Automated SSL certificate renewal for Aruba ClearPass

ClearPass won't update a renewed certificate on its own. CertKit will.

Every ClearPass Policy Manager server holds a separate certificate for each service it runs: HTTPS(RSA) and HTTPS(ECC) for the admin UI and guest portal, and RADIUS/EAP for 802.1X authentication. When a certificate renews, each of those slots keeps serving the old one until someone imports the new certificate into the Certificate Store — per service, per cluster node. Every 47 days. On every cluster you manage.

CertKit centralizes certificate issuance and renewal, then pushes the renewed certificate to your ClearPass servers automatically via the CertKit Agent and the ClearPass REST API, importing it into the service you choose on one node or the whole cluster.

Start free trial Watch demo

Built for Aruba ClearPass

Pre-built templates for the HTTPS(RSA), HTTPS(ECC), and RADIUS/EAP server certificates ship in your CertKit account. No scripting required.

CertKit renews your ClearPass certificate for you. On every renewal it authenticates to the ClearPass REST API, imports the new certificate and chain as a PFX into the service you picked, and repeats that on every cluster node you told it to cover. No Certificate Store clicks, no per-node repetition.

ClearPass restarts the affected service on each node it updates — a brief admin UI and guest portal blip for the HTTPS certificates, and a moment of failed-and-retried authentications for RADIUS/EAP. Schedule deployments in a maintenance window so renewals land at 2am Sunday, not mid-workday.

How to install an SSL certificate on Aruba ClearPass

The manual process, if you want to do it yourself:

Create a certificate signing request. Under Administration → Certificates → Certificate Store, select the server and the service type — HTTPS(RSA), HTTPS(ECC), or RADIUS/EAP — and choose Create Certificate Signing Request. Or create the CSR and key externally.
Submit the CSR to a certificate authority. Purchase a certificate or use a free ACME CA, then wait for the signed certificate file to come back. A wildcard certificate can cover the guest portal and the RADIUS server identity with one subject.
Enable the CA chain in the Trust List. Under Administration → Certificates → Trust List, every CA in the chain must be present and enabled — with the EAP usage for the RADIUS/EAP certificate — or the import fails validation.
Import the certificate. Back in the Certificate Store, choose Import Certificate for the same server and service and upload the certificate, private key, and chain. The service restarts when the import lands, so pick your moment.
Repeat for every service and every cluster node. Each ClearPass server holds its own certificate for each service. A cluster of three nodes running HTTPS and RADIUS is six imports, and none of them refresh on their own.

Every one of these steps is manual, and ClearPass won't repeat any of them for you when the certificate renews. With lifetimes shrinking to 47 days, installation stops being an annual chore and becomes a recurring task: eight times a year, on every service, on every node. Miss the RADIUS/EAP one and 802.1X clients start failing authentication — laptops and phones silently fall off the Wi-Fi.

At 47 days, automation is the only sustainable way to run ClearPass certificates. Here's how CertKit does it.

How it works

 Your network            CertKit                 ACME CA
┌───────────────────┐     ┌──────────────────┐    ┌─────────────┐
│  ┌─────────────┐  │     │                  │    │             │
│  │Deploy Agent │◄─┼─────┤  Issue & Renew   │◄──►│             │
│  └──┬────┬─────┘  │     │   Certificates   │    │             │
│     │    │ REST   │     │                ┌───┐  └─────────────┘
│     │    │ API    │     └───────────┬────│DNS│
│     ▼    ▼        │                 │    └───┘
│ ┌──────────────┐  │                 │
│ │ ClearPass    │  │                 │
│ │ [x] Imported │  │ ◄───────────────┘
│ │ [x] Restarted│  │       Verify
│ └──────────────┘  │
└───────────────────┘

CertKit issues and renews certificates centrally in the cloud using delegated DNS validation. You create a one-time CNAME record; CertKit handles every ACME challenge after that.

The deploy agent is a small service you run on a Windows host inside your network. It makes an outbound HTTPS connection to CertKit to pull each renewed certificate, then connects to ClearPass over its REST API on your LAN to import the certificate into each target server. ClearPass never talks to CertKit or the public internet directly, never runs ACME, needs no port 80 open to the world, and never stores DNS credentials. One deploy agent can reach every ClearPass cluster and other appliance on that network, so there's nothing to install on the appliances themselves.

