Verify Certificates

LogRhythm and SQL Server support any certificates that the Windows operating system can support, including certificates using SHA1 through SHA512 for the signature algorithm.

Verify Certificates with Windows Certificate Manager

1. On the server where the certificates are installed, run mmc.exe.
2. On the File menu, click Add/Remove Snap-in.
3. Click the Certificates snap-in, and then click Add.
4. Select the Computer account option, and then click Next.
5. Select the Local computer option, and then click Finish.
6. In the Add or Remove Snap-ins dialog box, click OK.
7. Find your certificate.
   • Certificate Location: LocalMachine or CurrentUser
   • Certificate Store: MY (Personal) or ROOT
   Client and server certificates need to have their signing certificate (i.e., the Root CA certificate) in the Trusted Root Certification Authorities in order to pass the trusted authority check.
   Server authentication: -sky exchange -eku 1.3.6.1.5.5.7.3.1
8. Right-click the certificate, and then click Properties.
9. Click the Certification Path tab.
   You should see a tree structure with your certificate as the leaf and its signing certificate as the root. Additionally, the Certificate status field at the bottom of the dialog should state This certificate is OK.
10. (Optional) If you did not create your own certificates, if you are not sure where your certificate came from, or to verify that your certificate has the right attributes, complete the following steps:
    • Review the information on the General tab to ensure it says that the certificate can be verified up to a trusted certification authority.
    • Make sure your certificate’s signing certificate — the Root certificate authority (CA) that was used to generate your client or server certificate — is in the LocalComputer’s Trusted Root Certification Authorities store.
    • If it is a server certificate, make sure it has Server Authentication as an enhanced key usage value: 1.3.6.1.5.5.7.3.1.

Verify Data Indexer Certificates

1. Open the Configuration Manager. 
2. On the left, click Data Indexers.
3. To enable the Advanced View, on the bottom of the page, click Show.