You can add and activate certificates for the appliance in thetab. You can create your own certificate and then have it signed by a CA, or you can use an existing certificate and key pair.
IMPORTANT:In this section, you can only manage certificates for the Advanced Authentication appliance (port 9443). To change the certificates for the Advanced Authentication application (port 443), goto thetab in the Administration portal.
The appliance is shipped with a self-signed digital certificate. Instead of using this self-signed certificate, it is recommended that you use a trusted server certificate that is signed by a trusted certificate authority (CA) such as VeriSign or Equifax.
Use this tool to manage the appliance’s certificates and maintain its certificate store.
Table 2-2 Using the Digital Certificates Page
Certificates in the Selected Key Store
Use this drop-down list to filter whether JVM or Web Application Certificates are listed.
This drop-down list lets you create a new key pair, import a trusted certificate or key pair, export a certificate you have selected in the list, or generate a Certificate Signing Request for a web application that you have selected.
This exposes the option to delete a certificate that you have selected.
This lets you view the information for a selected certificate.
This lets you reload a selected certificate.
Self-signed Certificate: The Micro Focus Appliance ships with a self-signed digital certificate.
If needed, you can generate appliance certificates and Certificate Sigining Requests for certificate authorities (CA) such as VeriSign or Equifax.
However, the self-signed certificate included with the appliance should be sufficient for the vast majority of deployments because security practices generally dictate that appliances be deployed inside an organization’s.
Java Certificates: All certificates for the IBM Java package bundled with the underlying SLES OS are installed with the appliance.
Unless instructed otherwise in the service documentation, you do not need to update certificates when you update a service that the appliance supports.
In the Port 9443 Console> drop-down list, ensure that is selected.
Click> , then specify the following information:
Alias: Specify a name that you want to use to identify and manage this certificate.
Validity (days): Specify how long you want the certificate to remain valid.
Key Algorithm: Select eitheror .
Key Size: Select the desired key size.
Signature Algorithm: Select the desired signature algorithm.
Common Name (CN): This must match the server name in the URL in order for browsers to accept the certificate for SSL communication.
Organizational Unit (OU): (Optional) Small organization name, such as a department or division. For example, Purchasing.
Organization (O): (Optional) Large organization name. For example, Micro Focus
City or Lacality (L): (Optional) City name. For example, Provo.
State or Province (ST): (Optional) State or province name. For example, Utah.
Two-letter Country Code (C): (Optional) Two-letter country code. For example, US.
Clickto create the self-signed certificate.
After selecting the self-signed certificate, click> > .
Send the certificate to a certificate authority (CA), such as Verisign, using whatever process they have defined.
Usually, the CA takes your Certificate Signing Request (CSR) and generates an official certificate based on the information in the CSR. The CA then mails the new certificate and certificate chain back to you.
After you have received the certificate and certificate chain from the CA:
Revisit the Digital Certificates page by clickingfrom the appliance.
Click> > . Browse to the trusted certificate chain that you received from the CA, then click .
Select the self-signed certificate, then click> > .
Browse to and upload the official certificate to be used to update the certificate information.
On the Digital Certificates page, the name in thecolumn for your certificate changes to the name of the CA that stamped your certificate.
Activate the certificate, as described in Activating a Certificate.
When you use an existing certificate and key pair, use a .P12 key pair format.
Click> > . Browse to and select your existing certificate, then click .
Click> > . Browse to your existing certificate chain for the certificate that you selected in Step 2, then click .
Click> > , then browse to and select your P12 key pair file, specify your password if needed, then click OK.
Because of a browser compatibility issue with HTML 5, the path to the certificate is sometimes shown as c:\fakepath. This does not adversely affect the import process.
Continue with Activating a Certificate.
On the Digital Certificates page, select the certificate that you want to make active, click, then click .
Verify that the certificate and the certificate chain were created correctly by selecting the certificate and clicking.
You can export the built-in self signed certificate and upload the same to the Administration portal throughpolicy.
On the Digital Certificates page, selectfrom .
Select the self-signed certificate and click> > .
Specify the password to export the certificate and click.
The certificate exports in .p12 format.
NOTE:You can convert the certificate to .pem format using the following OpenSSL command:
openssl pkcs12 -in path.p12 -out newfile.pem
Before uploading the .pem file to Administration portal ensure the file contains the text -----BEGIN PRIVATE KEY-----. If the private key is encrypted -----BEGIN ENCRYPTED PRIVATE KEY-----, then run the following command to decrypt the key:
openssl pkey -in newfile.pem -out foo.key