Connectors authenticate with the platform using X.509 client certificates. Each connector installation presents a certificate when communicating with platform services, and the certificate's distinguished name is used as the connector's identity within the platform. That identity must be assigned the appropriate roles and resource permissions before the connector can upload data.
This article describes how to generate a certificate suitable for connector use on Windows, using Microsoft Certificate Manager and a Certificate Authority.
Requirements
Certificates used by connectors must meet the following requirements:
Issued by a Certificate Authority — either a public CA or an internal organisational CA
Extended Key Usage must include both Client Authentication and Server Authentication
Subject must be fewer than 100 characters
No wildcard characters in the subject
Common Name (CN) should match the hostname of the server where the connector is installed
Key size of 2048 bits or greater is recommended
A single certificate can be shared across multiple connector installations on the same server.
Step 1 — Generate a Certificate Signing Request
Open Microsoft Certificate Manager by running
certmgr.msc.Navigate to the Personal folder.
Right-click Certificates and select All Tasks \> Advanced Operations \> Create Custom Request.
Select Proceed without enrolment policy.
Choose a certificate template that supports both Client Authentication and Server Authentication.
Select an appropriate cryptographic provider and key size (2048 bits or greater).
In the Certificate Information section, open Details and select Properties.
Configure the Subject — set the Common Name (CN) to the hostname of the connector server, and add any other required identifying information.
Under Extended Key Usage, confirm both Server Authentication and Client Authentication are included.
Save the request to generate the Certificate Signing Request (CSR) file.
Step 2 — Submit the CSR to your Certificate Authority
Submit the CSR file to your Certificate Authority using their certificate request portal or process. Complete any validation steps required. Once approved, the CA issues the certificate.
Step 3 — Install the certificate
Save the issued certificate to the server.
Open Microsoft Certificate Manager.
Navigate to the Personal folder.
Right-click Certificates and select All Tasks \> Import.
Follow the import wizard to install the certificate into the Personal certificate store.
Step 4 — Export for connector use (PKCS#12)
The connector requires the certificate in PKCS#12 format, which includes the private key.
In Microsoft Certificate Manager, navigate to Personal \> Certificates.
Select the certificate and choose All Tasks \> Export.
Select Yes, export the private key.
Choose Personal Information Exchange (PKCS#12).
Enable the option to include the full certification path.
Complete the export. The resulting file is used when installing or modifying the connector.
Step 5 — Export the certificate chain for platform validation (PKCS#7)
The platform needs to trust the certificate. Export the certificate chain and provide it to support.
Select the certificate and choose All Tasks \> Export.
Select PKCS#7 format.
Include all certificates in the certification path.
Provide the exported file to support so the certificate chain can be registered with the platform.
After generating the certificate
Once the certificate is registered with the platform, it appears as a user identity. Assign the appropriate roles and resource permissions to this identity so the connector can write data to the correct objects. The certificate distinguished name shown on the connector's About screen is the identifier to use when configuring access.