Getting Started with Vendor Application Connection

1.0 Introduction

This article helps you get started with the CyberArk vendor application integration in Fortanix Key Insight to scan certificates.

2.0 Terminology References

For CyberArk connection concepts and supported features, refer to CyberArk Connection Concepts.

3.0 Start the Connection Setup

Before configuring a CyberArk connection, ensure you can access Fortanix Key Insight.

For information about signing up for Fortanix Armor, creating an Armor account, and accessing Fortanix Key Insight, refer to Getting Started with Key Insight.

You can start the connection setup when you first access Fortanix Key Insight or after you have entered the application.

• First-time users: When you access Fortanix Key Insight for the first time, the connection setup wizard is displayed automatically. Proceed to Section 4.0: Configure a CyberArk (SaaS) Connection or Section 5: Configure a CyberArk (On-premises) Connection to configure the required CyberArk connection.

• Existing users: In Fortanix Key Insight, go to Configuration → Connections → VENDOR APPLICATIONS → ADD VENDOR APPLICATION. Proceed to Section 4.0: Configure a CyberArk (SaaS) Connection or Section 5: Configure a CyberArk (On-premises) Connection to configure the required CyberArk connection.

4.0 Configure a CyberArk (SaaS) Connection

After you access the Fortanix Key Insight solution from Fortanix Armor, you can configure and onboard a CyberArk (SaaS) connection to scan your cryptographic materials.

4.1 Prerequisites

Before setting up a CyberArk (SaaS) connection in Fortanix Key Insight, ensure that the CyberArk platform is correctly set up and that the necessary access, permissions, and API integration are in place.

4.1.1 Set Up CyberArk Certificate Management Identity and Permissions

Perform the following steps to set up identity and permissions in CyberArk Certificate Management:

1. Log in to the CyberArk Certificate Management (formerly Venafi SaaS) platform.

2. Set up the service account for Fortanix Key Insight integration by creating an identity with WebSDK access enabled.

   NOTE

   Use the CyberArk Certificate Management Username and Password created in this step when configuring the CyberArk (SaaS or On-premises) connection in Fortanix Key Insight.

3. Assign permissions to the service account created in Step 2:

   1. Navigate to Policy Tree.

   2. Select the Root Policy Object.

   3. Click General, and then select Permissions.

   4. Grant the following permissions to the selected service account:

      • View

      • Read

   5. Click Save.

4.1.2 Create CyberArk Certificate Management API Integration

Perform the following steps to create an API Integration in CyberArk Certificate Management for Fortanix Key Insight:

1. Log in to the CyberArk Certificate Management (formerly Venafi SaaS) platform.

2. Create a new API Integration. For detailed steps, refer to the CyberArk official documentation.

   While creating the API Integration, ensure Access Token Authentication is configured with the following settings:

   • Token Refresh is enabled (this is enabled by default).

   • The Username and Password is selected in Allowed Authentication Methods.

   For detailed steps on Access Token authentication, refer to the CyberArk official documentation.

3. In the User or team access section of the API Integration, add the service account created in Section 4.1.1: Set Up CyberArk Certificate Management Identity and Permissions to run this integration.

   1. Search for the service account and select it.

   2. Click Add.

   For detailed steps, refer to the CyberArk official documentation on assigning service accounts to an API Integration.

4. Create the API Integration for Fortanix Key Insight by importing the following JSON configuration:

   {
     "id": "fortanix",
     "name": "Fortanix",
     "vendor": "",
     "description": "Fortanix Key Insight",
     "scope": "certificate:discover,manage;configuration:manage"
   }
   

   NOTE

   The value of the id field (for example, fortanix) is used as the Client ID when configuring the CyberArk (SaaS or On-premises) connection in Fortanix Key Insight.

4.1.3 Confirm CyberArk Certificate Management Access Details

Before proceeding, ensure you have the following information readily available:

• CyberArk URL:  The base URL of the CyberArk Certificate Management (formerly Venafi SaaS) tenant used to access the service.

• Username and Password: Defined in Section 4.1.1: Set Up CyberArk Certificate Management Identity and Permissions.

• Client ID of the API Integration: Defined in Section 4.1.2: Create CyberArk Certificate Management API Integration.

NOTE

Contact your CyberArk administrator if you need help confirming the required access details.

Using these credentials, Fortanix Key Insight makes an API call to CyberArk to obtain an access token with the required scopes (certificate:discover,manage;configuration:manage). These scopes authorize Fortanix Key Insight to scan and analyze certificates managed by CyberArk.

