Configure mTLS Certificate

Use this step to configure mutual TLS (mTLS) certificates for secure internal and external communications.

About this task

The mTLS Certificate Configurations step ensures encrypted and trusted communication between the BigFix UI application and its endpoints. You define certificate attributes such as common name, subject alternative names (SANs), IP addresses, cryptographic algorithm, and certificate authority. All fields are mandatory.

Procedure

  1. After completing Application Configuration, click Next button to open the MTLS Certificate Configurations screen.

  2. In the Common name field, enter a resolvable FQDN or IP address for the certificate.

    Example: bfserver.example.com.

  3. In the Subject alternative names (SANs) field, specify one or more DNS names or IP addresses.

    Separate multiple SANs with commas.

    Example: bfserver.example.com, api.example.com.

  4. In the IP Address field, provide the IP address associated with the certificate.
  5. Under Algorithm, select the cryptographic algorithm for the certificate.
    • RSA-4096 (default)
    • ECC-P384
  6. Under Certificate authority, choose the CA for issuing the certificate.

    • Internal CA (default)

    • You can configure an external CA if required.

  7. Review all entries carefully. After saving, the application generates and uses this certificate for TLS-secured endpoints.
  8. Click Next to continue to the BES Explorer Configurations step.

    If the mTLS configuration is accepted, a success message is displayed.