Deployment Prerequisites¶
The following items must be in place before installing the NHI Security Platform. They apply to on-premises and private cloud deployments. SaaS deployments require only the items listed under SaaS customers.
Licence, Servers and Infrastructure¶
| Item | What you need |
|---|---|
| Installation package and licence | The Securden Unified PAM installation package and a licence key for either the complete NHI Security Platform or Certificate Management alone. |
| Servers | Servers that meet the specifications on the System Configuration page, each with a Windows Server licence. |
| Local admin rights | Local administrator rights on the application server to run the installation. |
| Firewall changes | Firewall rules approved before deployment. See the Ports Used page for the full list. |
| SSL certificate | A publicly trusted SSL certificate with its private key and the intermediate certificate authority (CA) bundle. It secures connections between users' browsers and the server. |
| DNS records | DNS records for the primary and secondary application servers, so users reach the console by name. |
| Load balancer or virtual IP (VIP) | Needed only if you run a secondary server for high availability. |
| Encryption key storage | A separate, access-controlled network location with a dedicated service account, or a hardware security module (HSM). The encryption key is kept away from the encrypted data. |
| Backup storage | A network path the server can write to, for encrypted database backups. |
| Mail server (SMTP) | SMTP server details so the platform can send email notifications, such as certificate expiry alerts and alerts about non-human identities and secrets. |
| Internet access | Outbound internet access from the application server to reach cloud and code repository APIs, public certificate authorities and ACME providers. If a proxy server controls internet traffic, have its address, port and credentials ready. |
| User directory (optional) | Connection details for Active Directory, Microsoft Entra ID or LDAP if users will sign in with their directory accounts, and for your single sign-on (SSO) or multi-factor authentication (MFA) provider if you use one. |
Data Source Access (NHI Only)¶
The platform discovers identities and secrets by connecting to each source with the credentials provided. A dedicated account or app for each source is recommended, so access can be reviewed and revoked independently.
| Data source | How Securden connects | What to prepare |
|---|---|---|
| AWS | Access key | An IAM (Identity and Access Management) user with an access key ID and secret access key. |
| Microsoft Azure | Service principal | An app registration in Microsoft Entra ID with its tenant ID, client ID and client secret. |
| GitHub | GitHub App | A GitHub App installed on your organisation. |
| Bitbucket | OAuth | An OAuth consumer in your Bitbucket workspace. |
| IIS Manager | Windows machine credentials, over SSH or WinRM | Credentials for a Windows account on each IIS server, with OpenSSH Server or WinRM over HTTPS (Windows Remote Management) enabled on the server. |
| Linux devices | Linux machine credentials, over SSH | A username and password for an account on each Linux device. |
Certificate Management¶
Required only when certificates are issued, renewed or deployed through the platform.
| Item | What you need |
|---|---|
| Public certificate authority | An account with the CA you buy certificates from (GoDaddy, The SSL Store, DigiCert, GlobalSign, Sectigo, Entrust or emSign) and its API credentials. |
| ACME provider | An account with an ACME provider (Let's Encrypt, Buypass Go SSL, ZeroSSL, Telia or any ACME-compatible provider) and a contact email. Some providers, such as ZeroSSL, also issue External Account Binding (EAB) keys that must be entered. ACME (Automatic Certificate Management Environment) is the protocol that issues and renews certificates automatically. |
| Domain validation | ACME providers check that you control each domain before issuing a certificate, usually through a web (HTTP) or DNS check. |
| Private certificate authority | A decision on whether to create a private root CA in Securden for internal certificates. |
| Certificate deployment targets | OpenSSH Server enabled on each Windows system that will receive certificates, and an account the platform can use to connect to it. |
SaaS Customers¶
Securden hosts the servers, database, SSL certificate, backups and encryption keys. SaaS customers provide:
- Data source access, as listed above (NHI only).
- Certificate authority and ACME provider accounts, if certificate management is used.
- User directory, SSO or MFA details, if users sign in through them.