4.1.4 IP Whitelisting Requirements

To enable secure and reliable communication between Fortanix Key Insight and your CyberArk environment, certain network connections may need to be allowed.

If IP whitelisting is required, retrieve the current Fortanix IP ranges from the Fortanix SaaS IP Ranges endpoint and allow the applicable IP ranges in your firewall or network infrastructure.

For information about Fortanix SaaS IP ranges and how to determine the applicable IP addresses based on traffic direction, region, and service, refer to Fortanix SaaS IP Whitelisting.

NOTE

IP whitelisting is not mandatory. It is required only if your CyberArk environment restricts inbound API access based on source IP addresses.

4.2 Select Connection Type

Perform the following steps to select the scan type, connection type, and CyberArk (SaaS) connection type:

1. On the Select Connection Type step, select Automated Scan as the scan type.

2. Under Select connection type, select Vendor Applications. Then, under Select vendor application, select CyberArk (SaaS).

3. Click NEXT.

4.3 Set Up Authentication

CyberArk supports secret-based authentication to control how users and applications obtain credentials to access CyberArk certificates.

4.3.1 Secret-Based Authentication

An authentication method in which an application securely stores CyberArk (SaaS) connection secrets (CyberArk URL, username, password, and client ID) and uses them to authenticate with CyberArk and obtain an access token. This access token is then used to authorize subsequent CyberArk API requests.

Perform the following steps to add secret-based CyberArk authentication:

1. On the Set Up Authentication step:

   1. CyberArk URL: Enter the CyberArk URL.

   2. Username: Enter the CyberArk username.

   3. Password: Enter the CyberArk password.

   4. Client ID: Enter the CyberArk Client ID.

2. Click NEXT.

4.4 Set Up Vendor (SaaS) Connection

Perform the following steps on the Set Up Vendor (SaaS) Connection step:

1. Connection Name: Enter a name for your connection. For example, CyberArk connection.

2. Click NEXT.

4.5 Add Key Insight Policy

The Fortanix Key Insight System Defined Policy is selected by default on the Key Insight Policy step. This policy is designed to facilitate the scanning of keys and services based on predefined key sizes and permitted operations, ensuring compliance with standard security configurations.

Additionally,

• Click ADD POLICY to add a new user-defined policy to the policy center.

• Click to copy and modify a system-defined policy, converting it into a user-defined policy.

For more information on Fortanix Key Insight policies and features, refer to Cryptographic Policy Management.

NOTE

If you change or update the policy instead of the System Defined Policy, you must Rescan the CyberArk (SaaS) connection to apply the new policy.

Click FINISH to complete the CyberArk (SaaS) connection onboarding.

NOTE

After onboarding the CyberArk (SaaS) connection:

• View the user interface (UI) (Overview and Certificates). You can also switch the region at any time using the region switcher drop down located on the top navigation bar. When the region is changed, the UI updates automatically to show the data, connections, and scan results for that region.

  For more information about the CyberArk connection (SaaS and On-premises) overview and related UI components, refer to CyberArk Connection-User Interface Components.

• Users with the Account Administrator and Group Administrator roles can manage (edit, delete, rescan) the connection from the Configuration → Connections → VENDOR APPLICATIONS.

  • Deleting the CyberArk (SaaS) connection cannot be undone.

• A group with the same name will be created on the Fortanix IAM Groups page. For more information, refer to Fortanix Armor Identity and Access Management (IAM).

5.0 Configure a CyberArk (On-premises) Connection

After you access the Fortanix Key Insight solution from Fortanix Armor, you can configure and onboard a CyberArk (On-premises) connection to scan your cryptographic materials.

5.1 Prerequisites

Before configuring a CyberArk (On-premises) connection in Fortanix Key Insight, ensure that the required CyberArk identity, permissions, API integration, and Fortanix On-premises Scanner prerequisites are ready.

5.1.1 Set Up CyberArk Certificate Management Identity and Permissions

Perform the steps described in Section 4.1.1: Set Up CyberArk Certificate Management Identity and Permissions.

5.1.2 Create CyberArk Certificate Management API Integration

Perform the steps described in Section 4.1.2: Create CyberArk Certificate Management API Integration to create an API Integration in CyberArk for Fortanix Key Insight.

5.1.3 Fortanix On-premises Scanner Requirements

In addition to the CyberArk platform configuration, CyberArk (On-premises) connections require the Fortanix On-premises Scanner.

For Fortanix On-premises Scanner prerequisites, refer to Getting Started with On-premises Connection.

