Security

Hey everyone,

I've been working on certificates for some time now, and I wanted to ask here about what might be developing with regard to the server certificates. Getting certificates into ClearPass is not difficult, but there are a lot of options and ways that can go wrong. Even for someone familiar with the platform, the yearly cycle of replacing the various certs can be a chore.
Would love to set up a process that can get the radius cert from my PKI automatically, and if the HTTP cert could use the ACME protocol... I know there are lots of moving parts there, but I'd love to see some progress.

The browser certs will be 47 days in a few years (2029) but it'll start with 200 days next year. Is there any plan to implement some automation into the process of getting certs soon?

Hi Man,

Aruba has opened a feature request (SEC-I-726) to provide native PKI enrollment for RADIUS/EAP certs and ACME support for HTTP/TLS certs, though it remains in "future consideration." You can review and up-vote it here:

https://innovationzone.arubanetworks.hpe.com/ideas/SEC-I-726

In the meantime, the recommended approach is to script certificate issuance and renewal via the ClearPass REST API.

Here's the reference to that as well from the developer site:

https://developer.arubanetworks.com/cppm/reference/certificatebycertificate_idget

Best regards,
Vigan

Original Message:
Sent: Jun 18, 2025 11:18 AM
From: hornp
Subject: Server Certificates management in ClearPass

Hey everyone,

I've been working on certificates for some time now, and I wanted to ask here about what might be developing with regard to the server certificates. Getting certificates into ClearPass is not difficult, but there are a lot of options and ways that can go wrong. Even for someone familiar with the platform, the yearly cycle of replacing the various certs can be a chore.
Would love to set up a process that can get the radius cert from my PKI automatically, and if the HTTP cert could use the ACME protocol... I know there are lots of moving parts there, but I'd love to see some progress.

The browser certs will be 47 days in a few years (2029) but it'll start with 200 days next year. Is there any plan to implement some automation into the process of getting certs soon?