Certificates used by ePO

[Wu_Yuxuan]

What are the certificates in use by ePO that could be issued by an internal CA? We are doing an exercise to renew any certs that are close to expiry, and found 2 certs on our CA that are issued to the ePO server. I could only find information for one type of cert, which is the ePO web console cert.

[Hawkmoon · Accepted solution]

Hi Wu_Yuxuan,

Maybe this will help?

1. Open up a command prompt and type in mmc.exe.
    (This will open up a mmc console.)

2. Click on file->Add/remove a snapin. Next click the Add button.
    (This brings up a list of standalone snapins.)

3. Choose the Certificates snapin.
    a. Select Computer Account. We store all our certificates to the system.
    b. Choose Local Computer

4. Select 'Close' and 'Ok'.

You should now have an mmc console with the 'Certificates (Local Computer)' in the mmc console. The ePO certificates are located in the following locations:

    • Orion_CA_<EPOServer Name>
        - This is located in the Certificates->Trusted Root Certification Authorities->Certificates.
    • AH_CA_<EPOServer Name>
        - This is located in the Certificates->Intermediate Certification Authorities->Certificates.
    • AH_<Agent Handler Server Name>
        - This is located in the Certificates->Personal->Certificates.

[Hawkmoon]

The following is for information. 😉😀

How to regenerate the certificates used by the McAfee ePO server service
Technical Articles ID: KB90760

How to generate a custom SSL certificate for use with ePolicy Orchestrator using the OpenSSL toolkit

Technical Articles ID:   KB72477

[cdinet · Accepted solution]

You are correct, the only cert that can be changed is the browser cert.

[Wu_Yuxuan]

Noted on the 3 ePO self-signed certs and the 1 CA-issued web console cert. Thanks for the help, Hawkmoon and cdinet.