Administer > Configuration > Secure Connections > Configure Secure Connections for Client Browsers > Configure CSA to Use a Trusted Certificate Authority-Signed or Subordinate Certificate Authority-Signed Certificate

Configure CSA to Use a Trusted Certificate Authority-Signed or Subordinate Certificate Authority-Signed Certificate

This section describes the process you should follow to obtain, install, and configure a trusted third-party Certificate Authority-signed or subordinate Certificate Authority-signed certificate for use by CSA. The process by which you acquire a certificate depends on your organization. If you are obtaining a certificate from a trusted third-party Certificate Authority, such as Verisign, perform the following general steps, which are described in detail below. If you are generating and/or obtaining a certificate from an internal Certificate Authority, such as a corporate Certificate Authority, you should perform the general steps in Configure CSA to Use an Internal Certificate Authority-Signed Certificate.

  1. Create a keystore and a self-signed certificate
  2. Create a certificate signing request
  3. Submit the certificate signing request to a Certificate Authority
  4. Import the Certificate Authority's root certificate
  5. Import the Certificate Authority-signed certificate
  6. Configure the Marketplace Portal
  7. Configure the Web server
  8. Configure client browsers
  9. Test the secure connection

Note In the following instructions,

CSA_HOME is the directory in which CSA is installed

(for example, on Windows the directory is C:\Program Files\HPE\CSA and on Linux the directory is /usr/local/hpe/csa) and the keytool utility is included with the JRE.

Also, the following instructions are applicable for subordinate Certificate Authorities. Wherever the Certificate Authority is mentioned, the subordinate Certificate Authority is implied. For example, if the content states to submit the certificate to a Certificate Authority, you may also submit the certificate to a subordinate Certificate Authority.

Step 1: Create a Keystore and Self-Signed Certificate

Create a self-signed certificate to send with your request to a Certificate Authority by doing the following:

  1. Open a command prompt and change directories to CSA_HOME.

  2. Run the following command:

    Windows:

    "CSA_JRE_HOME\bin\keytool" -genkeypair -alias csa_ca_signed
    -validity 365 -keyalg rsa -keysize 2048 -keystore .\jboss‑as\standalone\configuration\.keystore_ca_signed

    Linux:

    CSA_JRE_HOME/bin/keytool -genkeypair -alias csa_ca_signed
    -validity 365 -keyalg rsa -keysize 2048 -keystore ./jboss‑as/standalone/configuration/.keystore_ca_signed

    where CSA_JRE_HOME is the directory in which the JRE that is used by CSA is installed

    You can use different values for -alias, -validity, -keysize and -keystore. These instructions assume that you will use the -alias and -keystore values recommended here; you will have to adjust the commands accordingly if you use different values.

  3. Enter a keystore password.

    This password is used to control access to the keystore. This password must be the same as the password you enter for the key later in this procedure.

  4. When you are prompted for your first and last name, enter the fully qualified domain name of the CSA server.

  5. Follow the prompts to enter the remaining organization and location values.

  6. Enter the keystore password you supplied earlier to use as the key password.

    Although keytool allows you to enter different passwords for the keystore and the key, the two passwords must be the same to work with CSA.

Step 2: Create a Certificate Signing Request

To enable a Certificate Authority to sign the self-signed certificate, you will need to create a Certificate Signing Request using the following procedure:

  1. Open a command prompt and change directories to CSA_HOME.

  2. Run the following command:

    Windows:

    "CSA_JRE_HOME\bin\keytool" -certreq -alias csa_ca_signed
    -file C:\csacsr.txt -keystore .\jboss‑as\standalone\configuration\.keystore_ca_signed

    Linux:

    CSA_JRE_HOME/bin/keytool -certreq -alias csa_ca_signed
    -file /tmp/csacsr.txt -keystore ./jboss‑as/standalone/configuration/.keystore_ca_signed

    where CSA_JRE_HOME is the directory in which the JRE that is used by CSA is installed

  3. When you are prompted for a password, enter the password you supplied for the keystore and key when you created the keystore and self-signed certificate in step 1.

Step 3: Submit the Certificate Signing Request to a Certificate Authority

Submit the Certificate Signing Request to the Certified Authority following the procedure used by your organization or the third-party provider. After the submission has been processed, you will receive a Certificate Authority-signed certificate and a root certificate for the Certificate Authority.

In our example, we will assume the Certificate Authority's root certificate is named csaca.cer, the Certificate Authority-signed certificate is named csa_ca_signed.cer, and that both are located in C:\ on Windows or in /tmp on Linux. .

