of certificate you want to add, either Certificate Authorities or Custom Certificates.
If you selected Certificate Authorities do the following:
1. Click Add Certificate.
2. In Name type a unique name for the certificate.
3. To upload the file click the folder icon, go to the location of the *.crt file on your computer, click Open.
4. Click Save, to save the changes. A new entry is created for the uploaded certificate with the Name, Created, and Expires values populated. There are no applications or identity providers associated with the certificate, since it was just uploaded. It will be in the Not Associated state.
If you selected Custom Certificates option:
1. Click Add Certificate
2. In Name type a unique name for the certificate.
3. If a password was configured for the private key, in Password, enter a password.
4. For Cert, if you selected Manual option, paste the certificate body and the associated private key. Click Save and Deploy. A new entry is created for the uploaded certificate with the Name, CN, Created, Expires, and Deployment values populated. Since there are no applications or Identity providers associated with the certificate, it is in the Not Associated state in the Deployment column. After you associate it to an application or/and an IdP and deploy it, the Deployment status changes to Deployment in Progress state. If the application or IdP deployment succeeds, the certificate is automatically deployed in the different cloud zones and status changes to LPOPs Deployed. The count of the local pops where the deployment was successful and failed is shown. When you hover over the icon, the names of the local POPs are shown. When you click on the View link in the Associations column, the list of applications and IdPs associated with the certificate are shown. If the certificate is not deployed correctly, for example, if the password is incorrect, even if the association with application or IdP is okay, you see Deployment Failed state. Or if the certificate is uploaded correctly but the application or IdP association isn't completed successfully, you see Deployment Failed state.
5. For Cert, if you selected File upload option, click the folder icon, go to the location of the *.crt file on your computer, click Open, upload it and click Save and Deploy. A new entry is created for the uploaded certificate with the Name, CN, Created, Expires, and Deployment values populated. Since there are no applications or Identity providers associated with the certificate, it is in the Not Associated state in the Deployment column. After you associate it to an application or/and an IdP and deploy it, the Deployment status changes to Deployment in Progress state. If the application or IdP deployment succeeds, the certificate is automatically deployed in the different cloud zones and status changes to LPOPs Deployed. When you hover over the icon, the names of the local POPs are shown. When you click on the View link in the Associations column, the list of applications and IdPs associated with the certificate are shown. If the certificate is not deployed correctly, for example, if the password is incorrect, even if the association with application or IdP is okay, you see Deployment Failed state. Or if the certificate is uploaded correctly but the application or IdP association isn't completed successfully, you see Deployment Failed state.
To edit a certificate, click the pencil icon next to the certificate and make your edits and click Save and Deploy. You need not redeploy the applications or IdPs. After the certificate is deployed, it is automatically associated with the LPOP.

📘
Note:
Self-signed certificates are not editable.

To delete a certificate, click the trash icon next to the certificate.

Next, to use the certificate for an external domain, see Associate a certificate for using your own domain for your application.

Associate a certificate for using your own domain for your application

When you use your own domain for your application and a certificate that matches the domain is associated with the application, users are able to securely communicate to the EAA Cloud:

If you use an Akamai domain, you do not need to provide a certificate.
If you use your own domain, you can have Akamai generate a certificate for you or you can select to use an uploaded certificate from an authorized certificate authority (CA). It is recommended to provide your own certificate.

📘
In some cases, you may need to provide an intermediate certificate from your domain provider. When you paste your standard certificate in Cert, paste the intermediate certificate just below it.

Log in to Enterprise Center.
In the Enterprise Center navigation menu, select Application Access > Applications > Applications.
Select your application to open it.
In External host select Use your domain.
For the Certificate Preference, to use a self-signed certificate generated by Enterprise Application Access:
1. Select Use self-signed certificate.
2. Click Generate self-signed certificate.
  A message about application using a self-signed certificate appears.
For the Certificate Preference, to use an uploaded certificate:
1. Select Use uploaded certificates.
2. Select a certificate.
Click Save, to save the changes. Or click Save and Deploy, to save and deploy the changes.