6.11 Creating SSL Certificate for Distributed Deployment

The following procedure explains how to create an SSL Certificate for distributed deployment:

Run the following command to set the Java path:
```
export PATH=/opt/netiq/common/jre/bin:$PATH
```
Ensure that java path is set on the server. For example:
```
export PATH=/opt/netiq/common/jre/bin/:$PATH
```
Create a sample working directory.
```
mkdir -p /opt/certs
```

Generate the PKCS keystore:

keytool -genkey -alias < alias_name > -keyalg RSA -keystore <absolute path of keystore > -validity 3650 -keysize 1024 -dname "CN=<Subject Alternate Name>" -keypass <keypass> -storepass <storepass>

Generate the CSR (Certificate Signing Request):

keytool -certreq -v -alias < alias_name >  -file < name of the csr file > -keypass < keypass >  -keystore < absolute path of the keystore >  -storepass < storepass >

Generate a self-signed certificate:
1. Launch Identity console and login.
2. Navigate to Certificate Management > Issue Certificate.
3. Browse to the .csr file created in step 3. For example, ua.csr.
4. Click Open.
5. Under Key Usage Specifications drop-down, Specify the key type.
6. Under Extended Key Usage Specifications drop-down, Specify the Extended key type.
7. For the certificate type, select Unspecified under Basic Constrains drop down.
8. Specify the validity of the certificate under Certificate Parameters drop down.
9. Select the File in binary DER format under Certificate format drop down.
10. Click Next.
11. Click OK.
12. Download the certificate and copy the downloaded certificate to the /data directory.
Export the root certificate in .der format:
1. Launch Identity console and login.
2. Navigate to Certificate Management > Server Certificate Management.
3. Select the SSL CertificateDNS check box and click Export.
4. In the Certificates drop-down list, select the Organizational CA.
5. In the Export Format drop-down list, select DER.
6. Click OK.
7. Download the certificate and copy the downloaded certificate to the /data directory.

Import the certificates into the PKCS keystore as explained earlier.

keytool -import -trustcacerts -alias root -keystore <name of the keystore> -file <root certificate > -storepass <password> -noprompt

For example:

keytool -import -alias <alias name> -keystore <name of the keystore> -file <self-signed certificate> -storepass <password> -noprompt

Repeat the above procedure for each of the osp, userapp and reporting if they are used in different machines.