Rublon

Secure Remote Access

By

Starting with version 3.12.0, Rublon Authentication Proxy for Windows includes the Rublon Windows Certificate Export Helper. The helper exports a certificate and its private key from the Windows Certificate Store to the PEM files required by an LDAP Proxy that uses SSL or STARTTLS.

The helper lists suitable certificates, validates the selected certificate, encrypts the exported private key, and verifies that the certificate and private key match. It does not leave an intermediate PFX file on disk.

Prerequisites

Before you begin, make sure that:

  • Rublon Authentication Proxy 3.12.0 or later is installed on a Windows machine.
  • The certificate is installed in the Personal certificate store.
  • The certificate includes an accessible and exportable private key.
  • The certificate is currently valid and is valid for Server Authentication.
  • The certificate’s Subject Alternative Name contains the DNS name or IP address that LDAP clients use to connect to the Rublon Authentication Proxy.
  • The certificate is trusted by the connecting LDAP clients.

By default, the helper reads certificates from:

Local Computer\Personal

IMPORTANT

A private key marked as non-exportable cannot be made exportable afterward. Reissue the certificate using a template that allows private-key export or import the original PFX with the private key marked as exportable.

Exporting the Certificate

1. Open PowerShell as an administrator.

2. Go to the Rublon Authentication Proxy installation directory:

cd "C:\Program Files\Rublon Auth Proxy"

3. Start the guided Rublon Windows Certificate Export Helper:

.\bin\rublon-certificate-export.exe

4. When prompted, enter the DNS name or IP address that LDAP clients use to connect to the Rublon Authentication Proxy:

DNS name or IP address clients use to reach this proxy:

Entering this value is strongly recommended. The helper verifies whether the selected certificate covers the specified DNS name or IP address.

5. Review the certificates displayed by the helper. For example:

[1] CN=rap.example.com
    Valid until: 2028-09-18
    DNS names: rap.example.com
    Server Authentication: Yes
    Status: Ready
    Thumbprint: FA83F1394F3E140EC941EF7B5058637CCA725AA8

6. Select the appropriate certificate by entering its number or thumbprint.

7. Enter and confirm a password for the exported private key.

Note

The password is not displayed or stored by the helper. Store it securely because the Rublon Authentication Proxy needs it to load the encrypted private key.

Generated Files

By default, the helper creates the following files:

C:\Program Files\Rublon Auth Proxy\config\certificates\ldap-proxy-certificate.pem
C:\Program Files\Rublon Auth Proxy\config\certificates\ldap-proxy-private-key.pem

The private key uses the encrypted PKCS#8 PEM format. The helper also verifies that the exported certificate and private key match. No intermediate PFX file is left on disk.

Configuring Rublon Authentication Proxy

Add the generated certificate path, private-key path, and private-key password to the LDAP Proxy entry in config\config.yaml:

proxy_servers:
  - name: LDAP-Proxy
    type: LDAP
    ip:
    port: 636
    auth_source: LDAP_SOURCE_1
    auth_method: email
    cert_path: 'C:\Program Files\Rublon Auth Proxy\config\certificates\ldap-proxy-certificate.pem'
    pkey_path: 'C:\Program Files\Rublon Auth Proxy\config\certificates\ldap-proxy-private-key.pem'
    pkey_password: 'PRIVATE_KEY_PASSWORD'

The LDAP Proxy copies the transport_type setting from its LDAP authentication source. Make sure that the referenced authentication source uses ssl or starttls. For complete LDAP Proxy configuration instructions, refer to Configuring the Rublon Authentication Proxy as an LDAP Proxy Server.

Replace PRIVATE_KEY_PASSWORD according to the value of global.secret_source:

Restart the Rublon Authentication Proxy service after saving the configuration:

net stop RublonAuthProxy
net start RublonAuthProxy

Command-Line Options

You can provide certificate-selection options directly on the command line. For example:

.\bin\rublon-certificate-export.exe `
  --hostname rap.example.com `
  --thumbprint 0123456789ABCDEF0123456789ABCDEF01234567

The available options include:

  • --hostname – Specify the DNS name or IP address that the helper should validate against the certificate.
  • --thumbprint – Select a certificate directly by its thumbprint.
  • --store-location CurrentUser – Read certificates from the current user’s Personal certificate store instead of the Local Computer store.
  • --output-dir PATH – Save the generated files in a different directory.
  • --overwrite – Replace existing certificate and private-key files.
  • --unencrypted-private-key – Export the private key without password-based encryption.

IMPORTANT

Use an unencrypted private key only when your organization’s security controls explicitly permit it. Restrict access to the generated file so that only the account running the Rublon Authentication Proxy service and authorized administrators can read it.

Troubleshooting

The Private Key Is Non-Exportable

The export policy is set when the private key is generated or imported and cannot be changed for an existing key. Reissue the certificate using a template that allows private-key export or import the original PFX with Mark this key as exportable enabled.

Access to the Private Key Was Denied

Run PowerShell as an administrator. If the issue persists, open certlm.msc, locate the certificate in the Personal store, and select All Tasks → Manage Private Keys. Grant the account performing the export read access to the private key.

Hostname Validation Failed

Make sure that the certificate’s Subject Alternative Name contains the exact DNS name or IP address that LDAP clients use to connect to the Rublon Authentication Proxy.

Existing Output Files Were Found

The helper does not overwrite existing files by default. Back up the existing certificate and private-key files, and then run:

.\bin\rublon-certificate-export.exe --overwrite

LDAP Clients Do Not Trust the Certificate

Install the issuing CA certificate in the trusted certificate store of each connecting LDAP client. If you use a self-signed certificate in a test environment, the client must trust that certificate directly.

Creating a Certificate for Testing

For a test environment, you can create an exportable self-signed certificate in an elevated PowerShell window:

$dns="rap.example.com"; $expiry=(Get-Date).AddYears(2); $cert=New-SelfSignedCertificate -Type SSLServerAuthentication -Subject "CN=$dns" -DnsName $dns -CertStoreLocation "Cert:\LocalMachine\My" -KeyAlgorithm RSA -KeyLength 2048 -HashAlgorithm SHA256 -KeyExportPolicy Exportable -NotAfter $expiry; $cert.Thumbprint

IMPORTANT

Use self-signed certificates only for testing. LDAP clients must explicitly trust the self-signed certificate before they can establish a trusted SSL or STARTTLS connection.

Summary

The Rublon Windows Certificate Export Helper exports a certificate and private key from the Windows Certificate Store to the PEM files required by the Rublon Authentication Proxy’s LDAP Proxy. Select a valid Server Authentication certificate with an exportable private key, protect the exported key with a password, add the generated paths and password to the LDAP Proxy configuration, and restart the Rublon Authentication Proxy service.

Related Posts

Rublon Authentication Proxy – Documentation

Configuring the Rublon Authentication Proxy as an LDAP Proxy Server

Configuring the Rublon Authentication Proxy Secret Source – Environment Variables (env)

Configuring the Rublon Authentication Proxy Secret Source – Windows Credential Manager