Keycyte PAM 3.2 · Deployment Guide
Configuring the Web TLS Certificate
The Web TLS certificate is the HTTPS certificate that browsers see when they open the Client Panel or the Admin Panel. You manage it on Settings > Web TLS Certificate. A new certificate takes effect immediately for new connections; you do not need to restart Keycyte PAM.
Before You Begin
- You are signed in to the Admin Panel with the MASTER role.
- You have the certificate, its private key and any intermediate certificates as PEM text files.
- The private key is not protected with a password. To remove the password, use for example
openssl pkey -in key.pem -out key-plain.pem. - The key is RSA with at least 2048 bits, or ECDSA on the P-256 or P-384 curve.
Tip
If you have a PFX/PKCS#12 file, convert it to PEM first:
openssl pkcs12 -in cert.pfx -nokeys -out cert.pem
openssl pkcs12 -in cert.pfx -nocerts -nodes -out key.pemViewing the Current Certificate
Open Settings > Web TLS Certificate. The Current Certificate card shows the certificate that the PAM server uses now:
| Field | Description |
|---|---|
| Source | Where the certificate comes from: a certificate applied on this page, the PKCS#12 keystore from the installation, or a temporary self-signed certificate. |
| Days Remaining | Days until the certificate expires. |
| Subject | Subject of the certificate. |
| Issuer | Issuer of the certificate. |
| Valid From, Valid Until | Validity period. |
| Subject Alt Names | DNS names and IP addresses the certificate covers. |
| SHA256 Fingerprint | Fingerprint of the certificate. |
| Uploaded By, Uploaded At | Administrator who applied the certificate, and when. |
A status message above the details shows, for example, that the certificate is healthy, expires soon, is self-signed, or that the server runs on the installation keystore or on a temporary self-signed certificate.
Applying a New Certificate
To apply a new certificate:
-
Open Settings > Web TLS Certificate.
-
In the Upload New Certificate card, fill in the fields. You can paste the PEM text, or click Load from file next to a field to read it from a file.
Field Description Certificate (PEM) The server certificate. If you paste a full chain (server certificate followed by intermediates), Keycyte PAM separates the server certificate from the chain. Private Key (PEM) The unencrypted private key of the certificate. Intermediate Chain (PEM, optional) The intermediate certificates of your CA, if they are not in the certificate field. -
Click Validate.
The Validation Preview shows the parsed certificate and any warnings. Validation fails if, for example, the certificate and the key do not match, the certificate is expired or not yet valid, the key type is not supported, or the chain does not belong to the certificate.
Warnings do not stop you from applying the certificate. Typical warnings are: the certificate is self-signed, it expires soon, it does not cover the host name, it is issued by a CA but no chain was supplied, or the chain ends at an internal intermediate whose root is not trusted by the server.
-
Check the preview, and click Apply Certificate.
-
In the Apply Web TLS Certificate? dialog, confirm.
The certificate is applied. Existing browser sessions are not affected; new connections use the new certificate. Keycyte PAM sends the intermediate chain to browsers in issuer order, without the root certificate.
Important
Make sure that the certificate covers the DNS name users type in the browser, and that user workstations trust the issuing CA. If browsers cannot connect after you apply a certificate, see Resetting the Web TLS Certificate.
Upload History
The Upload History table lists the certificates that were applied on this page, with Subject, Issuer, Valid Until, Uploaded By and Uploaded At. The Active column marks the certificate in use.
Fallback Certificates
If no applied certificate can be loaded at startup, the PAM server falls back to the PKCS#12 keystore from the installation (KEYCYTE_SERVER_TLS_KEYSTORE), and if that also fails, to a temporary self-signed certificate that is regenerated at every start. The PAM server therefore always serves HTTPS, and you can sign in (after accepting the browser warning) to apply a valid certificate.
When an applied certificate has expired, the fallback keeps the listener online. Upload a renewed certificate as soon as possible.
Expiry Warnings
Keycyte PAM checks the active certificate once a day and e-mails all MASTER administrators when it has 30, 14, 7 and 1 days left. Each warning is sent once; the next e-mail is sent when the certificate reaches the next threshold.
E-mail warnings require:
- a working mail server configuration on Settings > Notification;
- an e-mail address for each MASTER administrator. For domain users without an e-mail address in Keycyte PAM, the address is read from the directory.
Expiry warnings are sent only for certificates applied on this page, not for the installation keystore or the self-signed fallback.