Keycyte PAM 3.2 · Deployment Guide

Certificates

Keycyte PAM serves its web interfaces only over HTTPS and connects to LDAP directories over TLS. Prepare the following files before you run the installer and place them in the installation package folder.

The installer copies the files to ~/keycyte, which is mounted into the PAM server as /app. It warns if localhost.p12 or cacerts.pem is missing after the copy.

HTTPS Certificate

At startup, the PAM server loads the HTTPS certificate in the following order:

1. The certificate that a MASTER administrator applied on Settings > Web TLS Certificate in the Admin Panel. It is stored in the database.
2. The PKCS#12 keystore from KEYCYTE_SERVER_TLS_KEYSTORE (in the installation package: /app/localhost.p12), opened with the password in KEYCYTE_SERVER_TLS_PASSWORD.
3. A temporary self-signed certificate that the PAM server generates at every start. Browsers show a trust warning for it.

The third level makes sure that the PAM server always starts listening on HTTPS, even if the configured certificate is missing, expired or damaged. You can then sign in, accept the browser warning, and upload a valid certificate.

The localhost.p12 keystore is used only until you apply a certificate in the Admin Panel. After installation, manage the HTTPS certificate on Settings > Web TLS Certificate. See Configuring the Web TLS Certificate.

Requirements for the HTTPS Certificate

Plan a certificate that:

• is issued for the DNS name that users type in the browser (for example pam.example.com);
• uses an RSA key of at least 2048 bits, or an ECDSA key on the P-256 or P-384 curve;
• is issued by a CA that user workstations trust, together with any intermediate certificates.

Keycyte PAM refuses Ed25519, DSA and ECDSA P-521 keys, because browsers cannot complete a TLS handshake with them.

LDAP CA File

cacerts.pem holds the CA certificates that are used to verify LDAP servers over LDAPS or StartTLS. Its path is set in LDAP_CA_CERT in the installation package’s .env file (/app/cacerts.pem). The PAM server adds these certificates to the system CA store.

You can also add LDAP server certificates later from the Admin Panel, when you configure a directory connection. See the Administrator Guide, section Settings > Authentication.