CertKit makes what many companies struggle with much easier to manage while at the same time providing great value compared to the traditional vendors in the space.

Ben Story, Managed Services Director, RedEye Network Solutions

Three certificates on every ClearPass server

ClearPass doesn't have one certificate, it has a slot per service on every node in the cluster. CertKit ships a pre-built template for each service. Pick the ones you use; the rest stay untouched.

HTTPS(RSA) Admin UI, guest portal, web services HTTPS(ECC) The EC-key counterpart, for clients that prefer ECDSA RADIUS/EAP Presented to 802.1X clients on Wi-Fi and wired NAC

What CertKit handles

Issue certificates via ACME, centrally. Your appliances have no ACME configuration, no open ports, no public DNS credentials. One CNAME record is all your domain contributes.
Renew automatically before expiry. That one-time CNAME covers every renewal challenge going forward. No intervention required on any device.
Issue the right key for the right slot. The HTTPS(ECC) service rejects RSA keys, so its template issues the certificate with an EC key while the HTTPS(RSA) and RADIUS/EAP templates use RSA. You never juggle key algorithms by hand.
Import over the ClearPass REST API. The CertKit Agent authenticates with an OAuth2 API client and imports the renewed certificate as a password-protected PFX with the full chain. ClearPass only accepts server certificates by downloading a PKCS#12 from a URL, so the agent serves the file from a temporary one-time URL on your LAN and tears the listener down when the import finishes — opening and removing the Windows Firewall rule for it automatically.
Update one node or the whole cluster. Name a single server from Server Manager or say all and CertKit walks every node in the cluster. The node whose API the agent is talking through updates last, so the web service restart can't cut off the deployment halfway.
Fail with a pointer, not a mystery. RADIUS/EAP imports require each CA in the chain to be enabled for EAP in the Trust List. When one is missing, the deployment fails naming the offending CA — a one-time fix per CA, not an unexplained error.
Verify the deployment, not just the script. After each renewal, CertKit connects to your published service and confirms the new certificate is actually being served. It checks the serial number, SANs, and expiry. If something is wrong, you find out before your users do.
Alert on failure. Import failures, unreachable nodes, verification mismatches, and upcoming expirations all generate alerts before they become incidents.
Audit every change. Every issuance, renewal, and deployment is logged with timestamp, certificate, and device. With certificate lifetimes heading to 47 days, that log is your compliance record.

Setup takes about ten minutes

Connect your domain. Add a one-time CNAME record to delegate DNS validation to CertKit. Every renewal challenge after that is automatic.
Create an API client. Under ClearPass Guest → Administration → API Services → API Clients, create a client with the client_credentials grant and an operator profile that allows Policy Manager Certificates read/write. CertKit authenticates with the client ID and secret.
Install the CertKit Agent. One command on any Windows host with HTTPS reachability to ClearPass. The agent runs as a background service. ClearPass pulls the PFX from the agent during each import, so it needs to reach the agent host on one TCP port (18080 by default).
Add the ClearPass deployment script. Choose the template for the service you're securing, set the ClearPass hostname, the API client credentials, and the target server name — or all for the cluster. CertKit runs it on every renewal.

See the full architecture →

Why not run ACME on ClearPass?

ClearPass has no ACME client, and the appliance that gatekeeps your network access is the last place to put DNS provider credentials or an open port 80 — either one is a privilege escalation waiting to happen.

Scripting the renewal yourself has its own sharp edges: OAuth token handling, an import API that only accepts a PKCS#12 by downloading it from a URL — so your script has to stand up a web server just to hand ClearPass a file — a loop over every cluster node, and the restart ordering that kills your own API session if you update the wrong node first. We built and tested the deployment for each service so you don't have to. CertKit issues the certificate via delegated DNS validation, then the agent handles the import, the cluster fan-out, and the cleanup as one verified step, with no ACME client on the appliance.

ClearPass is just one part of your network edge

Most networks have more than one place where TLS certificates live: firewalls like Fortinet, Cisco Firepower, and Juniper SRX, load balancers like F5 BIG-IP, and Microsoft Network Policy Server doing the same RADIUS job in Windows shops. CertKit automates all of it from one account.

See all integrations

Start automating ClearPass certificates today

Free 90-day trial. No credit card required. Direct access to our engineering team to get you set up.

Start free trial See pricing