Step 4: Import the Certificate Authority's Root Certificate

This step configures the JRE so it trusts the Certificate Authority that has signed your certificate. The JRE ships with a list of common, trusted Certificate Authority certificates that are stored in a keystore named cacerts. If the Certificate Authority used to sign your certificate is well known, it is likely that this root certificate is already present in the cacerts keystore. It is recommended that you perform the following steps even if you suspect that the certificate is already installed. The keytool command will detect if the certificate is already present, and you can exit the import process if the certificate exists.

  1. Open a command prompt.

  2. Run the following command:

    Windows:

    "CSA_JRE_HOME\bin\keytool" -importcert -alias csaca -file C:\csaca.cer -trustcacerts -keystore "CSA_JRE_HOME\lib\security\cacerts"

    Linux:

    CSA_JRE_HOME/bin/keytool -importcert -alias csaca -file /tmp/csaca.cer -trustcacerts -keystore CSA_JRE_HOME/lib/security/cacerts

    where CSA_JRE_HOME is the directory in which the JRE that is used by CSA is installed

  3. When prompted for the keystore password, enter changeit.

  4. Enter yes when prompted to trust the certificate.

Step 5: Import the Certificate Authority-Signed Certificate

  1. The Certificate Authority-signed certificate (csa_ca_signed.cer) contains a chain of certificates and you must copy the root and any intermediate certificates in the chain to separate files. Work with your security expert to copy each certificate to a separate file.

  2. Open a command prompt and change directories to CSA_HOME.

  3. Import the certificate file(s):

    You must import each separate file in the following order (each certificate must have a unique alias):

    • root certificate
    • intermediate or subordinate certificate(s) in hierarchical order
    • primary or end-user certificate

    For example, if the Certificate Authority-signed certificate contains three certificates (root, intermediate, and primary) and you copied the root certificate to C:\root.cer on Windows or /tmp/root.cer on Linux, and the intermediate certificate to C:\intermediate.cer on Windows or /tmp/intermediate.cer on Linux, (you will use the Certificate Authority-signed certificate as the primary certificate), run the following commands in the following order to import each certificate:

    Windows:

    "CSA_JR_HOME\bin\keytool" -importcert ‑alias csa_ca_signed_root ‑file C:\root.cer ‑trustcacerts ‑keystore .\jboss‑as\standalone\configuration\.keystore_ca_signed

    "CSA_JRE_HOME\bin\keytool" -importcert ‑alias csa_ca_signed_intermediate ‑file C:\intermediate.cer ‑trustcacerts ‑keystore .\jboss‑as\standalone\configuration\.keystore_ca_signed

    "CSA_JRE_HOME\bin\keytool" -importcert ‑alias csa_ca_signed ‑file C:\csa_ca_signed.cer ‑trustcacerts ‑keystore .\jboss‑as\standalone\configuration\.keystore_ca_signed

    Linux:

    CSA_JRE_HOME/bin/keytool -importcert ‑alias csa_ca_signed_root ‑file /tmp/root.cer ‑trustcacerts ‑keystore ./jboss‑as/standalone/configuration/.keystore_ca_signed

    CSA_JRE_HOME/bin/keytool -importcert ‑alias csa_ca_signed_intermediate ‑file /tmp/intermediate.cer ‑trustcacerts ‑keystore ./jboss‑as/standalone/configuration/.keystore_ca_signed

    CSA_JRE_HOME/bin/keytool -importcert ‑alias csa_ca_signed ‑file /tmp/csa_ca_signed.cer ‑trustcacerts ‑keystore ./jboss‑as/standalone/configuration/.keystore_ca_signed

    where CSA_JRE_HOME is the directory in which the JRE that is used by CSA is installed

    Use the alias of the primary certificate (csa_ca_signed) and keystore name (CSA_HOME/jboss-as/standalone/configuration/.keystore_ca_signed) when you configure the web server.

  4. When prompted, enter the password for the key and keystore.

    Use this password when you configure the web server.

Step 6: Configure the Marketplace Portal

This step converts the CSA keystore to a PKCS#12 archive and configures the Marketplace Portal to use the Certificate Authority-signed certificate.