5.2 Select Connection Type

Perform the following steps to select the scan type, connection type, and CyberArk (On-Premises) connection type:

1. On the Select Connection Type step, select Automated Scan as the scan type.

2. Under Select connection type, select Vendor Applications. Then, under Select vendor application, select CyberArk (On-Premises).

3. Click NEXT.

5.3 Set Up Vendor (On-premises) Connection

Perform the following steps on the Set Up Vendor (On-Premises) Connection step:

1. Connection Name: Enter a name for your connection. For example, CyberArk on-premises connection.

2. Click Fortanix on-premises scanner package to download the Fortanix On-premises Scanner for a CyberArk on-premises connection.

   1. After downloading the package, install it depending on your operating system (Linux or Windows).

      • For instructions on how to install the Fortanix On-Premises Scanner package on Linux, refer to On-premises Scanner Configuration - Linux.

      • For instructions on how to install the Fortanix On-Premises Scanner package on Windows, refer to On-premises Scanner Configuration - Windows.

   2. After installing the package, configure the CyberArk on-premises connection using the configuration file.

      For information on CyberArk On-premises connection configuration file parameters, refer to On-premises Scanner Configuration File.

   3. After configuration, run the Fortanix On-premises Scanner package depending on your operating system (Linux or Windows).

      • For instructions on how to run the Fortanix On-Premises Scanner package on Linux, refer to On-premises Scanner Configuration - Linux.

      • For instructions on how to install the Fortanix On-Premises Scanner package on Windows, refer to On-premises Scanner Configuration - Windows.

3. I have downloaded and installed the Scanner package: After the scanner installation and configuration, enable the check box to establish a secure connection between your CyberArk On-premises environment and Fortanix Key Insight.

4. Click NEXT.

5.4 Add Key Insight Policy

The Fortanix Key Insight System Defined Policy is selected by default on the Key Insight Policy step. This policy is designed to facilitate the scanning of keys and services based on predefined key sizes and permitted operations, ensuring compliance with standard security configurations.

Additionally,

• Click ADD POLICY to add a new user-defined policy to the policy center.

• Click to copy and modify a system-defined policy, converting it into a user-defined policy.

For more information on Fortanix Key Insight policies and features, refer to Cryptographic Policy Management.

NOTE

If you change or update the policy instead of the System Defined Policy, you must Rescan the CyberArk (On-premises) connection to apply the new policy.

Perform the following steps:

1. Click ADD SCANNER & GENERATE API KEY.

2. In the API Key Details dialog box, click COPY API KEY to copy the API key value and to complete the CyberArk(On-premises) connection onboarding.

   NOTE

   The API key is used by the Fortanix On-premises Scanner to authenticate with Fortanix Key Insight.

3. Close the dialog box to complete the onboarding.

   NOTE

   After onboarding the CyberArk (On-premises) connection:

   • You can verify the connection status on the VENDOR APPLICATIONS tab.

     • If the status is Connected, you can access the user interface (UI) (Overview and Certificates). You can alsoswitch the regionat any time using the region switcher drop down located on the top navigation bar. When the region is changed, the UI updates automatically to show the data, connections, and scan results for that region.

       For more information on the UI, refer to CyberArk Connection-User Interface Components.

     • If the status is Disconnected, restart the scanner to re-establish the connection.

     • If the status is Pending, use the generated API key to connect to Fortanix Key Insight. After the connection is established, add the resources to begin scanning.

   • Users with theAccount AdministratorandGroup Administratorroles can manage (edit, delete, rescan, and view details) the connection from the Configuration → Connections → VENDOR APPLICATIONS.

     • Deleting the CyberArk (On-premises) connection cannot be undone.

     • The Rescan option is available only when the CyberArk (On-premises) connection status is Connected.

     • When viewing the connection details:

       • Copy the Connection ID. This value is required in the Fortanix On-premises Scanner configuration.

       • Click MANAGE API KEY to manage (copy, delete, regenerate) the API key geneated.

         • You can generate a maximum of two API keys for configuring the connection between CyberArk (On-premises) and Fortanix Key Insight.

         • Deleting an API key may revoke access for the CyberArk (On-premises) connection, potentially disrupting its functionality. This action is irreversible.

       • Click DOWNLOAD PACKAGE to download the package again in case you changed your machine, your current package has errors or was not installed correctly.

       

   • A group with the same name will be created on the Fortanix IAM Groups page. For more information on Groups, refer to Fortanix Armor Identity and Access Management (IAM).