6.5.16 Aruba ClearPass

CertKit provides four ClearPass Policy Manager templates. The HTTPS templates update a server certificate on one or every cluster node. The RADIUS/EAP service-certificate template updates a cluster-wide service certificate.

Choose the template

Template	Key requirement	Scope	Service impact
HTTPS(RSA) Server Certificate	RSA	One server or all	Restarts the web service on each updated node.
HTTPS(ECC) Server Certificate	EC/ECDSA	One server or all	Restarts the web service on each updated node.
RADIUS/EAP Server Certificate	Match client requirements	One server or all	Restarts RADIUS on each updated node.
Service Certificate (Per-Service RADIUS/EAP)	RADIUS/EAP-capable certificate	Cluster-wide	Rebinds services that used the prior certificate with the same subject CN.

Use a deployment window for HTTPS and RADIUS server-certificate changes. Expect a short admin UI or captive-portal interruption for HTTPS and brief authentication retries for RADIUS.

API client permissions

Create an API client under ClearPass Guest > Administration > API Services > API Clients with:

• client_credentials grant type.
• An operator profile allowing Policy Manager Certificates read/write.
• Policy Manager Services read/write when using the per-service RADIUS/EAP template so CertKit can rebind services.

For server-certificate templates, set Cluster server to update to the exact name under Administration > Server Manager, or use all.

Callback network requirement

The ClearPass API imports a PKCS#12 file by downloading it from a URL. During deployment, the CertKit agent serves the password-protected PFX from a random one-time HTTP URL.

ClearPass must reach the agent host on the configured callback port, TCP 18080 by default. The agent temporarily opens Windows Firewall and removes the rule afterward. Any network firewall or ACL between ClearPass and the agent must also allow the connection.

Leave Agent address as reachable from ClearPass set to auto when the address selected by the route to ClearPass is reachable in the reverse direction. Set an explicit address when the host uses NAT or multiple network interfaces.

If the deployment says “ClearPass never downloaded the PFX,” test routing and TCP access from ClearPass to the displayed callback address and port.

Trust List requirement for RADIUS/EAP

The RADIUS/EAP Server Certificate and Service Certificate templates require every CA in the certificate’s actual chain to be present and enabled in the ClearPass Trust List with the EAP usage. This includes the intermediate CA certificates and the root CA required by ClearPass. Do not add the leaf server certificate to the Trust List.

For Let’s Encrypt certificates:

1. Identify each CA in the issued certificate’s chain or read the CA named in the ClearPass error.
2. Download the official PEM or DER CA certificate from the Let’s Encrypt Chains of Trust page. Use the current chain rather than assuming one fixed intermediate or root. If the error names ISRG Root X1, import the official ISRG Root X1 certificate from that page.
3. In ClearPass Policy Manager, open Administration > Certificates > Trust List and select Add.
4. Select the CA certificate file.
5. Add the EAP usage. Add other usages such as RadSec or Server/Client Trust only when required by the environment.
6. Check Enabled, then select Add Certificate.
7. Repeat for every missing CA certificate in the chain and rerun the CertKit deployment.

Use the official CA certificate file. Re-exported or incomplete files can omit extensions ClearPass expects, including the Subject Key Identifier.

Per-service renewal matching

Service-certificate renewals are matched by subject common name. CertKit imports the renewal, re-points services using the previous matching certificate, and deletes superseded matching certificates. A first deployment with no matching common name adds the certificate without changing a service binding.

For a product overview, see certificate automation for Aruba ClearPass.