<img height="1" width="1" style="display:none;" alt="" src="https://px.ads.linkedin.com/collect/?pid=1110556&amp;fmt=gif">
Skip to content
    June 22, 2021

    What Kind of Certificates Should I Use for Automic Automation v21?

    Key Takeaways
    • Select appropriate certificates for secure communication, enhancing the safety of your automation processes.
    • Utilize trusted certificate authorities to ensure the validity and reliability of your security certificates.
    • Monitor certificate expiration dates to proactively manage renewals and prevent service disruptions.

    The next version of Automic Automation mandates TLS/SSL for communications between the engines, Automic Web Interface (AWI), and most agents. Customers have to decide what type of certificates they will use to secure the communications across Automic.

    A public-key certificate contains information like name, hostname/domain name/IP address, validity period, the location that can be used to identify the owner (server), and the public key that the client uses to verify the server. By signing the certificate with a digital signature, for example, Public Certificate Authority (CA), you can ensure that the certificate is valid and trusted by all clients who trust this CA.

    The Automic Automation TLS/SSL implementation uses public-key certificates in X.509 format and TLS version 1.2 for secure connections between the server and AWI/agents.

    There are several questions that customers need to ask before moving to Automic Automation v21:

    • Does your company already use certificates signed by a third-party CA, and can they also be used for Automic?
    • Do you need to comply with strict security standards when using Automic Automation, especially in production environments?
    • Who is going to be responsible for managing the certificates? Is there a dedicated person/team for the Public Key Infrastructure (PKI) in the company?
    • Who will be responsible for installing/distributing certificates and configuring TLS/SSL for Automic Automation?
    • How many certificates will you need? Is it just a couple for your Automic servers, or do you have to manage multiple servers spread across many locations and need to have a centralized view?
    • How important is connection security? What’s the worst that could happen if a certificate is expired or is compromised?

    Based on your company’s requirements and resources, three main types of TLS/SSL certificates are available to secure communications.

     

    Certificates Signed by a Public Certificate Authority

    The main benefit of using certificates signed by a Public CA (DigiCert, Microsoft, Let’s Encrypt, ...) is that they are usually already trusted by many operating systems or applications, thus eliminating the effort of deploying them to all clients.

    The root certificates of these authorities, or intermediate ones signed by the root CA, are often installed as trusted certificates in the Windows certmgr, Unix OpenSSL truststore, or the Java trusted Keystore cacerts.

    A CSR (Certificate Signing Request) must be created and sent to the responsible authority to have certificates signed by a CA. Typically IT departments take care of CSRs, and public CAs offer APIs to send CSRs.

    Commercial CA certificate renewal can be done either by using vendor-specific tools or via their website.

     

    Certificates Signed by an Internal Certificate Authority

    For testing purposes or applications that are not Internet-facing, another alternative uses the benefits of having CA-signed certificates without turning to third-party vendors - creating your own Certificate Authority.

    The root certificate of the internal CA can then be used to sign certificates for hostnames and domains within the company. A CSR request is required to sign other certificates with this CA.

    Certificates signed by an internal CA can be renewed by re-using the previous private key/CSR to create a new server certificate.

     

    Self-Signed Certificates

    While using self-signed certificates gives you the flexibility to manage your security without being a TLS expert, renewing and distributing them is your responsibility.

    There are plenty of free tools to generate self-signed certificates, like Java’s keytool, openssl, or via the UI of KeyStore Explorer. To renew self-signed certificates, you will need to replace the old certificates with new ones.

     

    What To Do Next

    The decision of which kind of certificates to use for your Automic systems should be carefully considered, as it determines not only how secure the connections will be but also influence the amount of time you need to invest in renewing and deploying the certificates.

    Sometimes, a combination of the above might be the best way to go, depending on your security needs and knowledge of TLS/SSL.

    We have created a series of guides to walk you through the creation and deployment of certificates across a new Automic Automation v21 installation:

    Oana Botez

    Oana is a Product Owner at Broadcom with responsibility for the Automic Automation product and has a background in Software Engineering. Her current focus is on improving security by implementing modern standards like TLS/SSL and on delivering the first container-based solution of Automic.

    Other resources you might be interested in

    icon
    Blog October 8, 2025

    Nobody Cares About Your MTTR

    This post outlines why IT metrics like MTTR are irrelevant to business leaders, and it emphasizes that IT teams need network observability to bridge this gap.

    icon
    Blog October 8, 2025

    Tag(ging)—You’re It: How to Leverage AppNeta Monitoring Data for Maximum Insights

    Find out about tagging capabilities in AppNeta. Get strategies for making the most of tagging and see how it can be a game-changer for your operations teams.

    icon
    Office Hours October 6, 2025

    Rally Office Hours: October 2, 2025

    The Rally Model Context Protocol (MCP) Server acts as a standardized interface for AI models and developer tools. Learn about this exciting new feature then follow the weekly Q&A session with Rally...

    icon
    Blog October 1, 2025

    Why 1% Packet Loss Is the New 100% Outage

    In an era of real-time apps and multiple clouds, the old rules about 'acceptable' network errors no longer apply. See why you need end-to-end observability.

    icon
    Office Hours September 30, 2025

    Rally Office Hours: September 25, 2025

    Rally Office Hours delivers an essential product tip: Learn to transition from Legacy Custom Pages to powerful Custom Views. Plus, Q&A insights.

    icon
    Blog September 26, 2025

    Defining the Network Engineer of Tomorrow

    Read this post and see why the most important investment isn't in new hardware, but in transforming your team from device managers to service delivery experts.

    icon
    Blog September 26, 2025

    Harnessing AppNeta’s Browser- and HTTP-based Workflows to Track User Experience

    AppNeta’s browser- and HTTP-based workflows let you see what users actually experience. Preempt issues before they become headaches for your end users.

    icon
    Blog September 26, 2025

    “Rego U” Recap: Why SPM Is Still Hot

    Rego Consulting’s Annual Conference underscored why strategic portfolio management (SPM) is still essential. Leverage SPM to bridge strategy and execution.

    icon
    Blog September 23, 2025

    What's New in AutoSys 24.1: Built for the Modern Automation Landscape

    See how AutoSys 24.1 is designed to streamline your daily tasks, accelerate troubleshooting, and simplify how you integrate with the latest technologies.