This article applies as of PRTG 25

Client certificates

You can authenticate a server that connects to PRTG with a client certificate. When you set up client authentication, it increases the security and data integrity of the messages sent from PRTG.

You can authenticate with a client certificate when you use a notification template to send syslog messages via TLS (Setup | Notification Templates | Add Notification Template | Send Syslog Message) or when you send syslogs to a syslog server via the Audit Log feature (Core & Probes | Audit Log).

PRTG and client certificates

PRTG can access client certificates in two ways:

1. The client certificate is in your system certificate store.
2. You enter the client certificate, client certificate key, and optionally, the certificate key password manually in PRTG.

The benefit to using a client certificate in your system certificate store is the convenience when you need to change the client certificate when it expires.

When you use the system certificate store, you can tell PRTG to look for either the certificate's friendly name or thumbprint. If you configure PRTG to use a friendly name, you do not need to reconfigure PRTG again in terms of the client certificate. Instead, you can upload the new client certificate to the system certificate store and give it the same friendly name as the previous client certificate. PRTG finds the new client certificate and uses it immediately.

How to import a client certificate to the system certificate store

In order for PRTG to recognize and use a client certificate from the system certificate store, there are three settings you must use when you upload a new certificate.

1. Open your system's certificate store. For example, you can run certlm.msc as a command or search for "certificate" in the Windows taskbar. If you use the taskbar, your system should prompt you with three options in settings. Select Manage computer certificates.
   
   Click to enlarge.
2. Navigate to the folder where you want to import the client certificate.
   
   Important: Do not use the Personal folder. If you use the Personal folder, PRTG cannot find your certificate.
3. On the right-hand side, right click to open the context menu. Select All Tasks | Import.
   
   Click to enlarge.
4. The Certificate Import Wizard opens. Confirm that you are going to add a certificate to your Local Machine. Click Next.
   
   Click to enlarge.
5. Find the client certificate that you want to import and click Next.
   
   Click to enlarge.
   Note: If you use a PFX or P12 certificate, make sure that you mark the private key as exportable.
   
   Click to enlarge.
6. Choose if you want Windows to automatically select the location of the certificate store or if you want to define it manually. Click Next.
7. Click Finish to close the wizard. There is a notification if your import was successful, and you can now see the certificate in the system certificate store.

Set a friendly name

1. If you want to use a friendly name, navigate to the client certificate in the system certificate store
2. Right-click the certificate to open the context menu.
3. Click Properties.
4. In the general tab, go to the Friendly name setting. Enter a friendly name.
5. Click OK to save your changes.

You can now use the certificate's friendly name to configure PRTG.