You are establishing a cluster of HPE Aruba Networking ClearPass servers. (Assume that they are running version 6.9.). For which type of certificate it is recommended to install a CA-signed certificate on the Subscriber before it joins the cluster?

It is a security best practice and highly recommended to replace the default self-signed HTTPS certificate on any ClearPass server with a CA-signed certificate. This should be done on the Subscriber node before it joins the cluster. This ensures that administrators accessing the Subscriber's web-based management interface do not encounter browser trust errors. Secure, trusted HTTPS communication is fundamental for server management, including the initial cluster configuration steps performed via the user interface.

A. Database: The certificate for database replication between the Publisher and Subscriber is generated automatically by ClearPass during the cluster join process and is used for internal purposes only.
C. RADIUS/EAP: While a CA-signed RADIUS/EAP certificate is critical for production, it is synchronized from the Publisher to the Subscriber automatically after the node successfully joins the cluster.
D. RadSec: The RadSec certificate is used for securing RADIUS traffic between ClearPass and network access devices (NADs) over TLS; it is not required for the internal cluster formation process. ---

1. Aruba ClearPass Policy Manager 6.9 User Guide: In the chapter on "Clustering, Failover, and Redundancy," the section "Adding a Subscriber Node to a Cluster" notes that the RADIUS/EAP server certificate is automatically replicated from the publisher. This implies that installing it on the subscriber beforehand is not necessary, as it will be overwritten. The HTTPS certificate, however, pertains to the management of that specific node. (p. 218)

2. Aruba ClearPass Hardening Guide (for CPPM 6.7, principles apply to 6.9): Section "Install a new HTTPS Certificate" states, "The default installation of ClearPass includes a self-signed certificate for HTTPS communication... It is strongly recommended that you replace this certificate with one that is signed by a trusted certificate authority (CA)." This is a fundamental step for any managed server. (p. 6)

3. Aruba ClearPass Certificates 101 Technote: This guide explains the function of each certificate. It clarifies that the HTTPS certificate is for "securing WebUI access for administration" and other web-facing portals. It strongly recommends replacing the default self-signed certificate with a public CA-signed one to avoid trust errors for clients and administrators. (Section: "Server Certificates > HTTPS Certificate")