  1. Open a command prompt and navigate to CSA_HOME.

  2. Convert the CSA keystore to a PKCS#12 archive. Run the following command:

    Windows:

    "CSA_JRE_HOME\bin\keytool" -importkeystore -srckeystore .\jboss‑as\standalone\configuration\.keystore_ca_signed -deststoretype PKCS12 -destkeystore .\portal\conf\.mppkeystore_ca_signed

    Linux:

    CSA_JRE_HOME/bin/keytool -importkeystore -srckeystore ./jboss‑as/standalone/configuration/.keystore_ca_signed -deststoretype PKCS12 -destkeystore ./portal/conf/.mppkeystore_ca_signed

  3. When prompted, enter the password for the PKCS#12 archive. You will need this password when you configure the passphrase attribute later in this section.

  4. When prompted, enter the password for the CSA keystore (changeit).

  5. Open the CSA_HOME/portal/conf/mpp.json file in a text editor.

  6. Update the ca attribute value for the provider. Enter the path to the certificate file that you imported in Step 5: Import the Certificate Authority-Signed Certificate. For example, C:\csa_ca_signed.cer on Windows or /tmp/csa_ca_signed.cer on Linux. If you imported a chain of certificates, use the certificate file of the primary certificate.

  7. Update the ca attribute value for the idmProvider. Enter the path to the certificate file that you imported in Step 5: Import the Certificate Authority-Signed Certificate. For example, C:\csa_ca_signed.cer on Windows or /tmp/csa_ca_signed.cer on Linux. If you imported a chain of certificates, use the certificate file of the primary certificate.

  8. Update the pfx attribute value. Enter the name of the PKS#12 archive you created earlier. For example, ..\conf\.mppkeystore_ca_signed.

  9. Update the passphrase attribute value. Enter the encrypted password used to access the .mppkeystore_ca_signed archive (see Encrypt a Marketplace Portal Password for instructions). An encrypted password is preceded by ENC without any separating spaces and is enclosed in parentheses.

  10. Save and exit the file.

Step 7: Configure the Web Server

  1. Open CSA_HOME/jboss‑as/standalone/configuration/standalone.xml in a text editor.

  2. Locate the following entry:

    <keystore path="CSA_HOME/jboss‑as/standalone/configuration/.keystore" keystore‑password="changeit"/>

  3. Set the path attribute to the keystore you used in Step 5: Import the Certificate Authority-Signed Certificate, set the password attribute to the value that corresponds to the password you selected for the keystore, and add the alias attribute and set it to the alias you used in Step 5: Import the Certificate Authority-Signed Certificate.

    <keystore path="CSA_HOME/jboss‑as/standalone/configuration/.keystore_ca_signed" keystore‑password="keystorePassword" alias="csa_ca_signed"/>

    Note If you imported a chain of certificates, use the alias of the primary certificate.

    Note This example stores the password in clear text. If you want to use an encrypted password, see Masking Passwords in standalone.xml Using the JBoss vault Script for information about creating a password vault for JBoss.

  4. Restart the CSA service.

    See Restart CSA for instructions.

  5. After the service has started, review the log files in the CSA_HOME/jboss‑as/standalone/log/ directory and verify that no TLS or keystore errors are present.

Step 8: Configure Client Browsers

The client browser must be configured to trust certificates that are signed by the Certificate Authority. In most situations, this step will already have occurred. Client browsers are likely to already trust well-known third-party Certificate Authorities, or will have previously accessed and trusted Web sites that use internal Certificate Authority root certificates.

To test whether or not the browser on a client system is configured to trust certificates signed by your Certificate Authority, open a supported Web browser and navigate to https://<csahostname>:8444/csa. If you do not see a certificate warning, then the browser is configured properly.

If client browsers need to be configured to trust certificates signed by your Certificate Authority, then you will need to make the root certificate available to clients so it can be installed in the browser. The process of installing the root certificate will vary based on the browser.

  • Microsoft Internet Explorer and Chrome: From Windows Explorer, double-click on the .cer file to begin the import process. Install the certificate in the Trusted Root Certification Authorities store. For information about how to import the certificate, see the browser's online documentation.
  • Firefox: To begin the import process, select Tools > Options, select Advanced, select the Encryption tab, and click View Certificates. Import the root certificate into the Authorities tab. For information about how to import the certificate, see the browser's online documentation.

Step 9: Test Secure Connections

To test the connection to the Cloud Service Management Console, on a client system, open a supported Web browser and navigate to https://<csahostname>:8444/csa where <csahostname> is the fully-qualified domain name of the system that was used when the certificate was created. If the client browser is configured to accept the Certificate Authority's root certificate and the Web application opens without a certificate warning, then you have successfully configured CSA to use a Certificate Authority-signed certificate. If a certificate warning is displayed, review steps 1-8 to be sure they were followed as documented.

Send Help Center feedback